macOS Monterey 12.5 is now available and full of security updates
Apple on Wednesday released macOS 12.5, an update to the Mac operating system. The update includes enhancements to the TV app and Safari, as well as bug fixes and security patches.
Here are the release notes:
macOS Monterey 12.5 includes enhancements, bug fixes and security updates.
• TV app adds the option to restart a live sports game already in-progress and pause, rewind, or fast-forward
• Fixes an issue in Safari where a tab may revert back to a previous page
Some features may not be available for all regions, or on all Apple devices.
This update is chock full of security updates, according to the macOS 12.5 security support document. Here’s a list of the security updates:
APFS
Available for: macOS Monterey
Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
CVE-2022-32832: Tommy Muir (@Muirey03)
AppleMobileFileIntegrity
Available for: macOS Monterey
Impact: An app may be able to gain root privileges
Description: An authorization issue was addressed with improved state management.
CVE-2022-32826: Mickey Jin (@patch1t) of Trend Micro
Apple Neural Engine
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
CVE-2022-32810: Mohamed Ghannam (@_simo36)
Apple Neural Engine
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: This issue was addressed with improved checks.
CVE-2022-32840: Mohamed Ghannam (@_simo36)
Apple Neural Engine
Available for: macOS Monterey
Impact: An app may be able to break out of its sandbox
Description: This issue was addressed with improved checks.
CVE-2022-32845: Mohamed Ghannam (@_simo36)
AppleScript
Available for: macOS Monterey
Impact: Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory
Description: This issue was addressed with improved checks.
CVE-2022-32797: Mickey Jin (@patch1t), Ye Zhang (@co0py_Cat) of Baidu Security, Mickey Jin (@patch1t) of Trend Micro
AppleScript
Available for: macOS Monterey
Impact: Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved input validation.
CVE-2022-32851: Ye Zhang (@co0py_Cat) of Baidu Security
CVE-2022-32852: Ye Zhang (@co0py_Cat) of Baidu Security
CVE-2022-32853: Ye Zhang (@co0py_Cat) of Baidu Security
AppleScript
Available for: macOS Monterey
Impact: Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory
Description: An out-of-bounds read issue was addressed with improved bounds checking.
CVE-2022-32831: Ye Zhang (@co0py_Cat) of Baidu Security
Audio
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: An out-of-bounds write issue was addressed with improved input validation.
CVE-2022-32820: an anonymous researcher
Audio
Available for: macOS Monterey
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2022-32825: John Aakerblom (@jaakerblom)
Automation
Available for: macOS Monterey
Impact: An app may be able to bypass Privacy preferences
Description: A logic issue was addressed with improved checks.
CVE-2022-32789: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab
Calendar
Available for: macOS Monterey
Impact: An app may be able to access sensitive user information
Description: The issue was addressed with improved handling of caches.
CVE-2022-32805: Csaba Fitzl (@theevilbit) of Offensive Security
CoreMedia
Available for: macOS Monterey
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2022-32828: Antonio Zekic (@antoniozekic) and John Aakerblom (@jaakerblom)
CoreText
Available for: macOS Monterey
Impact: A remote user may cause an unexpected app termination or arbitrary code execution
Description: The issue was addressed with improved bounds checks.
CVE-2022-32839: STAR Labs (@starlabs_sg)
File System Events
Available for: macOS Monterey
Impact: An app may be able to gain root privileges
Description: A logic issue was addressed with improved state management.
CVE-2022-32819: Joshua Mason of Mandiant
GPU Drivers
Available for: macOS Monterey
Impact: An app may be able to disclose kernel memory
Description: Multiple out-of-bounds write issues were addressed with improved bounds checking.
CVE-2022-32793: an anonymous researcher
GPU Drivers
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved validation.
CVE-2022-32821: John Aakerblom (@jaakerblom)
iCloud Photo Library
Available for: macOS Monterey
Impact: An app may be able to access sensitive user information
Description: An information disclosure issue was addressed by removing the vulnerable code.
CVE-2022-32849: Joshua Jones
ICU
Available for: macOS Monterey
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2022-32787: Dohyun Lee (@l33d0hyun) of SSD Secure Disclosure Labs & DNSLab, Korea Univ.
ImageIO
Available for: macOS Monterey
Impact: Processing a maliciously crafted image may result in disclosure of process memory
Description: The issue was addressed with improved memory handling.
CVE-2022-32841: hjy79425575
ImageIO
Available for: macOS Monterey
Impact: Processing an image may lead to a denial-of-service
Description: A null pointer dereference was addressed with improved validation.
CVE-2022-32785: Yiğit Can YILMAZ (@yilmazcanyigit)
Intel Graphics Driver
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A memory corruption vulnerability was addressed with improved locking.
CVE-2022-32811: ABC Research s.r.o
Intel Graphics Driver
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
CVE-2022-32812: Yinyi Wu (@3ndy1), ABC Research s.r.o.
Kernel
Available for: macOS Monterey
Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
CVE-2022-32813: Xinru Chi of Pangu Lab
CVE-2022-32815: Xinru Chi of Pangu Lab
Kernel
Available for: macOS Monterey
Impact: An app may be able to disclose kernel memory
Description: An out-of-bounds read issue was addressed with improved bounds checking.
CVE-2022-32817: Xinru Chi of Pangu Lab
Kernel
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: This issue was addressed with improved checks.
CVE-2022-32829: an anonymous researcher
Liblouis
Available for: macOS Monterey
Impact: An app may cause unexpected app termination or arbitrary code execution
Description: This issue was addressed with improved checks.
CVE-2022-26981: Hexhive (hexhive.epfl.ch), NCNIPC of China (nipc.org.cn)
libxml2
Available for: macOS Monterey
Impact: An app may be able to leak sensitive user information
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2022-32823
Multi-Touch
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A type confusion issue was addressed with improved checks.
CVE-2022-32814: Pan ZhenPeng (@Peterpan0927)
Multi-Touch
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A type confusion issue was addressed with improved state handling.
CVE-2022-32814: Pan ZhenPeng (@Peterpan0927)
PackageKit
Available for: macOS Monterey
Impact: An app may be able to modify protected parts of the file system
Description: An issue in the handling of environment variables was addressed with improved validation.
CVE-2022-32786: Mickey Jin (@patch1t)
PackageKit
Available for: macOS Monterey
Impact: An app may be able to modify protected parts of the file system
Description: This issue was addressed with improved checks.
CVE-2022-32800: Mickey Jin (@patch1t)
PluginKit
Available for: macOS Monterey
Impact: An app may be able to read arbitrary files
Description: A logic issue was addressed with improved state management.
CVE-2022-32838: Mickey Jin (@patch1t) of Trend Micro
PS Normalizer
Available for: macOS Monterey
Impact: Processing a maliciously crafted Postscript file may result in unexpected app termination or disclosure of process memory
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2022-32843: Kai Lu of Zscaler’s ThreatLabz
SMB
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved state management.
CVE-2022-32796: Sreejith Krishnan R (@skr0x1c0)
SMB
Available for: macOS Monterey
Impact: An app may be able to gain elevated privileges
Description: An out-of-bounds read issue was addressed with improved input validation.
CVE-2022-32842: Sreejith Krishnan R (@skr0x1c0)
SMB
Available for: macOS Monterey
Impact: An app may be able to gain elevated privileges
Description: An out-of-bounds write issue was addressed with improved input validation.
CVE-2022-32798: Sreejith Krishnan R (@skr0x1c0)
SMB
Available for: macOS Monterey
Impact: A user in a privileged network position may be able to leak sensitive information
Description: An out-of-bounds read issue was addressed with improved bounds checking.
CVE-2022-32799: Sreejith Krishnan R (@skr0x1c0)
SMB
Available for: macOS Monterey
Impact: An app may be able to leak sensitive kernel state
Description: The issue was addressed with improved memory handling.
CVE-2022-32818: Sreejith Krishnan R (@skr0x1c0)
Software Update
Available for: macOS Monterey
Impact: A user in a privileged network position can track a user’s activity
Description: This issue was addressed by using HTTPS when sending information over the network.
CVE-2022-32857: Jeffrey Paul (sneak.berlin)
Spindump
Available for: macOS Monterey
Impact: An app may be able to overwrite arbitrary files
Description: This issue was addressed with improved file handling.
CVE-2022-32807: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab
Spotlight
Available for: macOS Monterey
Impact: An app may be able to gain root privileges
Description: This issue was addressed with improved checks.
CVE-2022-32801: Joshua Mason (@josh@jhu.edu)
subversion
Available for: macOS Monterey
Impact: Multiple issues in subversion
Description: Multiple issues were addressed by updating subversion.
CVE-2021-28544: Evgeny Kotkov, visualsvn.com
CVE-2022-24070: Evgeny Kotkov, visualsvn.com
CVE-2022-29046: Evgeny Kotkov, visualsvn.com
CVE-2022-29048: Evgeny Kotkov, visualsvn.com
TCC
Available for: macOS Monterey
Impact: An app may be able to access sensitive user information
Description: An access issue was addressed with improvements to the sandbox.
CVE-2022-32834: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com)
WebKit
Available for: macOS Monterey
Impact: Visiting a website that frames malicious content may lead to UI spoofing
Description: The issue was addressed with improved UI handling.
WebKit Bugzilla: 239316
CVE-2022-32816: Dohyun Lee (@l33d0hyun) of SSD Secure Disclosure Labs & DNSLab, Korea Univ.WebKit
Available for: macOS Monterey
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved input validation.
WebKit Bugzilla: 240720
CVE-2022-32792: Manfred Paul (@_manfp) working with Trend Micro Zero Day InitiativeWebRTC
Available for: macOS Monterey
Impact: Processing maliciously crafted web content may lead to arbitrary code execution.
Description: A memory corruption issue was addressed with improved state management.
WebKit Bugzilla: 242339
CVE-2022-2294: Jan Vojtesek of Avast Threat Intelligence teamWi-Fi
Available for: macOS Monterey
Impact: An app may be able to cause unexpected system termination or write kernel memory
Description: This issue was addressed with improved checks.
CVE-2022-32837: Wang Yu of Cyberserval
Wi-Fi
Available for: macOS Monterey
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: This issue was addressed with improved checks.
CVE-2022-32847: Wang Yu of Cyberserval
Windows Server
Available for: macOS Monterey
Impact: An app may be able to capture a user’s screen
Description: A logic issue was addressed with improved checks.
CVE-2022-32848: Jeremy Legendre of MacEnhance
How to update to macOS 12.5
- Open System Preferences.
- Click on Software Update.
- Your Mac will spend a minute or so checking for updates, if an update is available for your Mac you’ll have the option to click on Upgrade Now and then download the installer for the update to macOS.
- While the installer is being downloaded you will be able to continue to use your Mac. Once the installer has downloaded you can click to install the new update.
You can also set your Mac to automatically update. For details of how to do that, and more information about updating macOS, read: How to update macOS.
Read about the latest version of macOS Monterey for news about the problems with, and fixes coming to, the current version of macOS.
