=====================================================================

                             CERT-Renater

                   Note d'Information No. 2021/VULN050
_____________________________________________________________________

DATE                : 31/01/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Safari versions prior to 15.3.

=====================================================================
https://support.apple.com/en-us/HT213058
_____________________________________________________________________

APPLE-SA-2022-01-26-7 Safari 15.3

Safari 15.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213058.

WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2022-22590: Toan Pham from Team Orca of Sea Security
(security.sea.com)

WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing maliciously crafted web content may prevent
Content Security Policy from being enforced
Description: A logic issue was addressed with improved state
management.
CVE-2022-22592: Prakash (@1lastBr3ath)

WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing a maliciously crafted mail message may lead to
running arbitrary javascript
Description: A validation issue was addressed with improved input
sanitization.
CVE-2022-22589: Heige of KnownSec 404 Team (knownsec.com) and Bo Qu
of Palo Alto Networks (paloaltonetworks.com)

WebKit Storage
Available for: macOS Big Sur and macOS Catalina
Impact: A website may be able to track sensitive user information
Description: A cross-origin issue in the IndexDB API was addressed
with improved input validation.
CVE-2022-22594: Martin Bajanik of FingerprintJS

Additional recognition

WebKit
We would like to acknowledge Prakash (@1lastBr3ath) for their
assistance.


Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================