Important Security Update for Ventura and Monterey
This is an important security update that patches 2 known zero day vulnerabilities. Also of NOTE, Apple put this note on the 13.6 security update page
This means that Apple will be releasing more information on additional security vulnerabilities soon.
Kernel
Available for: macOS Ventura
Impact: A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Description: The issue was addressed with improved checks.
CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of Toronto’s Munk School and Maddie Stone of Google’s Threat Analysis Group
Security
Available for: macOS Ventura
Impact: A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Description: A certificate validation issue was addressed.
CVE-2023-41991: Bill Marczak of The Citizen Lab at The University of Toronto’s Munk School and Maddie Stone of Google’s Threat Analysis Group
macOS Ventura 13.6 Security Update
Released September 21, 2023
My macOS Ventura 13.6 Update Video
macOS Ventura Patch Notes Summary
1. New Features – none
2. Bug fixes – none
4. Enterprise Changes – None
3. Security Fixes – 2
4. Safari Security (Webkit) – 0
5. Full installer and M1 IPSW – Full installer and M1/M2 IPSW restore file released!
6. OpenCore Legacy Patcher Users – OCLP 0.6.8 – Tested good on 2011 MBPro 15″ (Non Metal) & 2015 MacBook Pro 15″ (Metal GPU)
Full Apple Public Update Release list
macOS 💻 ✅
Ventura 13.6 (22G120)
Monterey – 12.7 (21G725)
Big Sur – None – Current =11.7.10 (20G1427)
Safari – 16.6 (Ventura not updated) 16.6.1 (Updated Monterey & Big Sur Only)
macOS Ventura 13.5.2 (22G91) Update is now Available!
UPDATED: 9/19/23
This article will be continually updated as new information comes in.
Apple just released macOS Ventura 13.5.2 to the public! Let’s jump in and find out what’s new in this update.
This is an important security update that patches a known zero day vulnerability called BLASTPASS. A zero day means the exploit was actively used before Apple was able to fix it and patch it with 13.5.2.
UPDATE #2
Citizenlab the group that reported the venerability to Apple says the exploit is an “NSO Group iPhone Zero-Click, Zero-Day Exploit” CVE-2023-41064 CVE-2023-41061
“Apple’s Security Engineering and Architecture team and Citizen Lab believe that Lockdown Mode blocks this particular attack.“
CIS has issued a Security Bulletin 2023-100 that discusses the CVE-2023-41064 venerability. The recommendation is to patch ASAP for large and medium companies.
Impact: Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2023-41064: The Citizen Lab at The University of Torontoʼs Munk School
My macOS Ventura 13.5.2 Update Video!
macOS Ventura Patch Notes Summary
1. New Features – none
2. Bug fixes – none
4. Enterprise Changes – None
3. Security Fixes – 1
4. Safari Security (Webkit) – None
5. Full installer and M1 IPSW – Full installer and M1/M2 IPSW restore file released!
6. OpenCore Legacy Patcher Users – Testing in progress with OCLP 0.6.8
