PT-2022-21566 · Apple · Apple Macos

Ron Masas · CVE-2022-32905 · Published 2022-10-24 · Updated 2024-01-30

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macOS versions prior to 13

Description The issue concerns the processing of maliciously crafted DMG files, which may lead to arbitrary code execution with system privileges. This was addressed with improved validation of symlinks.

Recommendations For versions prior to macOS 13, update to macOS Ventura 13 to resolve the issue.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2022-32905

Affected Products

Apple Macos

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-32905 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32905 · Vendor Advisory
• https://support.apple.com/en-us/HT213488 · Vendor Advisory
• https://support.apple.com/en-us/102853 · Note
• https://twitter.com/RonMasas/status/1752570574759469111 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32905 · Note