Home / mailingsPDF  

APPLE-SA-2022-01-26-7 Safari 15.3

Posted on 27 January 2022
Apple Security-announce

APPLE-SA-2022-01-26-7 Safari 15.3

Safari 15.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213058.

WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2022-22590: Toan Pham from Team Orca of Sea Security
(security.sea.com)

WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing maliciously crafted web content may prevent
Content Security Policy from being enforced
Description: A logic issue was addressed with improved state
management.
CVE-2022-22592: Prakash (@1lastBr3ath)

WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing a maliciously crafted mail message may lead to
running arbitrary javascript
Description: A validation issue was addressed with improved input
sanitization.
CVE-2022-22589: Heige of KnownSec 404 Team (knownsec.com) and Bo Qu
of Palo Alto Networks (paloaltonetworks.com)

WebKit Storage
Available for: macOS Big Sur and macOS Catalina
Impact: A website may be able to track sensitive user information
Description: A cross-origin issue in the IndexDB API was addressed
with improved input validation.
CVE-2022-22594: Martin Bajanik of FingerprintJS

Additional recognition

WebKit
We would like to acknowledge Prakash (@1lastBr3ath) for their
assistance.


Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

 

TOP