CVE-2023-32384: Buffer Overflow

Q: What is CVE-2023-32384?

CVE-2023-32384 is a buffer overflow vulnerability in ImageIO that has been fixed in various Apple operating systems.

Q: What is the severity of CVE-2023-32384?

CVE-2023-32384 has a severity rating of 7.8 (high).

Q: Which Apple operating systems are affected by CVE-2023-32384?

CVE-2023-32384 affects macOS Big Sur (up to 11.7.7), macOS Monterey (up to 12.6.6), iOS (up to 15.7.6), iPadOS (up to 15.7.6), tvOS (up to 16.5), and watchOS (up to 9.5).

Q: How can I fix CVE-2023-32384?

CVE-2023-32384 is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. Make sure to update your Apple operating systems to the respective fixed versions.

Q: Is there any additional reference information for CVE-2023-32384?

Yes, you can find additional reference information for CVE-2023-32384 at the following links: [support.apple.com/en-us/HT213757](support.apple.com/en-us/HT213757), [support.apple.com/en-us/HT213758](support.apple.com/en-us/HT213758), [support.apple.com/en-us/HT213759](support.apple.com/en-us/HT213759).

Published May 18, 2023

Updated

A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. Processing an image may lead to arbitrary code execution.

Credit

Meysam Firouzi@@R00tkitsmm(Trend Micro Zero Day Initiative), Gerhard Muth, Dimitrios Tatsis(Cisco Talos), Mickey Jin@@patch1t, Zitong Wu (吴梓桐)(Zhuhai No), Adam M., Meysam Firouzi@@R00tkitSMM(Mbition Mercedes), hou xuewei vmk msu@@p1ay8y3ar, CertiK SkyFall Team(Pinauten GmbH), Linus Henze(Pinauten GmbH), 08Tc3wBB(Jamf), James Duffy (mangoSecure), Adam Doupé(ASU SEFCOM), Eloi Benoist-Vanderbeken@@elvanderb(Synacktiv), Wojciech Reguła@@_r3ggi(SecuRing), OSS-Fuzz(Google Project Zero), Ned Williamson(Google Project Zero), Jonathan Bar Or(Microsoft), Anurag Bohra(Microsoft), (Microsoft), Michael Pearse(Microsoft), Thijs Alkemade@@xnyhps(Computest Sector 7), Gergely Kalman@@gergely_kalman, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Thijs Alkemade(Computest Sector 7), Jonathan Fritz, Arsenii Kostromin (0x3c3e), Julian Szulc, Holger Fuhrmannek(Deutsche Telekom Security GmbH on behalf of BSI), Yiğit Can YILMAZ@@yilmazcanyigit(FFRI Security Inc), Koh M. Nakagawa(FFRI Security Inc), Kirin@@Pwnrin(Offensive Security), Jeff Johnson (underpassapp.com)(Offensive Security), (Offensive Security), Csaba Fitzl@@theevilbit(Offensive Security), Kirin@@Pwnrin, Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Mickey Jin@@patch1t(Tencent Security Xuanwu Lab), Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), an anonymous researcher, Khiem Tran, Gergely Kalman@@gergely_kalman(SecuRing), (SecuRing), Wojciech Reguła(SecuRing), Yiğit Can YILMAZ@@yilmazcanyigit, CVE-2023-22809, Satish Panduranga, Ivan Fratric(Google Project Zero), Wojciech Regula(SecuRing), Ignacio Sanmillan@@ulexec, Clément Lecigne(Google's Threat Analysis Group), Donncha Ó Cearbhaill(Amnesty International), Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Sergii Kryvoblotskyi(MacPaw Inc), ABC Research s.r.o., Mohamed GHANNAM@@_simo36, (Google Project Zero), Jiwon Park, Amat Cama(Vigilant Labs)

Affected Software

18 affected componentsFixes available

Apple macOS Big Sur<11.7.7

11.7.7

Apple tvOS<16.5

16.5

Apple WatchOS<9.5

9.5

Apple macOS Monterey<12.6.6

12.6.6

Apple macOS Ventura<13.4

13.4

Apple iOS<16.5

16.5

Apple iPadOS<16.5

16.5

Apple iOS<15.7.6

15.7.6

Apple iPadOS<15.7.6

15.7.6

Apple iPadOS<15.7.6

Apple iPadOS>=16.0<16.5

Apple iPhone OS<15.7.6

Apple iPhone OS>=16.0<16.5

Apple macOS>=11.0.0<11.7.7

Apple macOS>=12.0.0<12.6.6

Apple macOS>=13.0<13.4

Apple tvOS<16.5

Apple WatchOS<9.5

Event History

May 18, 2023

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Description

Updated

via Apple·12:00 AM

Affected Software

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionAffected Software

Jun 23, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2023-32384?

CVE-2023-32384 is a buffer overflow vulnerability in ImageIO that has been fixed in various Apple operating systems.

What is the severity of CVE-2023-32384?

CVE-2023-32384 has a severity rating of 7.8 (high).

Which Apple operating systems are affected by CVE-2023-32384?

CVE-2023-32384 affects macOS Big Sur (up to 11.7.7), macOS Monterey (up to 12.6.6), iOS (up to 15.7.6), iPadOS (up to 15.7.6), tvOS (up to 16.5), and watchOS (up to 9.5).

How can I fix CVE-2023-32384?

CVE-2023-32384 is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. Make sure to update your Apple operating systems to the respective fixed versions.

Is there any additional reference information for CVE-2023-32384?

Yes, you can find additional reference information for CVE-2023-32384 at the following links: [support.apple.com/en-us/HT213757](support.apple.com/en-us/HT213757), [support.apple.com/en-us/HT213758](support.apple.com/en-us/HT213758), [support.apple.com/en-us/HT213759](support.apple.com/en-us/HT213759).

CVE-2023-32384: Buffer Overflow

Credit

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2023-32384?

What is the severity of CVE-2023-32384?

Which Apple operating systems are affected by CVE-2023-32384?

How can I fix CVE-2023-32384?

Is there any additional reference information for CVE-2023-32384?

Company

Resources

Contact