CVE-2023-41968

EUVD-2023-46427
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to read arbitrary files.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 6%
Affected Products (NVD)
VendorProductVersion
appleipados
𝑥
< 17.0
appleiphone_os
𝑥
< 17.0
applemacos
12.0.0 ≤
𝑥
< 12.7
applemacos
13.0 ≤
𝑥
< 13.6
appletvos
𝑥
< 17.0
applewatchos
𝑥
< 10.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2023/Oct/10
http://seclists.org/fulldisclosure/2023/Oct/3
http://seclists.org/fulldisclosure/2023/Oct/5
http://seclists.org/fulldisclosure/2023/Oct/6
http://seclists.org/fulldisclosure/2023/Oct/8
http://seclists.org/fulldisclosure/2023/Oct/9
https://support.apple.com/en-us/HT213931
https://support.apple.com/en-us/HT213932
https://support.apple.com/en-us/HT213936
https://support.apple.com/en-us/HT213937
https://support.apple.com/en-us/HT213938
https://support.apple.com/en-us/HT213940
http://seclists.org/fulldisclosure/2023/Oct/10
http://seclists.org/fulldisclosure/2023/Oct/3
http://seclists.org/fulldisclosure/2023/Oct/5
http://seclists.org/fulldisclosure/2023/Oct/6
http://seclists.org/fulldisclosure/2023/Oct/8
http://seclists.org/fulldisclosure/2023/Oct/9
https://support.apple.com/en-us/HT213931
https://support.apple.com/en-us/HT213932
https://support.apple.com/en-us/HT213936
https://support.apple.com/en-us/HT213937
https://support.apple.com/en-us/HT213938
https://support.apple.com/en-us/HT213940
https://support.apple.com/kb/HT213931
https://support.apple.com/kb/HT213932
https://support.apple.com/kb/HT213937
https://support.apple.com/kb/HT213938
https://support.apple.com/kb/HT213940