Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system.

A zero-day vulnerability, tracked as CVE-2022-2294, is a memory corruption issue in Safari. An attacker could exploit this vulnerability using maliciously crafted web content to obtain arbitrary code execution.

Proof-of-Concept for vulnerabilities in iOS, iPadOS, and macOS released

A proof-of-concept (PoC) is now available for remote code execution (RCE) vulnerabilities known as CVE-2022-32845, CVE-2022-32948, CVE-2022-42805, CVE-2022-32899.

Threat updates

Date	Update
17 Nov 2022	Proof-of-Concept Released This Cyber Alert is updated to reflect the release of a PoC involving multiple vulnerabilities.

Remediation advice

Affected organisations are encouraged to review the Apple security advisories and apply the following relevant updates.

Remediation steps

Type	Step
Patch	Safari 15.6 https://support.apple.com/kb/HT213341
Patch	tvOS 15.6 https://support.apple.com/kb/HT213342
Patch	macOS Catalina Security Update 2022-005 https://support.apple.com/kb/HT213343
Patch	macOS Big Sur 11.6.8 https://support.apple.com/kb/HT213344
Patch	macOS Monterey 12.5 https://support.apple.com/kb/HT213345
Patch	iOS 15.6 and iPadOS 15.6 https://support.apple.com/kb/HT213346
Patch	watchOS 8.7 https://support.apple.com/kb/HT213340

Definitive source of threat updates

https://support.apple.com/en-us/HT201222

CVE Vulnerabilities

Status Published

CVE-2022-2294

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Status Published

CVE-2022-32845

This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to break out of its sandbox.

Status Reserved

CVE-2022-32948

Status Reserved

CVE-2022-42805

Status Published

CVE-2022-32899

The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13, watchOS 9. An app may be able to execute arbitrary code with kernel privileges.

Last edited: 17 November 2022 3:01 pm