High severity · published Dec 20, 2024
CVE-2023-42867
This issue was addressed with improved validation of the process entitlement and Team ID
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
This issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app may be able to gain root privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
GarageBand · Apple
before 10.4.9 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-42867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-42867
Vendor Advisory
https://support.apple.com/en-us/120299
support.apple.com
https://support.apple.com/kb/HT214042
More from GarageBand
8.8
CVE-2017-2372
An issue was discovered in certain Apple products
7.8
CVE-2024-44142
The issue was addressed with improved bounds checks
7.8
CVE-2024-23300
A use-after-free issue was addressed with improved memory management
7.8
CVE-2022-22664
An out-of-bounds read was addressed with improved bounds checking
7.8
CVE-2022-22657
A memory initialization issue was addressed with improved memory handling