CVE-2023-32437: Input Validation
Published May 18, 2023
·Updated
Accessibility. A privacy issue was addressed with improved private data redaction for log entries.
Other sources
Accessibility. This issue was addressed with improved checks.
— Apple
Accounts. A permissions issue was addressed with improved redaction of sensitive information.
— Apple
Accounts. A privacy issue was addressed with improved private data redaction for log entries.
— Apple
AMD. A buffer overflow issue was addressed with improved memory handling.
— Apple
Apple Neural Engine. The issue was addressed with improved memory handling.
— Apple
Credit
Mickey Jin@@patch1t, Sergii Kryvoblotskyi(MacPaw Inc), Adam M., Meysam Firouzi@@R00tkitSMM(Mbition Mercedes), Meysam Firouzi@@R00tkitsmm(Trend Micro Zero Day Initiative), Linus Henze(Pinauten GmbH), CertiK SkyFall Team(Pinauten GmbH), 08Tc3wBB(Jamf), Adam Doupé(ASU SEFCOM), Eloi Benoist-Vanderbeken@@elvanderb(Synacktiv), Wojciech Reguła@@_r3ggi(SecuRing), Gergely Kalman@@gergely_kalman, Thijs Alkemade(Computest Sector 7), Julian Szulc, Yiğit Can YILMAZ@@yilmazcanyigit(FFRI Security Inc), Koh M. Nakagawa(FFRI Security Inc), Kirin@@Pwnrin(Offensive Security), Jeff Johnson (underpassapp.com)(Offensive Security), (Offensive Security), Csaba Fitzl@@theevilbit(Offensive Security), Kirin@@Pwnrin, Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), an anonymous researcher, Khiem Tran, Gergely Kalman@@gergely_kalman(SecuRing), (SecuRing), Wojciech Reguła(SecuRing), Yiğit Can YILMAZ@@yilmazcanyigit, Satish Panduranga, Ivan Fratric(Google Project Zero), Wojciech Regula(SecuRing), Ignacio Sanmillan@@ulexec, Clément Lecigne(Google's Threat Analysis Group), Donncha Ó Cearbhaill(Amnesty International), Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Mickey Jin@@patch1t(Tencent Security Xuanwu Lab), Zitong Wu (吴梓桐)(Zhuhai No), Mohamed GHANNAM@@_simo36, Jonathan Fritz, Jiwon Park, James Duffy (mangoSecure), OSS-Fuzz(Google Project Zero), (Google Project Zero), Ned Williamson(Google Project Zero), Amat Cama(Vigilant Labs), Thijs Alkemade@@xnyhps(Computest Sector 7), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Arsenii Kostromin (0x3c3e), Holger Fuhrmannek(Deutsche Telekom Security GmbH on behalf of BSI), CVE-2023-22809, Gerhard Muth, Dimitrios Tatsis(Cisco Talos), hou xuewei vmk msu@@p1ay8y3ar, Jonathan Bar Or(Microsoft), Anurag Bohra(Microsoft), (Microsoft), Michael Pearse(Microsoft), ABC Research s.r.o., Nick Brook, pattern-f@@pattern_F_(Ant Security Light), Kirin@@Pwnrin(SecuRing), found by OSS-Fuzz, Zweig(Kunlun Lab), 香农的三蹦子(Pangu Lab), Peter Nguyễn Vũ Hoàng@@peternguyen14(STAR Labs SG Pte), Certik Skyfall Team, Valentin Pashkov(Kaspersky), Mikhail Vinogradov(Kaspersky), Georgy Kucherin@@kucher1n(Kaspersky), Leonid Bezvershenko@@bzvr_(Kaspersky), (Kaspersky), Boris Larin@@oct0xor(Kaspersky), Kaitao Xie(Alibaba Group), Certik Skyfall Team(Ant Security Light), Sei K., Noah Roskin-Frazee, Johan Carlsson (joaxcar), Hritvik Taneja, Jason Kim, Jie Jeff Xu, Stephan van Schaik, Daniel Genkin, Yuval Yarom, Narendra Bhati (twitter.com/imnarendrabhati)(Suma Soft Pvt), Pune - India(TU Wien), Valentino Dalla Valle(TU Wien), Pedro Bernardo(TU Wien), Marco Squarcina(TU Wien), (TU Wien), Lorenzo Veronese(TU Wien), Pune - India, Yuhao Hu, Jiming Wang, Jikai Ren, Anonymous(Trend Micro Zero Day Initiative), Francisco Alonso@@revskills, Junsung Lee, 이준성(Junsung Lee)(Cross Republic), Apple, YeongHyeon Choi@@hyeon101010
Affected Software
7 affected componentsFixes available
Apple tvOS<16.5
16.5
Apple WatchOS<9.5
9.5
Apple macOS Ventura<13.4
13.4
Apple iOS<16.5
16.5
Apple iPadOS<16.5
16.5
Apple iPadOS<16.6
Apple iPhone OS<16.6
Event History
Jul 24, 2023
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Jul 26, 2023
CVE Published
via MITRE·11:55 PM
Data Sourced
via MITRE·11:55 PM
DescriptionWeakness
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2023-32400
- CVE-2023-34352
- CVE-2023-32411
- CVE-2023-32399
- CVE-2023-28191
- CVE-2023-32392
- CVE-2023-32372
- CVE-2023-32384
- CVE-2023-32354
- CVE-2023-32420
- CVE-2023-27930
- CVE-2023-32398
- CVE-2023-32413
- CVE-2023-32352
- CVE-2023-32428
- CVE-2023-32407
- CVE-2023-32368
- CVE-2023-32403
- CVE-2023-32437
- CVE-2023-32390
- CVE-2023-32357
- CVE-2023-32432
- CVE-2023-32391
- CVE-2023-32404
- CVE-2023-32394
- CVE-2023-32422
- CVE-2023-32376
- CVE-2023-28202
- CVE-2023-32412
- CVE-2023-32408
- CVE-2023-32415
- CVE-2023-32402
- CVE-2023-32423
- CVE-2023-32409
- CVE-2023-28204
- CVE-2023-32373
- CVE-2023-32389
- CVE-2023-32388
- CVE-2023-32425
- CVE-2023-32417
- CVE-2023-32379
- CVE-2023-32383
- CVE-2023-32371
- CVE-2023-32386
- CVE-2023-32360
- CVE-2023-32387
- CVE-2023-32414
- CVE-2023-32410
- CVE-2023-27940
- CVE-2023-29469
- CVE-2023-42869
- CVE-2023-32369
- CVE-2023-32405
- CVE-2023-42958
- CVE-2023-32375
- CVE-2023-32382
- CVE-2023-32380
- CVE-2023-32355
- CVE-2023-32385
- CVE-2023-32395
- CVE-2023-32401
- CVE-2023-32363
- CVE-2023-32367
- CVE-2023-32397
- CVE-2023-22809
- CVE-2023-32419
- CVE-2023-32365
- CVE-2023-40442
- CVE-2023-40439
- CVE-2023-34425
- CVE-2023-38136
- CVE-2023-38580
- CVE-2023-40392
- CVE-2023-40437
- CVE-2023-32416
- CVE-2022-3970
- CVE-2023-38590
- CVE-2023-38598
- CVE-2023-36495
- CVE-2023-38604
- CVE-2023-32734
- CVE-2023-32441
- CVE-2023-38261
- CVE-2023-38424
- CVE-2023-38425
- CVE-2023-38606
- CVE-2023-32381
- CVE-2023-32433
- CVE-2023-35993
- CVE-2023-41995
- CVE-2023-38410
- CVE-2023-38603
- CVE-2023-40400
- CVE-2023-38565
- CVE-2023-38593
- CVE-2023-40394
- CVE-2023-38605
- CVE-2023-40397
- CVE-2023-38599
- CVE-2023-32445
- CVE-2023-38592
- CVE-2023-38572
- CVE-2023-38594
- CVE-2023-38595
- CVE-2023-38600
- CVE-2023-38611
- CVE-2023-37450
- CVE-2023-42866
- CVE-2023-38597
- CVE-2023-38133
- CVE-2023-43000
Frequently Asked Questions
1
What is CVE-2023-32437?
CVE-2023-32437 is a vulnerability in NSURLSession that allows an app to break out of its sandbox in iOS 16.6 and iPadOS 16.6.
2
How does CVE-2023-32437 affect Apple products?
CVE-2023-32437 affects Apple products such as iOS, iPadOS, iPhone OS, tvOS, watchOS, and macOS Ventura.
3
What is the severity of CVE-2023-32437?
The severity of CVE-2023-32437 is high, with a severity value of 8.6.
4
How can I fix CVE-2023-32437?
To fix CVE-2023-32437, update your iOS or iPadOS device to version 16.6 or higher.
5
Where can I find more information about CVE-2023-32437?
You can find more information about CVE-2023-32437 on the Apple support website.