-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-09-26-2023-5 Additional information for APPLE-SA-2023-09-21-7 macOS Monterey 12.7

macOS Monterey 12.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213932.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-40412: Mohamed GHANNAM (@_simo36)
CVE-2023-40409: Ye Zhang (@VAR10CK) of Baidu Security
Entry added September 26, 2023

Apple Neural Engine
Available for: macOS Monterey
Impact: An app may be able to disclose kernel memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2023-40410: Tim Michaud (@TimGMichaud) of Moveworks.ai
Entry added September 26, 2023

Biometric Authentication
Available for: macOS Monterey
Impact: An app may be able to disclose kernel memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2023-41232: Liang Wei of PixiePoint Security
Entry added September 26, 2023

ColorSync
Available for: macOS Monterey
Impact: An app may be able to read arbitrary files
Description: The issue was addressed with improved checks.
CVE-2023-40406: JeongOhKyea of Theori
Entry added September 26, 2023

CoreAnimation
Available for: macOS Monterey
Impact: Processing web content may lead to a denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2023-40420: 이준성(Junsung Lee) of Cross Republic
Entry added September 26, 2023

Disk Management
Available for: macOS Monterey
Impact: An app may be able to read arbitrary files
Description: This issue was addressed with improved validation of
symlinks.
CVE-2023-41968: Mickey Jin (@patch1t) and James Hutchins
Entry added September 26, 2023

Game Center
Available for: macOS Monterey
Impact: An app may be able to access contacts
Description: The issue was addressed with improved handling of caches.
CVE-2023-40395: Csaba Fitzl (@theevilbit) of Offensive Security
Entry added September 26, 2023

Kernel
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-41984: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Entry added September 26, 2023

Kernel
Available for: macOS Monterey
Impact: A local attacker may be able to elevate their privileges. Apple
is aware of a report that this issue may have been actively exploited
against versions of iOS before iOS 16.7.
Description: The issue was addressed with improved checks.
CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

libxpc
Available for: macOS Monterey
Impact: An app may be able to access protected user data
Description: An authorization issue was addressed with improved state
management.
CVE-2023-41073: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab
(xlab.tencent.com)
Entry added September 26, 2023

libxpc
Available for: macOS Monterey
Impact: An app may be able to delete files for which it does not have
permission
Description: A permissions issue was addressed with additional
restrictions.
CVE-2023-40454: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab
(xlab.tencent.com)
Entry added September 26, 2023

libxslt
Available for: macOS Monterey
Impact: Processing web content may disclose sensitive information
Description: The issue was addressed with improved memory handling.
CVE-2023-40403: Dohyun Lee (@l33d0hyun) of PK Security
Entry added September 26, 2023

Maps
Available for: macOS Monterey
Impact: An app may be able to read sensitive location information
Description: The issue was addressed with improved handling of caches.
CVE-2023-40427: Adam M., and Wojciech Regula of SecuRing
(wojciechregula.blog)
Entry added September 26, 2023

Sandbox
Available for: macOS Monterey
Impact: An app may be able to overwrite arbitrary files
Description: The issue was addressed with improved bounds checks.
CVE-2023-40452: Yiğit Can YILMAZ (@yilmazcanyigit)
Entry added September 26, 2023

Additional recognition

AppSandbox
We would like to acknowledge Kirin (@Pwnrin) for their assistance.
Entry added September 26, 2023

Kernel
We would like to acknowledge Bill Marczak of The Citizen Lab at The
University of Toronto's Munk School and Maddie Stone of Google's Threat
Analysis Group for their assistance.

libxml2
We would like to acknowledge OSS-Fuzz, and Ned Williamson of Google
Project Zero for their assistance.
Entry added September 26, 2023

WebKit
We would like to acknowledge Khiem Tran, and Narendra Bhati From Suma
Soft Pvt. Ltd, Pune (India) for their assistance.
Entry added September 26, 2023

WebRTC
We would like to acknowledge anonymous researcher for their assistance.
Entry added September 26, 2023

macOS Monterey 12.7 may be obtained from the Mac App Store or Apple's
Software Downloads web site: https://support.apple.com/downloads/
All information is also posted on the Apple Security Updates
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJgACgkQX+5d1TXa
IvqcNQ/9GQlneQRhlET+3tkaIg7g0XJE+HkDOKOR/F5oi9yAkvpg5O+jAiwKq61E
PXvBWN6b0dhrANcRswmEDF2SWVIbPLLnkne5F6XoA18SDVxOorUYXxdsXaOIVO3J
Zssoxhc5cFLR41m8WqnJ2MqJHhPvjKAtFjqyUXiF/ZbBqrKtnYeiho+ueG/joDbb
lMGf2AXUQQ5Zoc7J4EPgtlrBBXIeJobcRsFrYWnvimEADfyX87w7Idf5pfbrgmbu
xy0B4742tPztEu7SvKpZzD9CqQU7Lpm+uK4JfiZjllkibe4sYyypyVptDGQRB08S
WJ6zPXNA5Wm2F7Fjplx9m1qPqGen2kek5dBCT09QfqFwdnjp/tiAODmdHD+PYtdI
ANoMRQ7J2i99mm8AtKpM279sNmF5byvpAYCJypJylmy0TRspvDfWv5ekfNutZ/iG
JnTFck0V6j+a3VAKOvyDkP0kIpbEw4Efx7r9TBqcYJq+EkxZyRNlbqZyz21d7rpN
aQKI5Q1hCZosOZt6ndeqsymJJatMsvFFV7QUKOyFYq9+WDaj1soOgeXQKcyX2LFN
Iq7js+tS2t+r5A8t8tZEsEKfSObgOhX3gJhA81vbkVOM0NtqFHJj/YNBI16A16rz
GNB6OtcLdc+omv5tu9g6WGGN7GVCspY4RmmnXnAJS2YKf1lZYAA=
=bYk1
-----END PGP SIGNATURE-----