CVE-2023-27961: 
macOS vulnerability analysis and mitigation

CVE-2023-27961 is a security vulnerability affecting multiple Apple operating systems including macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, watchOS 9.4, and macOS Big Sur 11.7.5. The vulnerability was discovered by Rıza Sabuncu (@rizasabuncu) and involves multiple validation issues in the Calendar application that could allow maliciously crafted calendar invitations to exfiltrate user information (Apple Support).

The vulnerability stems from multiple validation issues in the Calendar application's input sanitization mechanisms. The issue was addressed by Apple through improved input sanitization implementations. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. This indicates local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability (NVD).

If exploited, this vulnerability allows an attacker to exfiltrate user information through maliciously crafted calendar invitations. The vulnerability has a high confidentiality impact, potentially exposing sensitive user data (Apple Support).

The vulnerability requires user interaction to be exploited, specifically through importing a maliciously crafted calendar invitation. The attack vector is local, meaning the attacker needs local access to the system to execute the attack. No special privileges are required to exploit this vulnerability (NVD).

Apple has addressed this vulnerability by implementing improved input sanitization in the following software updates: macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, watchOS 9.4, and macOS Big Sur 11.7.5. Users are advised to update their devices to these versions to protect against this vulnerability (Apple Support).