PT-2022-18050 · Apple · Safari+1

Jeonghoon Shin · Published 2022-05-16 · Updated 2022-06-07 · CVE-2022-26748

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to macOS Monterey 12.4 Apple Safari versions prior to macOS Big Sur 11.6.6 Apple Safari versions prior to Security Update 2022-004 Catalina

Description An out-of-bounds write issue was addressed with improved input validation. Processing maliciously crafted web content may lead to arbitrary code execution.

Recommendations For Apple Safari versions prior to macOS Monterey 12.4, update to macOS Monterey 12.4 or later. For Apple Safari versions prior to macOS Big Sur 11.6.6, update to macOS Big Sur 11.6.6 or later. For Apple Safari versions prior to Security Update 2022-004 Catalina, apply Security Update 2022-004 Catalina.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-26748

ZDI-22-793

Affected Products

Apple Macos

Safari

References · 10

• https://zerodayinitiative.com/advisories/ZDI-22-793 · Security Note
• https://support.apple.com/en-us/HT213255 · Vendor Advisory
• https://support.apple.com/en-us/HT213256 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26748 · Vendor Advisory
• https://support.apple.com/en-us/HT213257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26748 · Security Note
• https://t.me/cibsecurity/43454 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26748 · Note
• https://support.apple.com/en-us/102871 · Note
• https://support.apple.com/en-us/102873 · Note