Alongside iOS 17.2 arriving today, Apple has released macOS 14.2. As it happens, the new Mac release comes with double the amount of security fixes of iOS. Here are the 20 flaws fixed with the latest update.
Apple’s security updates page shared all the details of the vulnerability fixes that come with macOS Sonoma 14.2. Fortunately, like the 10 security patches in iOS 17.2, none of the 20 flaws fixed in macOS 14.2 were known as actively exploited.
But the update is still important to install as it fixes issues like:
- Bluetooth issue where “An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard”
- Find My bug where an “app may be able to read sensitive location information”
- Kernel flaw where an “app may be able to break out of its sandbox”
- CoreMedia Playback bug where an “app may be able to access user-sensitive data”
- WebKit flaw where “Processing web content may lead to arbitrary code execution”
A similar security patch comes with macOS Ventura 13.6.3 and Monterey 12.7.2. Check your Mac’s System Settings now to see if the update is available.
Here are the full security release notes for macOS 14.2:
Accessibility
Available for: macOS Sonoma
Impact: Secure text fields may be displayed via the Accessibility Keyboard when using a physical keyboard
Description: This issue was addressed with improved state management.
CVE-2023-42874: Don Clarke
Accounts
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved private data redaction for log entries.
CVE-2023-42919: Kirin (@Pwnrin)
AppleEvents
Available for: macOS Sonoma
Impact: An app may be able to access information about a user’s contacts
Description: This issue was addressed with improved redaction of sensitive information.
CVE-2023-42894: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)
AppleGraphicsControl
Available for: macOS Sonoma
Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved input validation.
CVE-2023-42901: Ivan Fratric of Google Project Zero
CVE-2023-42902: Ivan Fratric of Google Project Zero, and Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
CVE-2023-42912: Ivan Fratric of Google Project Zero
CVE-2023-42903: Ivan Fratric of Google Project Zero
CVE-2023-42904: Ivan Fratric of Google Project Zero
CVE-2023-42905: Ivan Fratric of Google Project Zero
CVE-2023-42906: Ivan Fratric of Google Project Zero
CVE-2023-42907: Ivan Fratric of Google Project Zero
CVE-2023-42908: Ivan Fratric of Google Project Zero
CVE-2023-42909: Ivan Fratric of Google Project Zero
CVE-2023-42910: Ivan Fratric of Google Project Zero
CVE-2023-42911: Ivan Fratric of Google Project Zero
CVE-2023-42926: Ivan Fratric of Google Project Zero
AppleVA
Available for: macOS Sonoma
Impact: Processing an image may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
CVE-2023-42882: Ivan Fratric of Google Project Zero
Archive Utility
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A logic issue was addressed with improved checks.
CVE-2023-42924: Mickey Jin (@patch1t)
AVEVideoEncoder
Available for: macOS Sonoma
Impact: An app may be able to disclose kernel memory
Description: This issue was addressed with improved redaction of sensitive information.
CVE-2023-42884: an anonymous researcher
Bluetooth
Available for: macOS Sonoma
Impact: An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard
Description: The issue was addressed with improved checks.
CVE-2023-45866: Marc Newlin of SkySafe
CoreMedia Playback
Available for: macOS Sonoma
Impact: An app may be able to access user-sensitive data
Description: The issue was addressed with improved checks.
CVE-2023-42900: Mickey Jin (@patch1t)
CoreServices
Available for: macOS Sonoma
Impact: A user may be able to cause unexpected app termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2023-42886: Koh M. Nakagawa (@tsunek0h)
ExtensionKit
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved private data redaction for log entries.
CVE-2023-42927: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)
Find My
Available for: macOS Sonoma
Impact: An app may be able to read sensitive location information
Description: This issue was addressed with improved redaction of sensitive information.
CVE-2023-42922: Wojciech Regula of SecuRing (wojciechregula.blog)
ImageIO
Available for: macOS Sonoma
Impact: Processing an image may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
CVE-2023-42898: Junsung Lee
CVE-2023-42899: Meysam Firouzi @R00tkitSMM and Junsung Lee
IOKit
Available for: macOS Sonoma
Impact: An app may be able to monitor keystrokes without user permission
Description: An authentication issue was addressed with improved state management.
CVE-2023-42891: an anonymous researcher
Kernel
Available for: macOS Sonoma
Impact: An app may be able to break out of its sandbox
Description: The issue was addressed with improved memory handling.
CVE-2023-42914: Eloi Benoist-Vanderbeken (@elvanderb) of Synacktiv (@Synacktiv)
ncurses
Available for: macOS Sonoma
Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution
Description: This issue was addressed with improved checks.
CVE-2020-19185
CVE-2020-19186
CVE-2020-19187
CVE-2020-19188
CVE-2020-19189
CVE-2020-19190
SharedFileList
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: The issue was addressed with improved checks.
CVE-2023-42842: an anonymous researcher
TCC
Available for: macOS Sonoma
Impact: An app may be able to access protected user data
Description: A logic issue was addressed with improved checks.
CVE-2023-42932: Zhongquan Li (@Guluisacat)
Vim
Available for: macOS Sonoma
Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution
Description: This issue was addressed by updating to Vim version 9.0.1969.
CVE-2023-5344
WebKit
Available for: macOS Sonoma
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 259830
CVE-2023-42890: Pwn2car
WebKit
Available for: macOS Sonoma
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 263349
CVE-2023-42883: Zoom Offensive Security Team
Additional recognition
Memoji
We would like to acknowledge Jerry Tenenbaum for their assistance.
Wi-Fi
We would like to acknowledge Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) for their assistance.
FTC: We use income earning auto affiliate links. More.
Comments