-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-12-11-2023-4 macOS Sonoma 14.2 macOS Sonoma 14.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214036. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Accessibility Available for: macOS Sonoma Impact: Secure text fields may be displayed via the Accessibility Keyboard when using a physical keyboard Description: This issue was addressed with improved state management. CVE-2023-42874: Don Clarke Accounts Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-42919: Kirin (@Pwnrin) AppleEvents Available for: macOS Sonoma Impact: An app may be able to access information about a user's contacts Description: This issue was addressed with improved redaction of sensitive information. CVE-2023-42894: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) AppleGraphicsControl Available for: macOS Sonoma Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2023-42901: Ivan Fratric of Google Project Zero CVE-2023-42902: Ivan Fratric of Google Project Zero, and Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative CVE-2023-42912: Ivan Fratric of Google Project Zero CVE-2023-42903: Ivan Fratric of Google Project Zero CVE-2023-42904: Ivan Fratric of Google Project Zero CVE-2023-42905: Ivan Fratric of Google Project Zero CVE-2023-42906: Ivan Fratric of Google Project Zero CVE-2023-42907: Ivan Fratric of Google Project Zero CVE-2023-42908: Ivan Fratric of Google Project Zero CVE-2023-42909: Ivan Fratric of Google Project Zero CVE-2023-42910: Ivan Fratric of Google Project Zero CVE-2023-42911: Ivan Fratric of Google Project Zero CVE-2023-42926: Ivan Fratric of Google Project Zero AppleVA Available for: macOS Sonoma Impact: Processing an image may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. CVE-2023-42882: Ivan Fratric of Google Project Zero Archive Utility Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: A logic issue was addressed with improved checks. CVE-2023-42924: Mickey Jin (@patch1t) AVEVideoEncoder Available for: macOS Sonoma Impact: An app may be able to disclose kernel memory Description: This issue was addressed with improved redaction of sensitive information. CVE-2023-42884: an anonymous researcher Bluetooth Available for: macOS Sonoma Impact: An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard Description: The issue was addressed with improved checks. CVE-2023-45866: Marc Newlin of SkySafe CoreMedia Playback Available for: macOS Sonoma Impact: An app may be able to access user-sensitive data Description: The issue was addressed with improved checks. CVE-2023-42900: Mickey Jin (@patch1t) CoreServices Available for: macOS Sonoma Impact: A user may be able to cause unexpected app termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2023-42886: Koh M. Nakagawa (@tsunek0h) ExtensionKit Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-42927: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) Find My Available for: macOS Sonoma Impact: An app may be able to read sensitive location information Description: This issue was addressed with improved redaction of sensitive information. CVE-2023-42922: Wojciech Regula of SecuRing (wojciechregula.blog) ImageIO Available for: macOS Sonoma Impact: Processing an image may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. CVE-2023-42898: Junsung Lee CVE-2023-42899: Meysam Firouzi @R00tkitSMM and Junsung Lee IOKit Available for: macOS Sonoma Impact: An app may be able to monitor keystrokes without user permission Description: An authentication issue was addressed with improved state management. CVE-2023-42891: an anonymous researcher Kernel Available for: macOS Sonoma Impact: An app may be able to break out of its sandbox Description: The issue was addressed with improved memory handling. CVE-2023-42914: Eloi Benoist-Vanderbeken (@elvanderb) of Synacktiv (@Synacktiv) ncurses Available for: macOS Sonoma Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2020-19185 CVE-2020-19186 CVE-2020-19187 CVE-2020-19188 CVE-2020-19189 CVE-2020-19190 SharedFileList Available for: macOS Sonoma Impact: An app may be able to access sensitive user data Description: The issue was addressed with improved checks. CVE-2023-42842: an anonymous researcher TCC Available for: macOS Sonoma Impact: An app may be able to access protected user data Description: A logic issue was addressed with improved checks. CVE-2023-42932: Zhongquan Li (@Guluisacat) Vim Available for: macOS Sonoma Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: This issue was addressed by updating to Vim version 9.0.1969. CVE-2023-5344 WebKit Available for: macOS Sonoma Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 259830 CVE-2023-42890: Pwn2car WebKit Available for: macOS Sonoma Impact: Processing an image may lead to a denial-of-service Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 263349 CVE-2023-42883: Zoom Offensive Security Team Additional recognition Memoji We would like to acknowledge Jerry Tenenbaum for their assistance. Wi-Fi We would like to acknowledge Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab) for their assistance. macOS Sonoma 14.2 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmV3qdUACgkQX+5d1TXa Ivp5JQ/9FhhIgATXMT6vd3gK4Bqn3JRODRK+rBcNBjb0zMKWh42fXqZA81K86Ksv FB6/OxqYmdo9NI2g7VMj0I7vS8cQf2ZE0sjSYObkuZ32As5y7Ov+xvNnrCjLuwV3 vrDlBFRRS7KWNskNEV4ciT+ECHUYU6Jkrpt/TqpmR/B/fFxNfjE2Ibeuy56CSlGi FYCasHeyI5pC4kfetYG6Jo7RwcK1nCbNWHB3+zKQItvkkwV3nVBF+QjJGD/aEzz3 X8Jp/hf3taYesK45lr6HWGcuuAGLAAYkjfxz8lLYDQ4AoQ5Xi9WCTjEX9shdKgoF oo1JQDCEuhLXK+1vOxoYEmUAKMRQMMlRMtZgft8hPh6Pce8gYcI0Rez3RT5+m2+U C7d0+97gnpssZkq2JRdyjogl5ACNHGD81jBHg33PppnjTptKNn8JSyXIZLBM3zK/ jQRLmEAlJkl6MgnWKiy+pyzPxCsoFJnOJG481sLTEfQbiQONFIUV3YTesxbIv2a0 8yAM0cFf5cqF6frS81zn8vYfdPJU6HJ3OQGmumLQ4UJAbWY7zg9XbyyZTFw2woGj 0IvoSEBuP4e25JznB1/nchP7W4MJ9VfAzMe/MyBqOibHgomkY1UQqdvWz7olK3Bb 5NkKt5PVTVjAH+R5wVnnXPlWq7Rgfg2m0Y9g3FwTm4WPrIUT5Us= =c6Yv -----END PGP SIGNATURE-----