CVE-2023-32386: Buffer Overflow

Q: What is the vulnerability ID of this privacy issue?

The vulnerability ID of this privacy issue is CVE-2023-32386.

Q: What is the severity level of CVE-2023-32386?

The severity level of CVE-2023-32386 is low with a severity value of 3.3.

Q: Which versions of macOS are affected by CVE-2023-32386?

CVE-2023-32386 affects macOS Big Sur versions up to and including 11.7.7, macOS Monterey versions up to and including 12.6.6, and macOS Ventura versions up to and including 13.4.

Q: How was the privacy issue addressed?

The privacy issue was addressed with improved handling of temporary files.

Q: Where can I find more information about CVE-2023-32386?

You can find more information about CVE-2023-32386 on the Apple support website: [link](https://support.apple.com/en-us/HT213758), [link](https://support.apple.com/en-us/HT213759), [link](https://support.apple.com/en-us/HT213760).

Published May 18, 2023

Updated

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to observe unprotected user data.

Credit

Kirin@@Pwnrin, Mickey Jin@@patch1t, Sergii Kryvoblotskyi(MacPaw Inc), ABC Research s.r.o., James Duffy (mangoSecure), Adam M., Gerhard Muth, Dimitrios Tatsis(Cisco Talos), Zitong Wu (吴梓桐)(Zhuhai No), Meysam Firouzi@@R00tkitSMM(Mbition Mercedes), Meysam Firouzi@@R00tkitsmm(Trend Micro Zero Day Initiative), hou xuewei vmk msu@@p1ay8y3ar, CertiK SkyFall Team(Pinauten GmbH), Linus Henze(Pinauten GmbH), 08Tc3wBB(Jamf), Adam Doupé(ASU SEFCOM), Eloi Benoist-Vanderbeken@@elvanderb(Synacktiv), Wojciech Reguła@@_r3ggi(SecuRing), OSS-Fuzz(Google Project Zero), Ned Williamson(Google Project Zero), Jonathan Bar Or(Microsoft), Anurag Bohra(Microsoft), (Microsoft), Michael Pearse(Microsoft), Thijs Alkemade@@xnyhps(Computest Sector 7), Gergely Kalman@@gergely_kalman, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Thijs Alkemade(Computest Sector 7), Jonathan Fritz, Arsenii Kostromin (0x3c3e), Julian Szulc, Holger Fuhrmannek(Deutsche Telekom Security GmbH on behalf of BSI), Yiğit Can YILMAZ@@yilmazcanyigit(FFRI Security Inc), Koh M. Nakagawa(FFRI Security Inc), Kirin@@Pwnrin(Offensive Security), Jeff Johnson (underpassapp.com)(Offensive Security), (Offensive Security), Csaba Fitzl@@theevilbit(Offensive Security), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Mickey Jin@@patch1t(Tencent Security Xuanwu Lab), Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), an anonymous researcher, Khiem Tran, Gergely Kalman@@gergely_kalman(SecuRing), (SecuRing), Wojciech Reguła(SecuRing), Yiğit Can YILMAZ@@yilmazcanyigit, CVE-2023-22809, Satish Panduranga, Ivan Fratric(Google Project Zero), Wojciech Regula(SecuRing), Ignacio Sanmillan@@ulexec, Clément Lecigne(Google's Threat Analysis Group), Donncha Ó Cearbhaill(Amnesty International), Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte)

Affected Software

6 affected componentsFixes available

Apple macOS Big Sur<11.7.7

11.7.7

macOS<12.6.6

12.6.6

macOS Ventura<13.4

13.4

macOS>=11.0<11.7.7

macOS>=12.0.0<12.6.6

macOS>=13.0<13.4

Event History

May 18, 2023

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Description

Jun 23, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID of this privacy issue?

The vulnerability ID of this privacy issue is CVE-2023-32386.

What is the severity level of CVE-2023-32386?

The severity level of CVE-2023-32386 is low with a severity value of 3.3.

Which versions of macOS are affected by CVE-2023-32386?

CVE-2023-32386 affects macOS Big Sur versions up to and including 11.7.7, macOS Monterey versions up to and including 12.6.6, and macOS Ventura versions up to and including 13.4.

How was the privacy issue addressed?

The privacy issue was addressed with improved handling of temporary files.

Where can I find more information about CVE-2023-32386?

You can find more information about CVE-2023-32386 on the Apple support website: [link](https://support.apple.com/en-us/HT213758), [link](https://support.apple.com/en-us/HT213759), [link](https://support.apple.com/en-us/HT213760).

CVE-2023-32386: Buffer Overflow

Credit

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the vulnerability ID of this privacy issue?

What is the severity level of CVE-2023-32386?

Which versions of macOS are affected by CVE-2023-32386?

How was the privacy issue addressed?

Where can I find more information about CVE-2023-32386?

Company

Resources

Contact