Apple has rolled out a security update aimed at addressing three Git flaws within its Xcode macOS development environment, SecurityWeek reports.
Threat actors could exploit the first vulnerability tracked as CVE-2022-29187, which is a CVE-2022-24765 variant to facilitate configuration file creation within the malicious .git directory and enable the execution of arbitrary commands.
"An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository," said Apple, which noted that all Git versions before 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 are affected. Also fixed in the update is CVE-2022-39253, which could be leveraged to allow information leaks.
Apple's latest security update also addresses CVE-2022-39260, which could be abused for arbitrary code execution, and CVE-2022-42797, which could be exploited to obtain root privileges.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.