Home / mailings APPLE-SA-2022-01-26-7 Safari 15.3
Posted on 27 January 2022
Apple Security-announceAPPLE-SA-2022-01-26-7 Safari 15.3
Safari 15.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213058.
WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2022-22590: Toan Pham from Team Orca of Sea Security
(security.sea.com)
WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing maliciously crafted web content may prevent
Content Security Policy from being enforced
Description: A logic issue was addressed with improved state
management.
CVE-2022-22592: Prakash (@1lastBr3ath)
WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing a maliciously crafted mail message may lead to
running arbitrary javascript
Description: A validation issue was addressed with improved input
sanitization.
CVE-2022-22589: Heige of KnownSec 404 Team (knownsec.com) and Bo Qu
of Palo Alto Networks (paloaltonetworks.com)
WebKit Storage
Available for: macOS Big Sur and macOS Catalina
Impact: A website may be able to track sensitive user information
Description: A cross-origin issue in the IndexDB API was addressed
with improved input validation.
CVE-2022-22594: Martin Bajanik of FingerprintJS
Additional recognition
WebKit
We would like to acknowledge Prakash (@1lastBr3ath) for their
assistance.
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/