VulnerabilityModified

CVE-2023-42867

This issue was addressed with improved validation of the process entitlement and Team ID.

HIGH 7.8EPSS 0.21%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

This issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app may be able to gain root privileges.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.21% probability · 11th percentile
CISA KEV: Not listed
Weakness: CWE-281
Affected: apple/garageband
Source: product-security@apple.com

References

https://support.apple.com/en-us/120299Vendor Advisory
https://support.apple.com/kb/HT214042

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.