-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-01-22-2024-5 macOS Sonoma 14.3

macOS Sonoma 14.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214061.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: macOS Sonoma
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2024-23212: Ye Zhang of Baidu Security

CoreCrypto
Available for: macOS Sonoma
Impact: An attacker may be able to decrypt legacy RSA PKCS#1 v1.5
ciphertexts without having the private key
Description: A timing side-channel issue was addressed with improvements
to constant-time computation in cryptographic functions.
CVE-2024-23218: Clemens Lang

Finder
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: The issue was addressed with improved checks.
CVE-2024-23224: Brian McNulty

Kernel
Available for: macOS Sonoma
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2024-23208: fmyy(@binary_fmyy) and lime From TIANGONG Team of
Legendsec at QI-ANXIN Group

LLVM
Available for: macOS Sonoma
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
CVE-2024-23209

Mail Search
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved redaction of
sensitive information.
CVE-2024-23207: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab), and
Ian de Marcellus

NSSpellChecker
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved handling of
files.
CVE-2024-23223: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)

Safari
Available for: macOS Sonoma
Impact: A user's private browsing activity may be visible in Settings
Description: A privacy issue was addressed with improved handling of
user preferences.
CVE-2024-23211: Mark Bowers

Shortcuts
Available for: macOS Sonoma
Impact: A shortcut may be able to use sensitive data with certain
actions without prompting the user
Description: The issue was addressed with additional permissions checks.
CVE-2024-23203: an anonymous researcher
CVE-2024-23204: Jubaer Alnazi (@h33tjubaer)

Shortcuts
Available for: macOS Sonoma
Impact: An app may be able to bypass certain Privacy preferences
Description: A privacy issue was addressed with improved handling of
temporary files.
CVE-2024-23217: Kirin (@Pwnrin)

TCC
Available for: macOS Sonoma
Impact: An app may be able to access user-sensitive data
Description: An issue was addressed with improved handling of temporary
files.
CVE-2024-23215: Zhongquan Li (@Guluisacat)

Time Zone
Available for: macOS Sonoma
Impact: An app may be able to view a user's phone number in system logs
Description: This issue was addressed with improved redaction of
sensitive information.
CVE-2024-23210: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)

WebKit
Available for: macOS Sonoma
Impact: A maliciously crafted webpage may be able to fingerprint the
user
Description: An access issue was addressed with improved access
restrictions.
WebKit Bugzilla: 262699
CVE-2024-23206: an anonymous researcher

WebKit
Available for: macOS Sonoma
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 266619
CVE-2024-23213: Wangtaiyu of Zhongfu info

WebKit
Available for: macOS Sonoma
Impact: Processing maliciously crafted web content may lead to arbitrary
code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
WebKit Bugzilla: 265129
CVE-2024-23214: Nan Wang (@eternalsakura13) of 360 Vulnerability
Research Institute

WebKit
Available for: macOS Sonoma
Impact: Processing maliciously crafted web content may lead to arbitrary
code execution. Apple is aware of a report that this issue may have been
exploited.
Description: A type confusion issue was addressed with improved checks.
WebKit Bugzilla: 267134
CVE-2024-23222

macOS Sonoma 14.3 may be obtained from the Mac App Store or Apple's
Software Downloads web site: https://support.apple.com/downloads/
All information is also posted on the Apple Security Updates
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmWvDgUACgkQX+5d1TXa
Ivrf0Q/+Oca+geM2QXg9QR+6PJwuFfzuAMn2nm88bHWtJH6kaTe8Lc48OuFk6j0C
Q9KoLCDG7JTya701wTgIfCnJEpS7J6JCHxao8qPujebjTFumhvwigwI0uZzD1H2r
c5fJfQtlNAfG163ON26ZEbF7AMVL630illOUko0ULqYCiUM4qF/5h0zsPJgXjFHJ
4Yc5nMqH3jVjaAVxwNQhxU1L8Rz0xzOrNPX05FixPx9MTLZ6CuS8cRBYBv1HkLxm
OIqc4QUuWngNdxQ+ZCEcnr6yg96VXg6S7gVRlLOcTLxDOzRADF0OpztLwtfksMKp
gB7QllWloOIQ//NfWcNAX/TqmeKvOJ9kVTgRxz6MfwbnVkI9WfW3XQ1joowJ25r7
mn/X/bk3Bi+U3qTxxiAFi/Wlh2QfSnIwVmd0KWuFnbxs/5LyeGox+jDbRO1xKlfv
tj1V1aMVBUqj3OIWBbdN/pOpgDhhPfKrdwHNcER/LuTitjXAOhDI60Jdi/6xQBgY
S4d4duOjvEj7gY3EYJ5qrW/+2f/dNzMw6lsmPpckgKbUwKgqEaHadAEzpxkRZ1rm
4BOozvMt69WlhCOFEEyVky08opNCQg/uQj0Uegcm6zeEpv98xsk0a9NJMRI+Pjsw
rdTAOkNCgTy0QROYO+/TympI2LEJkppw+TSbaYK1S+rLDMO9Cvo=
=rPM0
-----END PGP SIGNATURE-----