CVE-2024-23268
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
Published: Mar 7, 2024
010
CVSS 7.8EPSS 0.05%High
CVE info copied to clipboard
An injection issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
Detection in Vulnerability Scanners
Detection for the vulnerability has been added to Qualys (379477)
Mar 7, 2024 at 6:15 PM
CVE Assignment
NVD published the first details for CVE-2024-23268
Mar 7, 2024 at 6:15 PM
Detection in Vulnerability Scanners
Detection for the vulnerability has been added to Nessus (191714)
Mar 7, 2024 at 6:16 PM
First Article
Feedly found the first article mentioning CVE-2024-23268. See article
Mar 7, 2024 at 6:51 PM / Apple Security updates
CVSS Estimate
Feedly estimated the CVSS score as HIGH
Mar 7, 2024 at 10:14 PM
CVSS Estimate
Feedly estimated the CVSS score as MEDIUM
Mar 8, 2024 at 6:32 AM
Affected Systems
Apple/macos
+null more
Patches
Apple
+null more
Links to Mitre Att&cks
T1562.003: Impair Command History Logging
+null more
Attack Patterns
CAPEC-10: Buffer Overflow via Environment Variables
+null more
References
About the security content of macOS Sonoma 14.4
Impact: A malicious app may be able to observe user data in log entries related to accessibility notifications Impact: Processing a file may lead to unexpected app termination or arbitrary code execution
News
Government issues important warning for iPhone, iPad and other Apple devices
The government body has said that several ‘high’ severity vulnerabilities have been found within different Apple operating systems that power the company’s devices which could lead to unauthorised access to the devices and also allow attackers to run arbitrary codes when exploited successfully. Apple macOS Sonoma versions prior to 14.4
Apple Security Advisory 03-07-2024-2
Apple Security Advisory 03-07-2024-2 - macOS Sonoma 14.4 addresses buffer overflow, bypass, code execution, out of bounds read, out of bounds write, and spoofing vulnerabilities.
APPLE-SA-03-07-2024-4 macOS Monterey 12.7.4
Posted by Apple Product Security via Fulldisclosure on Mar 13 APPLE-SA-03-07-2024-4 macOS Monterey 12.7.4 macOS Monterey 12.7.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214083 . Apple maintains a Security Releases page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Admin Framework Available for: macOS Monterey Impact: An app may be able to elevate privileges Description: A...
APPLE-SA-03-07-2024-2 macOS Sonoma 14.4
CVE-2024-23253: Mickey Jin (@patch1t) Image Processing Available for: macOS Sonoma Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2024-23257: Junsung Lee working with Trend Micro Zero Day Initiative ImageIO Available for: macOS Sonoma Impact: Processing an image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation.
macOS Monterey: CVSS (Max): 7.8*
CVE-2024-23269: Mickey Jin (@patch1t) ColorSync Available for: macOS Monterey Impact: Processing a file may lead to unexpected app termination or arbitrary code execution Description: The issue was addressed with improved memory handling. Nakagawa of FFRI Security, Inc. and an anonymous researcher MediaRemote Available for: macOS Monterey Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information.
See 22 more articles and social media posts