Maddie Stone

The issue involves insufficient checks when processing web content within the kernel of iOS, watchOS, iPadOS, and macOS, potentially allowing an attacker to elevate their privileges. Reports indicate that this issue may have been actively exploited in versions of iOS prior to iOS 16.7. The vulnerability allows malicious applications to bypass signature validation and gain elevated privileges. The issue was addressed by implementing improved checks. The vulnerability affects multiple Apple platforms. Technical details reveal the exploitation involves triggering a bug on an old thread, invoking `ipc entry grow table()` through `mach port allocate name()`, and subsequently calling `mach thread self()` to obtain a new mach name.

A certificate validation issue exists in Apple’s CoreTrust security component, potentially allowing malicious applications to bypass signature validation. Reports indicate that this issue may have been actively exploited against versions of iOS prior to version 16.7. The CoreTrust vulnerability, identified as CVE-2023-41991, was reportedly exploited by commercial surveillance vendors, including Intellexa and NSO Group, to install malicious software on iPhones. The issue involves incorrect validation of apps with multiple signers, allowing attackers to circumvent normal signature checks. This flaw was used in conjunction with other vulnerabilities, such as local privilege escalation and remote code execution. The exploit was significant enough that Apple released patches in iOS versions 16.7 and 17.0.1, as well as macOS Ventura 13.6, watchOS 9.6.3, and watchOS 10.0.1 to address the vulnerability.

A vulnerability exists in the WebKit engine, potentially allowing attackers to execute arbitrary code by processing malicious web content. This issue has been actively exploited in some instances, with reports indicating exploitation against iOS versions prior to 16.7. The vulnerability was addressed through improved checks in updated versions of the software. A threat actor, linked to Russia’s Foreign Intelligence Service (SVR), leveraged this vulnerability (CVE-2023-41993) in a watering hole campaign, compromising legitimate websites and redirecting visitors to malicious login pages to harvest Microsoft 365 credentials. Intellexa, a spyware vendor, also utilized this vulnerability as part of a zero-day exploit chain to deploy the Predator spyware on targets in Egypt. The exploit chain involved multiple zero-day vulnerabilities, including CVE-2023-41993, to gain deep access to devices.

The issue is related to an elevation-of-privilege vulnerability in the Windows Error Reporting Service, which allows attackers to affect the system. This vulnerability is associated with insecure privilege management and can be exploited to gain administrator privileges on a Windows device. There have been reports of this vulnerability being exploited in the wild. The Falcon Complete MDR team has discovered and blocked a zero-day exploit affecting Windows Error Reporting.

The issue is related to a use after free problem, which can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. Processing maliciously crafted web content may lead to arbitrary code execution.

The issue is related to an out-of-bounds write, also known as a heap-based buffer overflow, in the `rasterize edges 8` function of the Pixman library. This occurs due to an integer overflow in `pixman sample floor y`. The exploitation of this issue could allow a remote attacker to execute arbitrary code. The library is used for low-level graphics rendering in various open-source projects, including X.Org, Cairo, Firefox, and composite managers based on the Wayland protocol.

The issue is related to an integer overflow in the `xmlParseNameComplex()` function of the libxml2 library when parsing XML documents with the `XML PARSE HUGE` parser option enabled. This can lead to an attempt to access an array at a negative offset, typically resulting in a segmentation fault. A remote attacker could exploit this issue to execute arbitrary code on the system by persuading a victim to open a specially-crafted file.

The issue is related to insufficient validation of untrusted input in Intents, allowing a remote attacker to redirect the browser to a malicious URL via a crafted HTML page. This can be exploited by a remote attacker to gain access to the system.

The issue is related to a heap buffer overflow in the UI component of Google Chrome on Android. This could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

The issue is related to a use-after-free vulnerability in the Android kernel, specifically in the binder.c driver. This vulnerability allows an elevation of privilege from an application to the Linux kernel, potentially giving an attacker full control over the device. No user interaction is required to exploit this vulnerability, but it does require either the installation of a malicious local application or a separate vulnerability in a network-facing application. There have been reports of malicious apps exploiting this vulnerability, and it has been used in real-world attacks.