Apple · iOS and macOS
CVE-2022-32893
Apple iOS and macOS Out-of-Bounds Write Vulnerability
Cos'è
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CISA: Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 8 settembre 2022
- Aggiunta all'elenco CISA
- 18 agosto 2022
- Pubblicato
- 24 agosto 2022
- Gravità
- Alta 8,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 9,9% tra il 4,4% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-20 CWE-787
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (17)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7SETAAXEPGNB…
- https://www.debian.org/security/2022/dsa-5220
- https://www.debian.org/security/2022/dsa-5219
- https://security.gentoo.org/glsa/202208-39
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKJGV2EXVMYQ…
- https://support.apple.com/en-us/HT213414
- https://support.apple.com/en-us/HT213412
- https://support.apple.com/en-us/HT213413
- http://www.openwall.com/lists/oss-security/2022/08/25/5
- http://www.openwall.com/lists/oss-security/2022/08/26/2
- http://www.openwall.com/lists/oss-security/2022/08/29/1
- http://www.openwall.com/lists/oss-security/2022/08/29/2
- https://lists.debian.org/debian-lts-announce/2022/08/msg00019.html
- http://seclists.org/fulldisclosure/2022/Aug/16
- http://www.openwall.com/lists/oss-security/2022/09/02/10
- http://www.openwall.com/lists/oss-security/2022/09/13/1
- http://seclists.org/fulldisclosure/2022/Oct/49
Altre falle sfruttate di Apple
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 18 ago 2022 | Out-of-Bounds Write | iOS and macOS | Alta 7,8 | 3,3% |
| 28 gen 2022 | Memory Corruption | iOS and macOS | Critica 9,8 | 12% |
| 3 nov 2021 | Group Facetime | iOS and macOS | Alta 7,5 | 2,6% |
| 29 set 2026 | Out-of-Bounds Write | Multiple Products | Alta 8,8 | 26% |
| 18 ago 2026 | Improper Authentication | macOS | Critica 9,8 | 1,7% |
| 20 mar 2026 | Buffer Overflow | Multiple Products | Alta 8,8 | 1,7% |
| 20 mar 2026 | Improper Locking | Multiple Products | Alta 7,8 | 0,4% |
| 20 mar 2026 | Classic Buffer Overflow | Multiple Products | Media 5,5 | 0,4% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.