CVE-2022-42855highexplotación observadaCWE-269

CVE-2022-42855: fallo de gravedad alta en Apple tvOS

Publicada el 15 dic 2022 · Actualizada el 21 abr 2025

Seguir esta CVE + Monitorear tvOS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 7.1epss 0.5%

de la publicación al arma

Publicada en NVD15 dic

VulnCheck13 dic

A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to use arbitrary entitlements.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Productos afectados

Apple · tvOS

CVEs relacionadas — Apple tvOS

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-43529HIGHCVE-2025-43529EPSS 25.7%KEV CVE-2025-31200CRITICALCVE-2025-31200EPSS 20.9%KEV CVE-2023-37450HIGHCVE-2023-37450EPSS 18.9%KEV CVE-2019-8605HIGHCVE-2019-8605EPSS 17.6%KEV CVE-2025-24085CRITICALCVE-2025-24085EPSS 17.4%KEV CVE-2023-32409HIGHCVE-2023-32409EPSS 16.5%KEV

Referencias

http://packetstormsecurity.com/files/170518/libCoreEntitlements-CEContextQuery-Arbitrary-Entitlement-Returns.html http://seclists.org/fulldisclosure/2022/Dec/20 http://seclists.org/fulldisclosure/2022/Dec/21 http://seclists.org/fulldisclosure/2022/Dec/23 http://seclists.org/fulldisclosure/2022/Dec/24 http://seclists.org/fulldisclosure/2022/Dec/26 https://support.apple.com/en-us/HT213530 https://support.apple.com/en-us/HT213531 https://support.apple.com/en-us/HT213532 https://support.apple.com/en-us/HT213533 https://support.apple.com/en-us/HT213535 https://support.apple.com/kb/HT213536