First published: Mon Mar 27 2023(Updated: )
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. Parsing a maliciously crafted plist may lead to an unexpected app termination or arbitrary code execution.
Credit: an anonymous researcher an anonymous researcher an anonymous researcher an anonymous researcher an anonymous researcher an anonymous researcher product-security@apple.com product-security@apple.com
Affected Software | Affected Version | How to fix |
---|---|---|
Apple iPadOS | <16.4 | |
Apple iPhone OS | <16.4 | |
Apple macOS | <11.7.5 | |
Apple macOS | >=12.0<12.6.4 | |
Apple macOS | >=13.0<13.3 | |
Apple tvOS | <16.4 | |
Apple watchOS | <9.4 | |
Apple tvOS | <16.4 | 16.4 |
Apple watchOS | <9.4 | 9.4 |
<12.6.4 | 12.6.4 | |
<16.4 | 16.4 | |
<16.4 | 16.4 | |
<11.7.5 | 11.7.5 | |
Apple macOS Ventura | <13.3 | 13.3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
The severity of CVE-2023-27937 is high.
CVE-2023-27937 affects macOS Big Sur 11.7.5, watchOS 9.4, tvOS 16.4, iOS 16.4, iPadOS 16.4, macOS Monterey 12.6.4, and macOS Ventura 13.3.
CVE-2023-27937 can be exploited by parsing a maliciously crafted plist, which may lead to an unexpected app termination or arbitrary code execution.
To fix CVE-2023-27937, update to macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, tvOS 16.4, or watchOS 9.4.
More information about CVE-2023-27937 can be found at the following references: [Reference 1](https://support.apple.com/en-us/HT213674), [Reference 2](https://support.apple.com/en-us/HT213675), [Reference 3](https://support.apple.com/en-us/HT213670).