CVE-2022-22589

MEDIUM

Safari < 15.3 - Remote Code Execution via Malicious Mail Message

Title source: llm
STIX 2.1

Description

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript.

References (11)

Core 11
Core References
Vendor Advisory x_refsource_confirm
https://support.apple.com/kb/HT213185
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213053
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213054
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213057
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213059
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213058
Vendor Advisory x_refsource_confirm
https://support.apple.com/kb/HT213256
Vendor Advisory x_refsource_confirm
https://support.apple.com/kb/HT213255
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2022/May/33
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2022/May/35
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202208-39

Scores

CVSS v3 6.1
EPSS 0.0202
EPSS Percentile 78.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

Status published
Products (8)
apple/ipados < 15.3
apple/iphone_os < 15.3
apple/mac_os_x 10.15.7 (14 CPE variants)
apple/mac_os_x 10.15 - 10.15.7
apple/macos 11.0 - 11.6.6
apple/safari < 15.3
apple/tvos < 15.3
apple/watchos < 8.4
Published Mar 18, 2022
Tracked Since Feb 18, 2026