First published: Wed Oct 25 2023(Updated: )
Accounts. A privacy issue was addressed with improved private data redaction for log entries.
Credit: Yiğit Can YILMAZ @yilmazcanyigit Offensive SecurityCsaba Fitzl @theevilbit Offensive Security product-security@apple.com Offensive SecurityPan ZhenPeng @Peterpan0927 STAR Labs SG PteEloi Benoist-Vanderbeken @elvanderb SynacktivCVE-2023-42893 CVE-2023-3618 CVE-2020-19185 CVE-2020-19186 CVE-2020-19187 CVE-2020-19188 CVE-2020-19189 CVE-2020-19190 Yiğit Can YILMAZ @yilmazcanyigit Csaba Fitzl @theevilbit OffSecArsenii Kostromin (0x3c3e) Zhongquan Li @Guluisacat Zhongquan Li @Guluisacat Dawn Security Lab of JingDongCVE-2023-5344 Koh M. Nakagawa @tsunek0h Yann GASCUEL Alter SolutionsJewel Lambert Anthony Cruz Tyrant Corp @App Wojciech Regula SecuRingMeysam Firouzi @R00tkitSMM Junsung Lee an anonymous researcher Zhipeng Huo @R3dF09 Tencent Security Xuanwu LabMickey Jin @patch1t Kirin @Pwnrin Noah Roskin-Frazee Pr
Affected Software | Affected Version | How to fix |
---|---|---|
Apple macOS | <14.1 | 14.1 |
macOS | <12.7.2 | 12.7.2 |
macOS Ventura | <13.6.3 | 13.6.3 |
macOS | >=12.0<12.7.2 | |
macOS | >=13.0<13.6.3 | |
macOS | =14.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
CVE-2023-42838 is classified as a significant security issue due to its potential for arbitrary code execution.
To fix CVE-2023-42838, update your macOS to version 12.7.2, 13.6.3, or 14.1, depending on which version you are using.
CVE-2023-42838 affects macOS versions from 12.0 up to 12.7.2, 13.0 up to 13.6.3, and specifically version 14.0.
CVE-2023-42838 is an access control vulnerability that allows applications to potentially execute arbitrary code outside of their designated sandbox.
There are no official workarounds for CVE-2023-42838; the only mitigation is to update to the fixed versions of macOS.