Message-id: <A619B6ED-6D80-4560-975D-700611CD9B11@lists.apple.com>
Date: Wed, 25 Oct 2023 12:03:38 -0700
From: Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-10-25-2023-4 macOS Sonoma 14.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-10-25-2023-4 macOS Sonoma 14.1

macOS Sonoma 14.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213984.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

App Support
Available for: macOS Sonoma
Impact: Parsing a file may lead to an unexpected app termination or
arbitrary code execution
Description: This issue was addressed by removing the vulnerable code.
CVE-2023-30774

AppSandbox
Available for: macOS Sonoma
Impact: An app may be able to access user-sensitive data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2023-40444: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)

Contacts
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved private data
redaction for log entries.
CVE-2023-41072: Wojciech Regula of SecuRing (wojciechregula.blog) and
Csaba Fitzl (@theevilbit) of Offensive Security
CVE-2023-42857: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)

CoreAnimation
Available for: macOS Sonoma
Impact: An app may be able to cause a denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2023-40449: Tomi Tokics (@tomitokics) of iTomsn0w

Emoji
Available for: macOS Sonoma
Impact: An attacker may be able to execute arbitrary code as root from
the Lock Screen
Description: The issue was addressed by restricting options offered on a
locked device.
CVE-2023-41989: Jewel Lambert

FileProvider
Available for: macOS Sonoma
Impact: An app may be able to cause a denial-of-service to Endpoint
Security clients
Description: This issue was addressed by removing the vulnerable code.
CVE-2023-42854: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)

Find My
Available for: macOS Sonoma
Impact: An app may be able to read sensitive location information
Description: The issue was addressed with improved handling of caches.
CVE-2023-40413: Adam M.

Foundation
Available for: macOS Sonoma
Impact: A website may be able to access sensitive user data when
resolving symlinks
Description: This issue was addressed with improved handling of
symlinks.
CVE-2023-42844: Ron Masas of BreakPoint.SH

ImageIO
Available for: macOS Sonoma
Impact: Processing an image may result in disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2023-40416: JZ

IOTextEncryptionFamily
Available for: macOS Sonoma
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-40423: an anonymous researcher

iperf3
Available for: macOS Sonoma
Impact: A remote user may be able to cause unexpected app termination or
arbitrary code execution
Description: The issue was addressed with improved checks.
CVE-2023-38403

Kernel
Available for: macOS Sonoma
Impact: An attacker that has already achieved kernel code execution may
be able to bypass kernel memory mitigations
Description: The issue was addressed with improved memory handling.
CVE-2023-42849: Linus Henze of Pinauten GmbH (pinauten.de)

LaunchServices
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: The issue was addressed with improved permissions logic.
CVE-2023-42850: Thijs Alkemade (@xnyhps) from Computest Sector 7, Brian
McNulty, Zhongquan Li

Login Window
Available for: macOS Sonoma
Impact: An attacker with knowledge of a standard user's credentials can
unlock another standard user's locked screen on the same Mac
Description: A logic issue was addressed with improved state management.
CVE-2023-42861: Jon Crain, 凯 王, Brandon Chesser & CPU IT, inc, Matthew
McLean, Steven Maser, and Avalon IT Team of Concentrix

Mail Drafts
Available for: macOS Sonoma
Impact: Hide My Email may be deactivated unexpectedly
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2023-40408: Grzegorz Riegel

Maps
Available for: macOS Sonoma
Impact: An app may be able to read sensitive location information
Description: A privacy issue was addressed with improved private data
redaction for log entries.
CVE-2023-40405: Csaba Fitzl (@theevilbit) of Offensive Security

Model I/O
Available for: macOS Sonoma
Impact: Processing a file may lead to unexpected app termination or
arbitrary code execution
Description: The issue was addressed with improved memory handling.
CVE-2023-42856: Michael DePlante (@izobashi) of Trend Micro Zero Day
Initiative

Networking
Available for: macOS Sonoma
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2023-40404: Certik Skyfall Team

Passkeys
Available for: macOS Sonoma
Impact: An attacker may be able to access passkeys without
authentication
Description: A logic issue was addressed with improved checks.
CVE-2023-42847: an anonymous researcher

Photos
Available for: macOS Sonoma
Impact: Photos in the Hidden Photos Album may be viewed without
authentication
Description: An authentication issue was addressed with improved state
management.
CVE-2023-42845: Bistrit Dahla

Pro Res
Available for: macOS Sonoma
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-42841: Mingxuan Yang (@PPPF00L), happybabywu and Guang Gong of
360 Vulnerability Research Institute

Safari
Available for: macOS Sonoma
Impact: Visiting a malicious website may reveal browsing history
Description: The issue was addressed with improved handling of caches.
CVE-2023-41977: Alex Renda

Safari
Available for: macOS Sonoma
Impact: Visiting a malicious website may lead to user interface spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2023-42438: Rafay Baloch & Muhammad Samaak, an anonymous researcher

Siri
Available for: macOS Sonoma
Impact: An attacker with physical access may be able to use Siri to
access sensitive user data
Description: This issue was addressed by restricting options offered on
a locked device.
CVE-2023-41982: Bistrit Dahla
CVE-2023-41997: Bistrit Dahla
CVE-2023-41988: Bistrit Dahla

talagent
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional
restrictions.
CVE-2023-40421: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)

Terminal
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: The issue was addressed with improved checks.
CVE-2023-42842: an anonymous researcher

Vim
Available for: macOS Sonoma
Impact: Processing malicious input may lead to code execution
Description: A use-after-free issue was addressed with improved memory
management.
CVE-2023-4733
CVE-2023-4734
CVE-2023-4735
CVE-2023-4736
CVE-2023-4738
CVE-2023-4750
CVE-2023-4751
CVE-2023-4752
CVE-2023-4781

Weather
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved private data
redaction for log entries.
CVE-2023-41254: Cristian Dinca of "Tudor Vianu" National High School of
Computer Science, Romania

WebKit
Available for: macOS Sonoma
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 259836
CVE-2023-40447: 이준성(Junsung Lee) of Cross Republic

WebKit
Available for: macOS Sonoma
Impact: Processing web content may lead to arbitrary code execution
Description: A use-after-free issue was addressed with improved memory
management.
WebKit Bugzilla: 259890
CVE-2023-41976: 이준성(Junsung Lee)

WebKit
Available for: macOS Sonoma
Impact: Processing web content may lead to arbitrary code execution
Description: A logic issue was addressed with improved checks.
WebKit Bugzilla: 260173
CVE-2023-42852: an anonymous researcher

WebKit Process Model
Available for: macOS Sonoma
Impact: Processing web content may lead to a denial-of-service
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 260757
CVE-2023-41983: 이준성(Junsung Lee)

WindowServer
Available for: macOS Sonoma
Impact: A website may be able to access the microphone without the
microphone use indicator being shown
Description: This issue was addressed by removing the vulnerable code.
CVE-2023-41975: an anonymous researcher

Additional recognition

libarchive
We would like to acknowledge Bahaa Naamneh for their assistance.

libxml2
We would like to acknowledge OSS-Fuzz, Ned Williamson of Google Project
Zero for their assistance.

Login Window
We would like to acknowledge an anonymous researcher for their
assistance.

man
We would like to acknowledge Kirin (@Pwnrin) for their assistance.

Power Manager
We would like to acknowledge Xia0o0o0o (@Nyaaaaa_ovo) of University of
California, San Diego for their assistance.

Reminders
We would like to acknowledge Noah Roskin-Frazee and Prof. J.
(ZeroClicks.ai Lab) for their assistance.

WebKit
We would like to acknowledge an anonymous researcher for their
assistance.

macOS Sonoma 14.1 may be obtained from the Mac App Store or Apple's
Software Downloads web site: https://support.apple.com/downloads/
All information is also posted on the Apple Security Updates
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmU5Y1gACgkQX+5d1TXa
Ivp59RAA2EQwY61OvHZQ0u99Wov8TAoM9popyjLrkWBvKbTH03vdZIXyeCOaqFR8
aT5SAlRwGOv0QIp/KmRweGlLl96/YP5fhgmDxISwahJZqOuwFkcj9OTfmoENyd6w
7YYr0BwSfFhrFEQm/OdE4TbiXp+87YiPXA0NPVeClw15bpmQ830aIY3iMJrCLcAE
ZI6QW9Yi3ynYhor1U+24V8hCM6LgMClNCWavZMorx3D1dfcPkhfspZL1cLqrGNqz
cCF0IJaJDqKiFG//4FQqDbMOUuP3/FMkH4vED+9krIRqe51P6XDkVeI/BgFo6wpu
hgZVgcPxMgbeiZX7O4BAY/ygLe2pKpyvBDJKCCo4GjkypcjmFhyyul+J45yLOSA1
+x9EzYE8OSOn4dGA+qT9aKC4Csti9idoK0KsYHN7jCLU56Y9gvIV2n+PcWVhI4RF
gE4BD+71vPyn6+tpf27+Kt5qW1Mj3ru6Q3u0w2xobbLdpgxc66EfCn2ZLxuzSqvc
kSgwf1yOpiMLzBMAqWxgX51qppsQA1du8G6ZNmPjdyV28GpaWNzL/qb3vivaSYkK
b6vrLEGID7U4wFjbVfuc7v0xmZeOgUprH6eQ7PnjRdmMq0xDaW8xFs3iGc6GScvl
ZCI4CcZSLGPrCzmyUpbD+OMFT4SDDaOGSNEXW7jOrRjgQMc6bJQ=
=YgRC
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists