Message-id: <CC62B0FE-8C64-41B5-903D-5C7D563DA9AB@lists.apple.com>
Date: Tue, 26 Sep 2023 14:29:58 -0700
From: Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-09-26-2023-2 macOS Sonoma 14

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-09-26-2023-2 macOS Sonoma 14

macOS Sonoma 14 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213940.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Airport
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to read sensitive location information
Description: A permissions issue was addressed with improved redaction
of sensitive information.
CVE-2023-40384: Adam M.

AMD
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2023-32377: ABC Research s.r.o.

AMD
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-38615: ABC Research s.r.o.

App Store
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: A remote attacker may be able to break out of Web Content
sandbox
Description: The issue was addressed with improved handling of
protocols.
CVE-2023-40448: w0wbox

Apple Neural Engine
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-40432: Mohamed GHANNAM (@_simo36)

Apple Neural Engine
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2023-40399: Mohamed GHANNAM (@_simo36)

Apple Neural Engine
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to disclose kernel memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2023-40410: Tim Michaud (@TimGMichaud) of Moveworks.ai

AuthKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access user-sensitive data
Description: The issue was addressed with improved handling of caches.
CVE-2023-32361: Csaba Fitzl (@theevilbit) of Offensive Security

Bluetooth
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An attacker in physical proximity can cause a limited out of
bounds write
Description: The issue was addressed with improved checks.
CVE-2023-35984: zer0k

Bluetooth
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2023-40402: Yiğit Can YILMAZ (@yilmazcanyigit)

Bluetooth
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to bypass certain Privacy preferences
Description: A permissions issue was addressed with additional
restrictions.
CVE-2023-40426: Yiğit Can YILMAZ (@yilmazcanyigit) 

bootp
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to read sensitive location information
Description: A privacy issue was addressed with improved private data
redaction for log entries.
CVE-2023-41065: Adam M., and Noah Roskin-Frazee and Professor Jason Lau
(ZeroClicks.ai Lab)

Calendar
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access calendar data saved to a temporary
directory
Description: A privacy issue was addressed with improved handling of
temporary files.
CVE-2023-29497: Kirin (@Pwnrin) and Yishu Wang

CFNetwork
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may fail to enforce App Transport Security
Description: The issue was addressed with improved handling of
protocols.
CVE-2023-38596: Will Brattain at Trail of Bits

ColorSync
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to read arbitrary files
Description: The issue was addressed with improved checks.
CVE-2023-40406: JeongOhKyea of Theori

CoreAnimation
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Processing web content may lead to a denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2023-40420: 이준성(Junsung Lee) of Cross Republic

CUPS
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: A remote attacker may be able to cause a denial-of-service
Description: The issue was addressed with improved bounds checks.
CVE-2023-40407: Sei K.

Dev Tools
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to gain elevated privileges
Description: This issue was addressed with improved checks.
CVE-2023-32396: Mickey Jin (@patch1t)

FileProvider
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to bypass Privacy preferences
Description: A permissions issue was addressed with additional
restrictions.
CVE-2023-41980: Noah Roskin-Frazee and Professor Jason Lau
(ZeroClicks.ai Lab)

Game Center
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access contacts
Description: The issue was addressed with improved handling of caches.
CVE-2023-40395: Csaba Fitzl (@theevilbit) of Offensive Security

GPU Drivers
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2023-40391: Antonio Zekic (@antoniozekic) of Dataflow Security

GPU Drivers
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Processing web content may lead to a denial-of-service
Description: A resource exhaustion issue was addressed with improved
input validation.
CVE-2023-40441: Ron Masas of Imperva

iCloud
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with improved redaction
of sensitive information.
CVE-2023-23495: Csaba Fitzl (@theevilbit) of Offensive Security

iCloud Photo Library
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access a user's Photos Library
Description: A configuration issue was addressed with additional
restrictions.
CVE-2023-40434: Mikko Kenttälä (@Turmio_ ) of SensorFu

Image Capture
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2023-38586: Yiğit Can YILMAZ (@yilmazcanyigit)

IOAcceleratorFamily
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An attacker may be able to cause unexpected system termination
or read kernel memory
Description: The issue was addressed with improved bounds checks.
CVE-2023-40436: Murray Mike

Kernel
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2023-41995: Certik Skyfall Team, and pattern-f (@pattern_F_) of Ant
Security Light-Year Lab

Kernel
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An attacker that has already achieved kernel code execution may
be able to bypass kernel memory mitigations
Description: The issue was addressed with improved memory handling.
CVE-2023-41981: Linus Henze of Pinauten GmbH (pinauten.de)

Kernel
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-41984: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with improved validation.
CVE-2023-40429: Michael (Biscuit) Thomas and 张师傅(@京东蓝军)

LaunchServices
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may bypass Gatekeeper checks
Description: A logic issue was addressed with improved checks.
CVE-2023-41067: Ferdous Saljooki (@malwarezoo) of Jamf Software and an
anonymous researcher

libpcap
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: A remote user may cause an unexpected app termination or
arbitrary code execution
Description: This issue was addressed with improved checks.
CVE-2023-40400: Sei K.

libxpc
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with additional
restrictions.
CVE-2023-40454: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab
(xlab.tencent.com)

libxpc
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access protected user data
Description: An authorization issue was addressed with improved state
management.
CVE-2023-41073: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab
(xlab.tencent.com)

libxslt
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Processing web content may disclose sensitive information
Description: The issue was addressed with improved memory handling.
CVE-2023-40403: Dohyun Lee (@l33d0hyun) of PK Security

Maps
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to read sensitive location information
Description: The issue was addressed with improved handling of caches.
CVE-2023-40427: Adam M., and Wojciech Regula of SecuRing
(wojciechregula.blog)

Messages
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to observe unprotected user data
Description: A privacy issue was addressed with improved handling of
temporary files.
CVE-2023-32421: Meng Zhang (鲸落) of NorthSea, Ron Masas of BreakPoint
Security Research, Brian McNulty, and Kishan Bagaria of Texts.com

Music
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to modify protected parts of the file system
Description: The issue was addressed with improved checks.
CVE-2023-41986: Gergely Kalman (@gergely_kalman)

NetFSFramework
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: A permissions issue was addressed with additional
restrictions.
CVE-2023-40455: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab
(xlab.tencent.com)

Notes
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access Notes attachments
Description: A privacy issue was addressed with improved handling of
temporary files.
CVE-2023-40386: Kirin (@Pwnrin)

Power Management
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: A user may be able to view restricted content from the lock
screen
Description: A lock screen issue was addressed with improved state
management.
CVE-2023-37448: Serkan Erayabakan, David Kotval, Akincibor, Sina Ahmadi
of George Mason University, and Dominic Tabrizi

Pro Res
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-41063: Certik Skyfall Team

QuartzCore
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to cause a denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2023-40422: Tomi Tokics (@tomitokics) of iTomsn0w

Safari
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Processing web content may disclose sensitive information
Description: The issue was addressed with improved checks.
CVE-2023-39233: Luan Herrera (@lbherrera_)

Safari
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Safari may save photos to an unprotected location
Description: A privacy issue was addressed with improved handling of
temporary files.
CVE-2023-40388: Kirin (@Pwnrin)

Safari
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to identify what other apps a user has
installed
Description: The issue was addressed with improved checks.
CVE-2023-35990: Adriatik Raci of Sentry Cybersecurity

Safari
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Visiting a website that frames malicious content may lead to UI
spoofing
Description: A window management issue was addressed with improved state
management.
CVE-2023-40417: Narendra Bhati From Suma Soft Pvt. Ltd, Pune (India)

Sandbox
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to overwrite arbitrary files
Description: The issue was addressed with improved bounds checks.
CVE-2023-40452: Yiğit Can YILMAZ (@yilmazcanyigit)

Screen Sharing
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to bypass certain Privacy preferences
Description: An authorization issue was addressed with improved state
management.
CVE-2023-41078: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab
(xlab.tencent.com)

Share Sheet
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access sensitive data logged when a user
shares a link
Description: A logic issue was addressed with improved checks.
CVE-2023-41070: Kirin (@Pwnrin)

Shortcuts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: A shortcut may output sensitive user data without consent
Description: This issue was addressed by adding an additional prompt for
user consent.
CVE-2023-40541: Noah Roskin-Frazee (ZeroClicks.ai Lab) and James Duffy
(mangoSecure)

Shortcuts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to bypass Privacy preferences
Description: The issue was addressed with improved permissions logic.
CVE-2023-41079: Ron Masas of BreakPoint.sh and an anonymous researcher

StorageKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to read arbitrary files
Description: This issue was addressed with improved validation of
symlinks.
CVE-2023-41968: Mickey Jin (@patch1t) and James Hutchins

System Preferences
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may bypass Gatekeeper checks
Description: The issue was addressed with improved checks.
CVE-2023-40450: Thijs Alkemade (@xnyhps) from Computest Sector 7

TCC
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to access user-sensitive data
Description: The issue was addressed with improved checks.
CVE-2023-40424: Arsenii Kostromin (0x3c3e), Joshua Jewett
(@JoshJewett33), and Csaba Fitzl (@theevilbit) of Offensive Security

WebKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Processing web content may lead to arbitrary code execution
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 249451
CVE-2023-39434: Francisco Alonso (@revskills), and Dohyun Lee
(@l33d0hyun) of PK Security

WebKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 256551
CVE-2023-41074: 이준성(Junsung Lee) of Cross Republic and me Li

WebKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 239758
CVE-2023-35074: Abysslab Dong Jun Kim(@smlijun) and Jong Seong
Kim(@nevul37)

WebKit
Available for: Available for: Mac Studio (2022 and later), iMac (2019
and later), Mac Pro (2019 and later), Mac mini (2018 and later), MacBook
Air (2018 and later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: Processing web content may lead to arbitrary code execution.
Apple is aware of a report that this issue may have been actively
exploited against versions of iOS before iOS 16.7.
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 261544
CVE-2023-41993: Bill Marczak of The Citizen Lab at The University of
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Windows Server
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to unexpectedly leak a user's credentials
from secure text fields
Description: An authentication issue was addressed with improved state
management.
CVE-2023-41066: An anonymous researcher and Jeremy Legendre of
MacEnhance

XProtectFramework
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and later), MacBook Air (2018 and
later), MacBook Pro (2018 and later), and iMac Pro (2017)
Impact: An app may be able to modify protected parts of the file system
Description: A race condition was addressed with improved locking.
CVE-2023-41979: Koh M. Nakagawa (@tsunek0h)

Additional recognition

Airport
We would like to acknowledge Adam M., Noah Roskin-Frazee and Professor
Jason Lau (ZeroClicks.ai Lab) for their assistance.

AppKit
We would like to acknowledge an anonymous researcher for their
assistance.

AppSandbox
We would like to acknowledge Kirin (@Pwnrin) for their assistance.

Archive Utility
We would like to acknowledge Mickey Jin (@patch1t) for their assistance.

Audio
We would like to acknowledge Mickey Jin (@patch1t) for their assistance.

Bluetooth
We would like to acknowledge Jianjun Dai and Guang Gong of 360
Vulnerability Research Institute for their assistance.

Core Location
We would like to acknowledge Wouter Hennen for their assistance.

CoreMedia Playback
We would like to acknowledge Mickey Jin (@patch1t) for their
assistance. 

Data Detectors UI
We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi
Narain College Of Technology Bhopal for their assistance.

Find My
We would like to acknowledge Cher Scarlett for their assistance.

Home
We would like to acknowledge Jake Derouin (jakederouin.com) for their
assistance.

IOGraphics
We would like to acknowledge an anonymous researcher for their
assistance.

Kernel
We would like to acknowledge Bill Marczak of The Citizen Lab at The
University of Toronto's Munk School and Maddie Stone of Google's Threat
Analysis Group, Xinru Chi of Pangu Lab, 永超 王 for their assistance.

libxml2
We would like to acknowledge OSS-Fuzz, Ned Williamson of Google Project
Zero for their assistance.

libxpc
We would like to acknowledge an anonymous researcher for their
assistance.

libxslt
We would like to acknowledge Dohyun Lee (@l33d0hyun) of PK Security,
OSS-Fuzz, Ned Williamson of Google Project Zero for their assistance.

Model I/O
We would like to acknowledge Mickey Jin (@patch1t) for their assistance.

NSURL
We would like to acknowledge Zhanpeng Zhao (行之), 糖豆爸爸(@晴天组织) for their
assistance.

PackageKit
We would like to acknowledge Csaba Fitzl (@theevilbit) of Offensive
Security, an anonymous researcher for their assistance.

Photos
We would like to acknowledge Anatolii Kozlov, Dawid Pałuska, Kirin
(@Pwnrin), Lyndon Cornelius, Paul Lurin for their assistance.

Reminders
We would like to acknowledge Paweł Szafirowski for their assistance.

Safari
We would like to acknowledge Kang Ali of Punggawa Cyber Security for
their assistance.

Sandbox
We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for
their assistance.

SharedFileList
We would like to acknowledge Christopher Lopez - @L0Psec and Kandji, Leo
Pitt of Zoom Video Communications, Ross Bingham (@PwnDexter) for their
assistance.

Shortcuts
We would like to acknowledge Alfie Cockell Gwinnett, Christian Basting
of Bundesamt für Sicherheit in der Informationstechnik, Cristian Dinca
of "Tudor Vianu" National High School of Computer Science, Romania,
Giorgos Christodoulidis, Jubaer Alnazi of TRS Group Of Companies,
KRISHAN KANT DWIVEDI, Matthew Butler for their assistance.

Software Update
We would like to acknowledge Omar Siman for their assistance.

Spotlight
We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi
Narain College Of Technology Bhopal, Dawid Pałuska for their assistance.

StorageKit
We would like to acknowledge Mickey Jin (@patch1t) for their
assistance. 

Video Apps
We would like to acknowledge James Duffy (mangoSecure) for their
assistance.

WebKit
We would like to acknowledge Khiem Tran, Narendra Bhati From Suma Soft
Pvt. Ltd, Pune (India), and an anonymous researcher for their
assistance.

WebRTC
We would like to acknowledge anonymous researcher for their assistance.

Wi-Fi
We would like to acknowledge Wang Yu of Cyberserval for their
assistance.

macOS Sonoma 14 may be obtained from the Mac App Store or Apple's
Software Downloads web site: https://support.apple.com/downloads/
All information is also posted on the Apple Security Updates
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJYACgkQX+5d1TXa
Ivrk+g/+Lkdk6oQX2rdV0cKhvCLM2636CQHQ95vNRXa/8YyswpZhC9f76J5Hcw5f
/pL10ZFlpQ67spCCT4Np3g3BWPcypgt6ABaQJRYeuLSEUevg4tm80IRDaIJanKhh
oqxS3hH3JY3KxEy0Z0ykZODDgeJqZ5DjJloZHLcO5s0sDzn8GOfF0b+egvfI50Nr
S4BJI00jyXf/onZ6DwvI7HtSBFcqxBYZTsVXUd414bCkQyap1Pz0ExMJbZk/Hy1L
SlrX0xnxjt84GphN6T360VQCu1MKG61cVa7/60J7ihko8j8TPkpnaCLMT4WktvkZ
d6Xq2AelFQMVq8KlOmtzSFYlaC4j1w87T9fSuv8RFYUQdESAVYOGKYo1LQXrEdhS
ALXIqA721/mhlWombQKnhRE6bS5FIFfUEMbD2pqthsh79kScOJaPrs8mEOU9vq28
cd+DJkj6FH+TI1nv8zffx/Uw7G+yrTXSqneJG4nczjyhNKWsmO45YvOp1YQm3S/W
q5ObRax0OCIMF3S6phRrMazz5568Eir4OMHD2eXOkfB1qZQvrs0zrqXOUWmZ+LYT
au0xJAEGHDYo6/3JeYHJJAiO4H8jERKj643dWaBgaViZUA4V12qv9a846SAYoGZE
4LYnTVuv8ngCi51YfGYggCFayGGL6O0oKqXbEuXT2wHFsxViK18=
=OJQz
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists