ID

VAR-202201-0424


CVE

CVE-2022-22589


TITLE

plural  Apple  Product input verification vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2022-008595

DESCRIPTION

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript. plural Apple The product contains an input validation vulnerability.Information may be obtained and information may be tampered with. Summary: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.34.6). Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: webkit2gtk3-2.34.6-1.el8.src.rpm aarch64: webkit2gtk3-2.34.6-1.el8.aarch64.rpm webkit2gtk3-debuginfo-2.34.6-1.el8.aarch64.rpm webkit2gtk3-debugsource-2.34.6-1.el8.aarch64.rpm webkit2gtk3-devel-2.34.6-1.el8.aarch64.rpm webkit2gtk3-devel-debuginfo-2.34.6-1.el8.aarch64.rpm webkit2gtk3-jsc-2.34.6-1.el8.aarch64.rpm webkit2gtk3-jsc-debuginfo-2.34.6-1.el8.aarch64.rpm webkit2gtk3-jsc-devel-2.34.6-1.el8.aarch64.rpm webkit2gtk3-jsc-devel-debuginfo-2.34.6-1.el8.aarch64.rpm ppc64le: webkit2gtk3-2.34.6-1.el8.ppc64le.rpm webkit2gtk3-debuginfo-2.34.6-1.el8.ppc64le.rpm webkit2gtk3-debugsource-2.34.6-1.el8.ppc64le.rpm webkit2gtk3-devel-2.34.6-1.el8.ppc64le.rpm webkit2gtk3-devel-debuginfo-2.34.6-1.el8.ppc64le.rpm webkit2gtk3-jsc-2.34.6-1.el8.ppc64le.rpm webkit2gtk3-jsc-debuginfo-2.34.6-1.el8.ppc64le.rpm webkit2gtk3-jsc-devel-2.34.6-1.el8.ppc64le.rpm webkit2gtk3-jsc-devel-debuginfo-2.34.6-1.el8.ppc64le.rpm s390x: webkit2gtk3-2.34.6-1.el8.s390x.rpm webkit2gtk3-debuginfo-2.34.6-1.el8.s390x.rpm webkit2gtk3-debugsource-2.34.6-1.el8.s390x.rpm webkit2gtk3-devel-2.34.6-1.el8.s390x.rpm webkit2gtk3-devel-debuginfo-2.34.6-1.el8.s390x.rpm webkit2gtk3-jsc-2.34.6-1.el8.s390x.rpm webkit2gtk3-jsc-debuginfo-2.34.6-1.el8.s390x.rpm webkit2gtk3-jsc-devel-2.34.6-1.el8.s390x.rpm webkit2gtk3-jsc-devel-debuginfo-2.34.6-1.el8.s390x.rpm x86_64: webkit2gtk3-2.34.6-1.el8.i686.rpm webkit2gtk3-2.34.6-1.el8.x86_64.rpm webkit2gtk3-debuginfo-2.34.6-1.el8.i686.rpm webkit2gtk3-debuginfo-2.34.6-1.el8.x86_64.rpm webkit2gtk3-debugsource-2.34.6-1.el8.i686.rpm webkit2gtk3-debugsource-2.34.6-1.el8.x86_64.rpm webkit2gtk3-devel-2.34.6-1.el8.i686.rpm webkit2gtk3-devel-2.34.6-1.el8.x86_64.rpm webkit2gtk3-devel-debuginfo-2.34.6-1.el8.i686.rpm webkit2gtk3-devel-debuginfo-2.34.6-1.el8.x86_64.rpm webkit2gtk3-jsc-2.34.6-1.el8.i686.rpm webkit2gtk3-jsc-2.34.6-1.el8.x86_64.rpm webkit2gtk3-jsc-debuginfo-2.34.6-1.el8.i686.rpm webkit2gtk3-jsc-debuginfo-2.34.6-1.el8.x86_64.rpm webkit2gtk3-jsc-devel-2.34.6-1.el8.i686.rpm webkit2gtk3-jsc-devel-2.34.6-1.el8.x86_64.rpm webkit2gtk3-jsc-devel-debuginfo-2.34.6-1.el8.i686.rpm webkit2gtk3-jsc-devel-debuginfo-2.34.6-1.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-30809 https://access.redhat.com/security/cve/CVE-2021-30818 https://access.redhat.com/security/cve/CVE-2021-30823 https://access.redhat.com/security/cve/CVE-2021-30836 https://access.redhat.com/security/cve/CVE-2021-30846 https://access.redhat.com/security/cve/CVE-2021-30848 https://access.redhat.com/security/cve/CVE-2021-30849 https://access.redhat.com/security/cve/CVE-2021-30851 https://access.redhat.com/security/cve/CVE-2021-30884 https://access.redhat.com/security/cve/CVE-2021-30887 https://access.redhat.com/security/cve/CVE-2021-30888 https://access.redhat.com/security/cve/CVE-2021-30889 https://access.redhat.com/security/cve/CVE-2021-30890 https://access.redhat.com/security/cve/CVE-2021-30897 https://access.redhat.com/security/cve/CVE-2021-30934 https://access.redhat.com/security/cve/CVE-2021-30936 https://access.redhat.com/security/cve/CVE-2021-30951 https://access.redhat.com/security/cve/CVE-2021-30952 https://access.redhat.com/security/cve/CVE-2021-30953 https://access.redhat.com/security/cve/CVE-2021-30954 https://access.redhat.com/security/cve/CVE-2021-30984 https://access.redhat.com/security/cve/CVE-2021-45481 https://access.redhat.com/security/cve/CVE-2021-45482 https://access.redhat.com/security/cve/CVE-2021-45483 https://access.redhat.com/security/cve/CVE-2022-22589 https://access.redhat.com/security/cve/CVE-2022-22590 https://access.redhat.com/security/cve/CVE-2022-22592 https://access.redhat.com/security/cve/CVE-2022-22594 https://access.redhat.com/security/cve/CVE-2022-22620 https://access.redhat.com/security/cve/CVE-2022-22637 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. For the stable distribution (bullseye), these problems have been fixed in version 2.34.6-1~deb11u1. We recommend that you upgrade your wpewebkit packages. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina Security Update 2022-004 Catalina addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213255. apache Available for: macOS Catalina Impact: Multiple issues in apache Description: Multiple issues were addressed by updating apache to version 2.4.53. CVE-2021-44224 CVE-2021-44790 CVE-2022-22719 CVE-2022-22720 CVE-2022-22721 AppKit Available for: macOS Catalina Impact: A malicious application may be able to gain root privileges Description: A logic issue was addressed with improved validation. CVE-2022-22665: Lockheed Martin Red Team AppleGraphicsControl Available for: macOS Catalina Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2022-26751: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative AppleScript Available for: macOS Catalina Impact: Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2022-26697: Qi Sun and Robert Ai of Trend Micro AppleScript Available for: macOS Catalina Impact: Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2022-26698: Qi Sun of Trend Micro CoreTypes Available for: macOS Catalina Impact: A malicious application may bypass Gatekeeper checks Description: This issue was addressed with improved checks to prevent unauthorized actions. CVE-2022-22663: Arsenii Kostromin (0x3c3e) CVMS Available for: macOS Catalina Impact: A malicious application may be able to gain root privileges Description: A memory initialization issue was addressed. CVE-2022-26721: Yonghwi Jin (@jinmo123) of Theori CVE-2022-26722: Yonghwi Jin (@jinmo123) of Theori DriverKit Available for: macOS Catalina Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2022-26763: Linus Henze of Pinauten GmbH (pinauten.de) Graphics Drivers Available for: macOS Catalina Impact: A local user may be able to read kernel memory Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. CVE-2022-22674: an anonymous researcher Intel Graphics Driver Available for: macOS Catalina Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-26720: Liu Long of Ant Security Light-Year Lab Intel Graphics Driver Available for: macOS Catalina Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds read issue was addressed with improved input validation. CVE-2022-26770: Liu Long of Ant Security Light-Year Lab Intel Graphics Driver Available for: macOS Catalina Impact: An application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2022-26756: Jack Dates of RET2 Systems, Inc Intel Graphics Driver Available for: macOS Catalina Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2022-26769: Antonio Zekic (@antoniozekic) Intel Graphics Driver Available for: macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2022-26748: Jeonghoon Shin of Theori working with Trend Micro Zero Day Initiative Kernel Available for: macOS Catalina Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved validation. CVE-2022-26714: Peter Nguyễn Vũ Hoàng (@peternguyen14) of STAR Labs (@starlabs_sg) Kernel Available for: macOS Catalina Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed with improved memory management. CVE-2022-26757: Ned Williamson of Google Project Zero libresolv Available for: macOS Catalina Impact: An attacker may be able to cause unexpected application termination or arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2022-26775: Max Shavrick (@_mxms) of the Google Security Team LibreSSL Available for: macOS Catalina Impact: Processing a maliciously crafted certificate may lead to a denial of service Description: A denial of service issue was addressed with improved input validation. CVE-2022-0778 libxml2 Available for: macOS Catalina Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2022-23308 OpenSSL Available for: macOS Catalina Impact: Processing a maliciously crafted certificate may lead to a denial of service Description: This issue was addressed with improved checks. CVE-2022-0778 PackageKit Available for: macOS Catalina Impact: A malicious application may be able to modify protected parts of the file system Description: This issue was addressed with improved entitlements. CVE-2022-26727: Mickey Jin (@patch1t) Printing Available for: macOS Catalina Impact: A malicious application may be able to bypass Privacy preferences Description: This issue was addressed by removing the vulnerable code. CVE-2022-26746: @gorelics Security Available for: macOS Catalina Impact: A malicious app may be able to bypass signature validation Description: A certificate parsing issue was addressed with improved checks. CVE-2022-26766: Linus Henze of Pinauten GmbH (pinauten.de) SMB Available for: macOS Catalina Impact: An application may be able to gain elevated privileges Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2022-26715: Peter Nguyễn Vũ Hoàng of STAR Labs SoftwareUpdate Available for: macOS Catalina Impact: A malicious application may be able to access restricted files Description: This issue was addressed with improved entitlements. CVE-2022-26728: Mickey Jin (@patch1t) TCC Available for: macOS Catalina Impact: An app may be able to capture a user's screen Description: This issue was addressed with improved checks. CVE-2022-26726: an anonymous researcher Tcl Available for: macOS Catalina Impact: A malicious application may be able to break out of its sandbox Description: This issue was addressed with improved environment sanitization. CVE-2022-22589: Heige of KnownSec 404 Team (knownsec.com) and Bo Qu of Palo Alto Networks (paloaltonetworks.com) Wi-Fi Available for: macOS Catalina Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2022-26761: Wang Yu of Cyberserval zip Available for: macOS Catalina Impact: Processing a maliciously crafted file may lead to a denial of service Description: A denial of service issue was addressed with improved state handling. CVE-2022-0530 zlib Available for: macOS Catalina Impact: An attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2018-25032: Tavis Ormandy zsh Available for: macOS Catalina Impact: A remote attacker may be able to cause arbitrary code execution Description: This issue was addressed by updating to zsh version 5.8.1. CVE-2021-45444 Additional recognition PackageKit We would like to acknowledge Mickey Jin (@patch1t) of Trend Micro for their assistance. Security Update 2022-004 Catalina may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmKC1TYACgkQeC9qKD1p rhjgGRAAggg84uE4zYtBHmo5Qz45wlY/+FT7bSyCyo2Ta0m3JQmm26UiS9ZzXlD0 58jCo/ti+gH/gqwU05SnaG88pSMT6VKaDDnmw8WcrPtbl6NN6JX8vaZLFLoGO0dB rjwap7ulcLe7/HM8kCz3qqjKj4fusxckCjmm5yBMtuMklq7i51vzkT/+ws00ALcH 4S821CqIJlS2RIho/M/pih5A/H1Onw/nzKc7VOWjWMmmwoV+oiL4gMPE9kyIAJFQ NcZO7s70Qp9N5Z0VGIkD5HkAntEqYGNKJuCQUrHS0fHFUxVrQcuBbbSiv7vwnOT0 NVcFKBQWJtfcqmtcDF8mVi2ocqUh7So6AXhZGZtL3CrVfNMgTcjq6y5XwzXMgwlm ezMX73MnV91QuGp6KVZEmoFNlJ2dhKcJ0fYAhhW9DJqvJ1u5xIkQrUkK/ERLnWpE 9DIapT8uUbb9Zgez/tS9szv5jHhKtOoPbprju7d7LHw7XMFCVKbUvx745dFZx0AG PLsJZQNsQZJIK8QdcLA50KrlyjR2ts4nUsKj07I6LR4wUmcaj+goXYq4Nh4WLnoF x1AXD5ztdYlhqMcTAnuAbUYfuki0uzSy0p7wBiTknFwKMZNIaiToo64BES+7Iu1i vrB9SdtTSQCMXgPZX1Al1e2F/K2ubovrGU9geAEwLMq3AKudI4g= =JBHs -----END PGP SIGNATURE----- . ========================================================================== Ubuntu Security Notice USN-5306-1 February 28, 2022 webkit2gtk vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS Summary: Several security issues were fixed in WebKitGTK. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: libjavascriptcoregtk-4.0-18 2.34.6-0ubuntu0.21.10.1 libwebkit2gtk-4.0-37 2.34.6-0ubuntu0.21.10.1 Ubuntu 20.04 LTS: libjavascriptcoregtk-4.0-18 2.34.6-0ubuntu0.20.04.1 libwebkit2gtk-4.0-37 2.34.6-0ubuntu0.20.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use WebKitGTK, such as Epiphany, to make all the necessary changes. CVE-2022-22578: an anonymous researcher iCloud Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An application may be able to access a user's files Description: An issue existed within the path validation logic for symlinks. Apple is aware of a report that this issue may have been actively exploited. CVE-2022-22590: Toan Pham from Team Orca of Sea Security (security.sea.com) WebKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A logic issue was addressed with improved state management. CVE-2022-22592: Prakash (@1lastBr3ath) WebKit Storage Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: A website may be able to track sensitive user information Description: A cross-origin issue in the IndexDB API was addressed with improved input validation. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202208-39 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: WebKitGTK+: Multiple Vulnerabilities Date: August 31, 2022 Bugs: #866494, #864427, #856445, #861740, #837305, #845252, #839984, #833568, #832990 ID: 202208-39 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in WebkitGTK+, the worst of which could result in the arbitrary execution of code. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/webkit-gtk < 2.36.7 >= 2.36.7 Description ========== Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All WebKitGTK+ users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.36.7" References ========= [ 1 ] CVE-2022-2294 https://nvd.nist.gov/vuln/detail/CVE-2022-2294 [ 2 ] CVE-2022-22589 https://nvd.nist.gov/vuln/detail/CVE-2022-22589 [ 3 ] CVE-2022-22590 https://nvd.nist.gov/vuln/detail/CVE-2022-22590 [ 4 ] CVE-2022-22592 https://nvd.nist.gov/vuln/detail/CVE-2022-22592 [ 5 ] CVE-2022-22620 https://nvd.nist.gov/vuln/detail/CVE-2022-22620 [ 6 ] CVE-2022-22624 https://nvd.nist.gov/vuln/detail/CVE-2022-22624 [ 7 ] CVE-2022-22628 https://nvd.nist.gov/vuln/detail/CVE-2022-22628 [ 8 ] CVE-2022-22629 https://nvd.nist.gov/vuln/detail/CVE-2022-22629 [ 9 ] CVE-2022-22662 https://nvd.nist.gov/vuln/detail/CVE-2022-22662 [ 10 ] CVE-2022-22677 https://nvd.nist.gov/vuln/detail/CVE-2022-22677 [ 11 ] CVE-2022-26700 https://nvd.nist.gov/vuln/detail/CVE-2022-26700 [ 12 ] CVE-2022-26709 https://nvd.nist.gov/vuln/detail/CVE-2022-26709 [ 13 ] CVE-2022-26710 https://nvd.nist.gov/vuln/detail/CVE-2022-26710 [ 14 ] CVE-2022-26716 https://nvd.nist.gov/vuln/detail/CVE-2022-26716 [ 15 ] CVE-2022-26717 https://nvd.nist.gov/vuln/detail/CVE-2022-26717 [ 16 ] CVE-2022-26719 https://nvd.nist.gov/vuln/detail/CVE-2022-26719 [ 17 ] CVE-2022-30293 https://nvd.nist.gov/vuln/detail/CVE-2022-30293 [ 18 ] CVE-2022-30294 https://nvd.nist.gov/vuln/detail/CVE-2022-30294 [ 19 ] CVE-2022-32784 https://nvd.nist.gov/vuln/detail/CVE-2022-32784 [ 20 ] CVE-2022-32792 https://nvd.nist.gov/vuln/detail/CVE-2022-32792 [ 21 ] CVE-2022-32893 https://nvd.nist.gov/vuln/detail/CVE-2022-32893 [ 22 ] WSA-2022-0002 https://webkitgtk.org/security/WSA-2022-0002.html [ 23 ] WSA-2022-0003 https://webkitgtk.org/security/WSA-2022-0003.html [ 24 ] WSA-2022-0007 https://webkitgtk.org/security/WSA-2022-0007.html [ 25 ] WSA-2022-0008 https://webkitgtk.org/security/WSA-2022-0008.html Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202208-39 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

Trust: 2.43

sources: NVD: CVE-2022-22589 // JVNDB: JVNDB-2022-008595 // VULHUB: VHN-411217 // VULMON: CVE-2022-22589 // PACKETSTORM: 167037 // PACKETSTORM: 169237 // PACKETSTORM: 167189 // PACKETSTORM: 166164 // PACKETSTORM: 165777 // PACKETSTORM: 165771 // PACKETSTORM: 168226

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:eqversion:10.15.7

Trust: 1.0

vendor:applemodel:macosscope:gteversion:12.0.0

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.15.7

Trust: 1.0

vendor:applemodel:safariscope:ltversion:15.3

Trust: 1.0

vendor:applemodel:ipadosscope:ltversion:15.3

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:8.4

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.6.6

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:15.3

Trust: 1.0

vendor:applemodel:macosscope:ltversion:12.2

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:15.3

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.15

Trust: 1.0

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

vendor:アップルmodel:ipadosscope: - version: -

Trust: 0.8

vendor:アップルmodel:tvosscope: - version: -

Trust: 0.8

vendor:アップルmodel:macosscope: - version: -

Trust: 0.8

vendor:アップルmodel:safariscope: - version: -

Trust: 0.8

vendor:アップルmodel:apple mac os xscope: - version: -

Trust: 0.8

vendor:アップルmodel:watchosscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-008595 // NVD: CVE-2022-22589

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-22589
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-22589
value: MEDIUM

Trust: 0.8

VULHUB: VHN-411217
value: MEDIUM

Trust: 0.1

VULMON: CVE-2022-22589
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-22589
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-411217
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-22589
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: CVE-2022-22589
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-411217 // VULMON: CVE-2022-22589 // JVNDB: JVNDB-2022-008595 // NVD: CVE-2022-22589

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [NVD evaluation ]

Trust: 0.8

problemtype:CWE-20

Trust: 0.1

sources: VULHUB: VHN-411217 // JVNDB: JVNDB-2022-008595 // NVD: CVE-2022-22589

THREAT TYPE

remote

Trust: 0.1

sources: PACKETSTORM: 166164

TYPE

overflow, code execution

Trust: 0.2

sources: PACKETSTORM: 167189 // PACKETSTORM: 165771

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-411217

PATCH

title:HT213255 Apple  Security updateurl:https://support.apple.com/en-us/HT213053

Trust: 0.8

title:Debian Security Advisories: DSA-5084-1 wpewebkit -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=fad7bdb7356c54203c2fb7db9019fb4f

Trust: 0.1

title:Debian Security Advisories: DSA-5083-1 webkit2gtk -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=1e1726cb3c6d9dabbfb6d6be4668f64f

Trust: 0.1

title:Apple: iOS 15.3 and iPadOS 15.3url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=05e71c916b30e0c013cc3ece80cc9189

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: VULMON: CVE-2022-22589 // JVNDB: JVNDB-2022-008595

EXTERNAL IDS

db:NVDid:CVE-2022-22589

Trust: 3.5

db:JVNDBid:JVNDB-2022-008595

Trust: 0.8

db:PACKETSTORMid:165777

Trust: 0.2

db:PACKETSTORMid:168226

Trust: 0.2

db:PACKETSTORMid:167189

Trust: 0.2

db:PACKETSTORMid:165771

Trust: 0.2

db:PACKETSTORMid:167037

Trust: 0.2

db:PACKETSTORMid:166164

Trust: 0.2

db:PACKETSTORMid:167188

Trust: 0.1

db:PACKETSTORMid:165775

Trust: 0.1

db:PACKETSTORMid:165772

Trust: 0.1

db:PACKETSTORMid:165776

Trust: 0.1

db:VULHUBid:VHN-411217

Trust: 0.1

db:VULMONid:CVE-2022-22589

Trust: 0.1

db:PACKETSTORMid:169237

Trust: 0.1

sources: VULHUB: VHN-411217 // VULMON: CVE-2022-22589 // PACKETSTORM: 167037 // PACKETSTORM: 169237 // PACKETSTORM: 167189 // PACKETSTORM: 166164 // PACKETSTORM: 165777 // PACKETSTORM: 165771 // PACKETSTORM: 168226 // JVNDB: JVNDB-2022-008595 // NVD: CVE-2022-22589

REFERENCES

url:https://security.gentoo.org/glsa/202208-39

Trust: 2.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22589

Trust: 1.5

url:https://support.apple.com/kb/ht213185

Trust: 1.2

url:https://support.apple.com/kb/ht213255

Trust: 1.2

url:https://support.apple.com/kb/ht213256

Trust: 1.2

url:http://seclists.org/fulldisclosure/2022/may/35

Trust: 1.2

url:http://seclists.org/fulldisclosure/2022/may/33

Trust: 1.2

url:https://support.apple.com/en-us/ht213053

Trust: 1.2

url:https://support.apple.com/en-us/ht213054

Trust: 1.2

url:https://support.apple.com/en-us/ht213057

Trust: 1.2

url:https://support.apple.com/en-us/ht213058

Trust: 1.2

url:https://support.apple.com/en-us/ht213059

Trust: 1.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22590

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22592

Trust: 0.4

url:https://www.apple.com/support/security/pgp/

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-22620

Trust: 0.2

url:https://support.apple.com/kb/ht201222

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-22594

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:http://seclists.org/fulldisclosure/2022/jan/85

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

url:https://www.debian.org/security/2022/dsa-5084

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22592

Trust: 0.1

url:https://access.redhat.com/articles/11258

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30888

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30848

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22637

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30952

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30884

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30809

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30846

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30890

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30984

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-45482

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1777

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30888

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22620

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30809

Trust: 0.1

url:https://access.redhat.com/security/team/key/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30887

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30952

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30846

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30849

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30953

Trust: 0.1

url:https://access.redhat.com/security/team/contact/

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30823

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30936

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-45483

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30897

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30897

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30954

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30936

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22594

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30836

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30887

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30851

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30934

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30848

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30934

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-45483

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30951

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30849

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30836

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-45481

Trust: 0.1

url:https://bugzilla.redhat.com/):

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30818

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30889

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-45482

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30951

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22589

Trust: 0.1

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30823

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30889

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30953

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30984

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30954

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30818

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-45481

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-22590

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30851

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30890

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2021-30884

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://security-tracker.debian.org/tracker/wpewebkit

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:https://support.apple.com/downloads/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22721

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-23308

Trust: 0.1

url:https://support.apple.com/ht213255.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22663

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26726

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44790

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22674

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26714

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0530

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44224

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26698

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22719

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26727

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26728

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26697

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26748

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0778

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26721

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-45444

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-25032

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26720

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22720

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22665

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26715

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26722

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26746

Trust: 0.1

url:https://support.apple.com/en-us/ht201222.

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/webkit2gtk/2.34.6-0ubuntu0.21.10.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/webkit2gtk/2.34.6-0ubuntu0.20.04.1

Trust: 0.1

url:https://ubuntu.com/security/notices/usn-5306-1

Trust: 0.1

url:https://support.apple.com/ht213058.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22584

Trust: 0.1

url:https://www.apple.com/itunes/

Trust: 0.1

url:https://xlab.tencent.com)

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22593

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22587

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22585

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22579

Trust: 0.1

url:https://support.apple.com/ht213053.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22578

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26719

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22628

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22677

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-2294

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26709

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-30293

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2022-0008.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-30294

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22662

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22624

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26717

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2022-0002.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26700

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26716

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-26710

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32893

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32792

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2022-0003.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32784

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22629

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2022-0007.html

Trust: 0.1

sources: VULHUB: VHN-411217 // VULMON: CVE-2022-22589 // PACKETSTORM: 167037 // PACKETSTORM: 169237 // PACKETSTORM: 167189 // PACKETSTORM: 166164 // PACKETSTORM: 165777 // PACKETSTORM: 165771 // PACKETSTORM: 168226 // JVNDB: JVNDB-2022-008595 // NVD: CVE-2022-22589

CREDITS

Apple

Trust: 0.3

sources: PACKETSTORM: 167189 // PACKETSTORM: 165777 // PACKETSTORM: 165771

SOURCES

db:VULHUBid:VHN-411217
db:VULMONid:CVE-2022-22589
db:PACKETSTORMid:167037
db:PACKETSTORMid:169237
db:PACKETSTORMid:167189
db:PACKETSTORMid:166164
db:PACKETSTORMid:165777
db:PACKETSTORMid:165771
db:PACKETSTORMid:168226
db:JVNDBid:JVNDB-2022-008595
db:NVDid:CVE-2022-22589

LAST UPDATE DATE

2025-11-28T22:50:24.553000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-411217date:2022-10-06T00:00:00
db:VULMONid:CVE-2022-22589date:2023-08-08T00:00:00
db:JVNDBid:JVNDB-2022-008595date:2023-07-28T06:05:00
db:NVDid:CVE-2022-22589date:2024-11-21T06:47:04.823

SOURCES RELEASE DATE

db:VULHUBid:VHN-411217date:2022-03-18T00:00:00
db:VULMONid:CVE-2022-22589date:2022-03-18T00:00:00
db:PACKETSTORMid:167037date:2022-05-11T15:50:41
db:PACKETSTORMid:169237date:2022-02-28T20:12:00
db:PACKETSTORMid:167189date:2022-05-17T16:59:55
db:PACKETSTORMid:166164date:2022-02-28T16:31:29
db:PACKETSTORMid:165777date:2022-01-31T15:47:24
db:PACKETSTORMid:165771date:2022-01-31T15:45:47
db:PACKETSTORMid:168226date:2022-09-01T16:33:44
db:JVNDBid:JVNDB-2022-008595date:2023-07-28T00:00:00
db:NVDid:CVE-2022-22589date:2022-03-18T18:15:12.567