PT-2023-21435 · Apple · Garageband

Mickey Jin + 1 · Published 2023-05-08 · Updated 2023-07-27 · CVE-2023-27938

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GarageBand versions prior to 10.4.8

Description An out-of-bounds read issue was addressed with improved input validation. Parsing a maliciously crafted MIDI file may lead to an unexpected application termination or arbitrary code execution.

Recommendations For versions prior to 10.4.8, update to GarageBand for macOS 10.4.8 to resolve the issue. As a temporary workaround, consider avoiding the use of maliciously crafted MIDI files until the update is applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-27938

ZDI-23-644

Affected Products

Garageband

References · 5

• https://osv.dev/vulnerability/CVE-2023-27938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27938 · Security Note
• https://support.apple.com/en-us/HT213650 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-644 · Security Note
• https://t.me/cvenotify/50267 · Telegram Post