Vulnerability-Lookup

WID-SEC-W-2024-3286

Vulnerability from csaf_certbund - Published: 2024-10-27 23:00 - Updated: 2024-11-19 23:00

Summary

Red Hat Enterprise Linux: Mehrere Schwachstellen

Severity

Kritisch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial-of-Service-Zustand zu erzeugen.

Betroffene Betriebssysteme: - Linux

CVE-2022-32885

Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden Überprüfung der Grenzen oder einer Speicherbeschädigung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu erzeugen.

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2023-40397

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2023-42852

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2023-42917

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2024-27820

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2024-27851

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2024-40776

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2024-40779

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2024-40780

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2024-40782

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2024-40789

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

CVE-2024-4558

Affected products

Known affected 5 products

Product	Identifier	Version
Red Hat Enterprise Linux 9 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9`	9
RESF Rocky Linux 8 RESF / Rocky Linux	`cpe:/o:resf:rocky_linux:8`	8
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux 9.2 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:9.2`	9.2
Oracle Linux Oracle	`cpe:/o:oracle:linux:-`	—

References

10 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://access.redhat.com/errata/RHSA-2024:8492	external
https://access.redhat.com/errata/RHSA-2024:8496	external
https://access.redhat.com/errata/RHSA-2024:9646	external
https://access.redhat.com/errata/RHSA-2024:9653	external
https://access.redhat.com/errata/RHSA-2024:9680	external
https://access.redhat.com/errata/RHSA-2024:9679	external
http://linux.oracle.com/errata/ELSA-2024-9636.html	external
https://errata.build.resf.org/RLSA-2024:9636	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3286 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3286.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3286 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3286"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2024-10-27",
        "url": "https://access.redhat.com/errata/RHSA-2024:8492"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2024-10-27",
        "url": "https://access.redhat.com/errata/RHSA-2024:8496"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9646 vom 2024-11-14",
        "url": "https://access.redhat.com/errata/RHSA-2024:9646"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9653 vom 2024-11-14",
        "url": "https://access.redhat.com/errata/RHSA-2024:9653"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9680 vom 2024-11-14",
        "url": "https://access.redhat.com/errata/RHSA-2024:9680"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9679 vom 2024-11-14",
        "url": "https://access.redhat.com/errata/RHSA-2024:9679"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2024-9636 vom 2024-11-18",
        "url": "http://linux.oracle.com/errata/ELSA-2024-9636.html"
      },
      {
        "category": "external",
        "summary": "Rocky Linux Security Advisory RLSA-2024:9636 vom 2024-11-19",
        "url": "https://errata.build.resf.org/RLSA-2024:9636"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat Enterprise Linux: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-11-19T23:00:00.000+00:00",
      "generator": {
        "date": "2024-11-20T09:18:39.412+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-3286",
      "initial_release_date": "2024-10-27T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-10-27T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-11-14T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-11-17T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2024-11-19T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8",
                "product": {
                  "name": "RESF Rocky Linux 8",
                  "product_id": "T039270",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:resf:rocky_linux:8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rocky Linux"
          }
        ],
        "category": "vendor",
        "name": "RESF"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9",
                "product": {
                  "name": "Red Hat Enterprise Linux 9",
                  "product_id": "T035974",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "9.2",
                "product": {
                  "name": "Red Hat Enterprise Linux 9.2",
                  "product_id": "T038627",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-32885",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2022-32885"
    },
    {
      "cve": "CVE-2023-40397",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2023-40397"
    },
    {
      "cve": "CVE-2023-42852",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2023-42852"
    },
    {
      "cve": "CVE-2023-42917",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2023-42917"
    },
    {
      "cve": "CVE-2024-27820",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-27820"
    },
    {
      "cve": "CVE-2024-27851",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-27851"
    },
    {
      "cve": "CVE-2024-40776",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-40776"
    },
    {
      "cve": "CVE-2024-40779",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-40779"
    },
    {
      "cve": "CVE-2024-40780",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-40780"
    },
    {
      "cve": "CVE-2024-40782",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-40782"
    },
    {
      "cve": "CVE-2024-40789",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-40789"
    },
    {
      "cve": "CVE-2024-4558",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Red Hat Enterprise Linux. Diese Fehler existieren in den WebKit- und ANGLE-Komponenten aufgrund verschiedener sicherheitsrelevanter Probleme wie einer unzureichenden Speicherbehandlung, einer unzureichenden \u00dcberpr\u00fcfung der Grenzen oder einer Speicherbesch\u00e4digung und mehr. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035974",
          "T039270",
          "67646",
          "T038627",
          "T004914"
        ]
      },
      "release_date": "2024-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-4558"
    }
  ]
}

CVE-2024-40782 (GCVE-0-2024-40782)

Vulnerability from cvelistv5 – Published: 2024-07-29 22:17 – Updated: 2026-04-02 18:25

Summary

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Processing maliciously crafted web content may lead to an unexpected process crash

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/120908
https://support.apple.com/en-us/120909
https://support.apple.com/en-us/120911
https://support.apple.com/en-us/120913
https://support.apple.com/en-us/120914
https://support.apple.com/en-us/120915
https://support.apple.com/en-us/120916

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.6 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 16.7.9 (custom) Affected: 0 , < 17.6 (custom)
Apple	macOS	Affected: 0 , < 14.6 (custom)
Apple	tvOS	Affected: 0 , < 17.6 (custom)
Apple	visionOS	Affected: 0 , < 1.3 (custom)
Apple	watchOS	Affected: 0 , < 10.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "safari",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ios",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ipad_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ios",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "16.7",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ipad_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "16.7",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:watch_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "watch_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "10.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mac_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "14.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "visionos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "1.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:tv_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tv_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-40782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-30T14:29:08.109159Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-30T15:17:06.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:23:07.724Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214121"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214117"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214116"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214124"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214119"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214123"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214122"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/21"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/22"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html"
          },
          {
            "url": "https://support.apple.com/kb/HT214124"
          },
          {
            "url": "https://support.apple.com/kb/HT214123"
          },
          {
            "url": "https://support.apple.com/kb/HT214122"
          },
          {
            "url": "https://support.apple.com/kb/HT214119"
          },
          {
            "url": "https://support.apple.com/kb/HT214117"
          },
          {
            "url": "https://support.apple.com/kb/HT214116"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:25:50.913Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120908"
        },
        {
          "url": "https://support.apple.com/en-us/120909"
        },
        {
          "url": "https://support.apple.com/en-us/120911"
        },
        {
          "url": "https://support.apple.com/en-us/120913"
        },
        {
          "url": "https://support.apple.com/en-us/120914"
        },
        {
          "url": "https://support.apple.com/en-us/120915"
        },
        {
          "url": "https://support.apple.com/en-us/120916"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-40782",
    "datePublished": "2024-07-29T22:17:16.599Z",
    "dateReserved": "2024-07-10T17:11:04.688Z",
    "dateUpdated": "2026-04-02T18:25:50.913Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-27851 (GCVE-0-2024-27851)

Vulnerability from cvelistv5 – Published: 2024-06-10 20:56 – Updated: 2026-04-02 18:25

Summary

The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing maliciously crafted web content may lead to arbitrary code execution.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Processing maliciously crafted web content may lead to arbitrary code execution

Assigner

apple

References

6 references

URL	Tags
https://support.apple.com/en-us/120896
https://support.apple.com/en-us/120901
https://support.apple.com/en-us/120902
https://support.apple.com/en-us/120903
https://support.apple.com/en-us/120905
https://support.apple.com/en-us/120906

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.5 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 17.5 (custom)
Apple	macOS	Affected: 0 , < 14.5 (custom)
Apple	tvOS	Affected: 0 , < 17.5 (custom)
Apple	visionOS	Affected: 0 , < 1.2 (custom)
Apple	watchOS	Affected: 0 , < 10.5 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "iphone_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mac_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "14.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "visionos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "1.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "watchos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "10.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "safari",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tvos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27851",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-15T03:55:31.726Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:18:59.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214101"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214106"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214108"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214104"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214103"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214102"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jun/5"
          },
          {
            "url": "https://support.apple.com/kb/HT214108"
          },
          {
            "url": "https://support.apple.com/kb/HT214106"
          },
          {
            "url": "https://support.apple.com/kb/HT214104"
          },
          {
            "url": "https://support.apple.com/kb/HT214102"
          },
          {
            "url": "https://support.apple.com/kb/HT214101"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing maliciously crafted web content may lead to arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to arbitrary code execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:25:37.181Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120896"
        },
        {
          "url": "https://support.apple.com/en-us/120901"
        },
        {
          "url": "https://support.apple.com/en-us/120902"
        },
        {
          "url": "https://support.apple.com/en-us/120903"
        },
        {
          "url": "https://support.apple.com/en-us/120905"
        },
        {
          "url": "https://support.apple.com/en-us/120906"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-27851",
    "datePublished": "2024-06-10T20:56:47.478Z",
    "dateReserved": "2024-02-26T15:32:28.532Z",
    "dateUpdated": "2026-04-02T18:25:37.181Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-27820 (GCVE-0-2024-27820)

Vulnerability from cvelistv5 – Published: 2024-06-10 20:56 – Updated: 2026-04-02 18:20

Summary

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execution.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Processing web content may lead to arbitrary code execution

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/120896
https://support.apple.com/en-us/120898
https://support.apple.com/en-us/120901
https://support.apple.com/en-us/120902
https://support.apple.com/en-us/120903
https://support.apple.com/en-us/120905
https://support.apple.com/en-us/120906

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.5 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 16.7.8 (custom) Affected: 0 , < 17.5 (custom)
Apple	macOS	Affected: 0 , < 14.5 (custom)
Apple	tvOS	Affected: 0 , < 17.5 (custom)
Apple	visionOS	Affected: 0 , < 1.2 (custom)
Apple	watchOS	Affected: 0 , < 10.5 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "iphone_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "16.7",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ipad_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "16.7",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mac_os",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "14.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "visionos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "1.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "watchos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "10.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "safari",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tvos",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "17.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27820",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-14T03:56:09.764Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:18:17.501Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214101"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214100"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214106"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214108"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214104"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214103"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214102"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jun/5"
          },
          {
            "url": "https://support.apple.com/kb/HT214108"
          },
          {
            "url": "https://support.apple.com/kb/HT214106"
          },
          {
            "url": "https://support.apple.com/kb/HT214104"
          },
          {
            "url": "https://support.apple.com/kb/HT214102"
          },
          {
            "url": "https://support.apple.com/kb/HT214100"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing web content may lead to arbitrary code execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:20:39.123Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120896"
        },
        {
          "url": "https://support.apple.com/en-us/120898"
        },
        {
          "url": "https://support.apple.com/en-us/120901"
        },
        {
          "url": "https://support.apple.com/en-us/120902"
        },
        {
          "url": "https://support.apple.com/en-us/120903"
        },
        {
          "url": "https://support.apple.com/en-us/120905"
        },
        {
          "url": "https://support.apple.com/en-us/120906"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-27820",
    "datePublished": "2024-06-10T20:56:43.282Z",
    "dateReserved": "2024-02-26T15:32:28.523Z",
    "dateUpdated": "2026-04-02T18:20:39.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-4558 (GCVE-0-2024-4558)

Vulnerability from cvelistv5 – Published: 2024-05-07 19:02 – Updated: 2025-11-04 17:26

Summary

Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Use after free

Assigner

Chrome

References

10 references

URL	Tags
https://chromereleases.googleblog.com/2024/05/sta…
https://issues.chromium.org/issues/337766133
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
http://seclists.org/fulldisclosure/2024/Jul/16
http://seclists.org/fulldisclosure/2024/Jul/15
http://seclists.org/fulldisclosure/2024/Jul/18

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 124.0.6367.155 , < 124.0.6367.155 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "chrome",
            "vendor": "google",
            "versions": [
              {
                "lessThan": "124.0.6367.155",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-4558",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-09T04:00:46.590652Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:56:02.234Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:26:57.915Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_7.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://issues.chromium.org/issues/337766133"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAWEKDQTHPN7NFEMLIWP7YMIZ2DHF36N/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BWFSZNNWSQYDRYKNLBDGEXXKMBXDYQ3F/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html"
          },
          {
            "url": "https://support.apple.com/kb/HT214121"
          },
          {
            "url": "https://support.apple.com/kb/HT214119"
          },
          {
            "url": "https://support.apple.com/kb/HT214117"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "124.0.6367.155",
              "status": "affected",
              "version": "124.0.6367.155",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use after free",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-30T00:06:13.867Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_7.html"
        },
        {
          "url": "https://issues.chromium.org/issues/337766133"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAWEKDQTHPN7NFEMLIWP7YMIZ2DHF36N/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BWFSZNNWSQYDRYKNLBDGEXXKMBXDYQ3F/"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/16"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/15"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2024-4558",
    "datePublished": "2024-05-07T19:02:22.673Z",
    "dateReserved": "2024-05-06T18:32:23.603Z",
    "dateUpdated": "2025-11-04T17:26:57.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-40789 (GCVE-0-2024-40789)

Vulnerability from cvelistv5 – Published: 2024-07-29 22:16 – Updated: 2026-04-02 18:19

Summary

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

Processing maliciously crafted web content may lead to an unexpected process crash

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/120908
https://support.apple.com/en-us/120909
https://support.apple.com/en-us/120911
https://support.apple.com/en-us/120913
https://support.apple.com/en-us/120914
https://support.apple.com/en-us/120915
https://support.apple.com/en-us/120916

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.6 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 16.7.9 (custom) Affected: 0 , < 17.6 (custom)
Apple	macOS	Affected: 0 , < 14.6 (custom)
Apple	tvOS	Affected: 0 , < 17.6 (custom)
Apple	visionOS	Affected: 0 , < 1.3 (custom)
Apple	watchOS	Affected: 0 , < 10.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-40789",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-30T19:47:22.230489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T13:47:44.512Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:23:56.113Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214121"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214117"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214116"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214124"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214119"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214123"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214122"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214121"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/21"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/22"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html"
          },
          {
            "url": "https://support.apple.com/kb/HT214124"
          },
          {
            "url": "https://support.apple.com/kb/HT214122"
          },
          {
            "url": "https://support.apple.com/kb/HT214119"
          },
          {
            "url": "https://support.apple.com/kb/HT214117"
          },
          {
            "url": "https://support.apple.com/kb/HT214116"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:19:31.652Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120908"
        },
        {
          "url": "https://support.apple.com/en-us/120909"
        },
        {
          "url": "https://support.apple.com/en-us/120911"
        },
        {
          "url": "https://support.apple.com/en-us/120913"
        },
        {
          "url": "https://support.apple.com/en-us/120914"
        },
        {
          "url": "https://support.apple.com/en-us/120915"
        },
        {
          "url": "https://support.apple.com/en-us/120916"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-40789",
    "datePublished": "2024-07-29T22:16:57.905Z",
    "dateReserved": "2024-07-10T17:11:04.689Z",
    "dateUpdated": "2026-04-02T18:19:31.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-40397 (GCVE-0-2023-40397)

Vulnerability from cvelistv5 – Published: 2023-09-06 20:48 – Updated: 2025-02-13 17:07

Summary

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code execution.

Severity ?

No CVSS data available.

CWE

A remote attacker may be able to cause arbitrary javascript code execution

Assigner

apple

References

3 references

URL	Tags
https://support.apple.com/en-us/HT213843
http://www.openwall.com/lists/oss-security/2023/09/11/1
https://security.gentoo.org/glsa/202401-04

Impacted products

1 product

Vendor	Product	Version
Apple	macOS	Affected: unspecified , < 13.5 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T18:31:53.770Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213843"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/09/11/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-04"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "13.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A remote attacker may be able to cause arbitrary javascript code execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-05T14:06:45.711Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT213843"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/09/11/1"
        },
        {
          "url": "https://security.gentoo.org/glsa/202401-04"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2023-40397",
    "datePublished": "2023-09-06T20:48:06.383Z",
    "dateReserved": "2023-08-14T20:26:36.254Z",
    "dateUpdated": "2025-02-13T17:07:51.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-40776 (GCVE-0-2024-40776)

Vulnerability from cvelistv5 – Published: 2024-07-29 22:17 – Updated: 2026-04-02 18:22

Summary

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

Processing maliciously crafted web content may lead to an unexpected process crash

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/120908
https://support.apple.com/en-us/120909
https://support.apple.com/en-us/120911
https://support.apple.com/en-us/120913
https://support.apple.com/en-us/120914
https://support.apple.com/en-us/120915
https://support.apple.com/en-us/120916

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.6 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 16.7.9 (custom) Affected: 0 , < 17.6 (custom)
Apple	macOS	Affected: 0 , < 14.6 (custom)
Apple	tvOS	Affected: 0 , < 17.6 (custom)
Apple	visionOS	Affected: 0 , < 1.3 (custom)
Apple	watchOS	Affected: 0 , < 10.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-40776",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-30T13:33:50.803494Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-27T01:01:21.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:22:27.858Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214121"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214117"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214116"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214124"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214119"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214123"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214122"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/21"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/22"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html"
          },
          {
            "url": "https://support.apple.com/kb/HT214124"
          },
          {
            "url": "https://support.apple.com/kb/HT214123"
          },
          {
            "url": "https://support.apple.com/kb/HT214122"
          },
          {
            "url": "https://support.apple.com/kb/HT214119"
          },
          {
            "url": "https://support.apple.com/kb/HT214117"
          },
          {
            "url": "https://support.apple.com/kb/HT214116"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:22:43.154Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120908"
        },
        {
          "url": "https://support.apple.com/en-us/120909"
        },
        {
          "url": "https://support.apple.com/en-us/120911"
        },
        {
          "url": "https://support.apple.com/en-us/120913"
        },
        {
          "url": "https://support.apple.com/en-us/120914"
        },
        {
          "url": "https://support.apple.com/en-us/120915"
        },
        {
          "url": "https://support.apple.com/en-us/120916"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-40776",
    "datePublished": "2024-07-29T22:17:08.706Z",
    "dateReserved": "2024-07-10T17:11:04.687Z",
    "dateUpdated": "2026-04-02T18:22:43.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-40779 (GCVE-0-2024-40779)

Vulnerability from cvelistv5 – Published: 2024-07-29 22:16 – Updated: 2026-04-02 18:09

Summary

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

Processing maliciously crafted web content may lead to an unexpected process crash

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/120908
https://support.apple.com/en-us/120909
https://support.apple.com/en-us/120911
https://support.apple.com/en-us/120913
https://support.apple.com/en-us/120914
https://support.apple.com/en-us/120915
https://support.apple.com/en-us/120916

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.6 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 16.7.9 (custom) Affected: 0 , < 17.6 (custom)
Apple	macOS	Affected: 0 , < 14.6 (custom)
Apple	tvOS	Affected: 0 , < 17.6 (custom)
Apple	visionOS	Affected: 0 , < 1.3 (custom)
Apple	watchOS	Affected: 0 , < 10.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-40779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-30T18:33:34.012449Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T16:26:31.483Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:22:47.026Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214121"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214117"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214116"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214124"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214119"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214123"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214122"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/21"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/22"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html"
          },
          {
            "url": "https://support.apple.com/kb/HT214124"
          },
          {
            "url": "https://support.apple.com/kb/HT214123"
          },
          {
            "url": "https://support.apple.com/kb/HT214122"
          },
          {
            "url": "https://support.apple.com/kb/HT214119"
          },
          {
            "url": "https://support.apple.com/kb/HT214117"
          },
          {
            "url": "https://support.apple.com/kb/HT214116"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:09:37.173Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120908"
        },
        {
          "url": "https://support.apple.com/en-us/120909"
        },
        {
          "url": "https://support.apple.com/en-us/120911"
        },
        {
          "url": "https://support.apple.com/en-us/120913"
        },
        {
          "url": "https://support.apple.com/en-us/120914"
        },
        {
          "url": "https://support.apple.com/en-us/120915"
        },
        {
          "url": "https://support.apple.com/en-us/120916"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-40779",
    "datePublished": "2024-07-29T22:16:33.641Z",
    "dateReserved": "2024-07-10T17:11:04.688Z",
    "dateUpdated": "2026-04-02T18:09:37.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-42852 (GCVE-0-2023-42852)

Vulnerability from cvelistv5 – Published: 2023-10-25 18:32 – Updated: 2025-05-05 14:59

Summary

A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1. Processing web content may lead to arbitrary code execution.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Processing web content may lead to arbitrary code execution

Assigner

apple

References

19 references

URL	Tags
https://support.apple.com/en-us/HT213981
https://support.apple.com/en-us/HT213986
https://support.apple.com/en-us/HT213987
https://support.apple.com/en-us/HT213984
https://support.apple.com/en-us/HT213988
https://support.apple.com/en-us/HT213982
https://support.apple.com/kb/HT213984
http://seclists.org/fulldisclosure/2023/Oct/23
http://seclists.org/fulldisclosure/2023/Oct/22
http://seclists.org/fulldisclosure/2023/Oct/19
http://seclists.org/fulldisclosure/2023/Oct/27
http://seclists.org/fulldisclosure/2023/Oct/24
http://seclists.org/fulldisclosure/2023/Oct/25
https://lists.fedoraproject.org/archives/list/pac…
http://www.openwall.com/lists/oss-security/2023/11/15/1
https://www.debian.org/security/2023/dsa-5557
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://security.gentoo.org/glsa/202401-33

Impacted products

6 products

Vendor	Product	Version
Apple	iOS and iPadOS	Affected: unspecified , < 16.7 (custom)
Apple	Safari	Affected: unspecified , < 17.1 (custom)
Apple	tvOS	Affected: unspecified , < 17.1 (custom)
Apple	macOS	Affected: unspecified , < 14.1 (custom)
Apple	watchOS	Affected: unspecified , < 10.1 (custom)
Apple	iOS and iPadOS	Affected: unspecified , < 17.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:30:24.683Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213981"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213986"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213987"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213984"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213988"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213982"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT213984"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/22"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/19"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/27"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/24"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/25"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTCZGQPRDAOPP6NK4CIDJKIPMBWD5J7K/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/11/15/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5557"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RPPMOWFYZODONTA3RLZOKSGNR4DELGG2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S3O7ITSBZDHLBM5OG22K6RZAHRRTGECM/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-33"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-42852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:26:16.235454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T14:59:22.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1. Processing web content may lead to arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing web content may lead to arbitrary code execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-31T15:06:24.329Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT213981"
        },
        {
          "url": "https://support.apple.com/en-us/HT213986"
        },
        {
          "url": "https://support.apple.com/en-us/HT213987"
        },
        {
          "url": "https://support.apple.com/en-us/HT213984"
        },
        {
          "url": "https://support.apple.com/en-us/HT213988"
        },
        {
          "url": "https://support.apple.com/en-us/HT213982"
        },
        {
          "url": "https://support.apple.com/kb/HT213984"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/23"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/22"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/19"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/27"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/24"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/25"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTCZGQPRDAOPP6NK4CIDJKIPMBWD5J7K/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/11/15/1"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5557"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RPPMOWFYZODONTA3RLZOKSGNR4DELGG2/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S3O7ITSBZDHLBM5OG22K6RZAHRRTGECM/"
        },
        {
          "url": "https://security.gentoo.org/glsa/202401-33"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2023-42852",
    "datePublished": "2023-10-25T18:32:18.866Z",
    "dateReserved": "2023-09-14T19:05:11.450Z",
    "dateUpdated": "2025-05-05T14:59:22.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-32885 (GCVE-0-2022-32885)

Vulnerability from cvelistv5 – Published: 2023-05-08 00:00 – Updated: 2025-01-29 16:20

Summary

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Processing maliciously crafted web content may lead to arbitrary code execution

Assigner

apple

References

3 references

URL	Tags
https://support.apple.com/en-us/HT213345
https://support.apple.com/en-us/HT213346
https://support.apple.com/en-us/HT213341

Impacted products

3 products

Vendor	Product	Version
Apple	macOS	Affected: unspecified , < 12.5 (custom)
Apple	macOS	Affected: unspecified , < 15.6 (custom)
Apple	macOS	Affected: unspecified , < 15.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:54:03.009Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213345"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213346"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213341"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-32885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T16:20:34.535358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-29T16:20:44.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "12.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to arbitrary code execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-27T00:00:00.000Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT213345"
        },
        {
          "url": "https://support.apple.com/en-us/HT213346"
        },
        {
          "url": "https://support.apple.com/en-us/HT213341"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2022-32885",
    "datePublished": "2023-05-08T00:00:00.000Z",
    "dateReserved": "2022-06-09T00:00:00.000Z",
    "dateUpdated": "2025-01-29T16:20:44.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-40780 (GCVE-0-2024-40780)

Vulnerability from cvelistv5 – Published: 2024-07-29 22:16 – Updated: 2026-04-02 18:10

Summary

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

Processing maliciously crafted web content may lead to an unexpected process crash

Assigner

apple

References

7 references

URL	Tags
https://support.apple.com/en-us/120908
https://support.apple.com/en-us/120909
https://support.apple.com/en-us/120911
https://support.apple.com/en-us/120913
https://support.apple.com/en-us/120914
https://support.apple.com/en-us/120915
https://support.apple.com/en-us/120916

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.6 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 16.7.9 (custom) Affected: 0 , < 17.6 (custom)
Apple	macOS	Affected: 0 , < 14.6 (custom)
Apple	tvOS	Affected: 0 , < 17.6 (custom)
Apple	visionOS	Affected: 0 , < 1.3 (custom)
Apple	watchOS	Affected: 0 , < 10.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-40780",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-29T23:51:19.473237Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-27T01:06:18.828Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:22:55.216Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214121"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214117"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214116"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214124"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214119"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214123"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214122"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/21"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/17"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/22"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/18"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00006.html"
          },
          {
            "url": "https://support.apple.com/kb/HT214124"
          },
          {
            "url": "https://support.apple.com/kb/HT214123"
          },
          {
            "url": "https://support.apple.com/kb/HT214122"
          },
          {
            "url": "https://support.apple.com/kb/HT214119"
          },
          {
            "url": "https://support.apple.com/kb/HT214117"
          },
          {
            "url": "https://support.apple.com/kb/HT214116"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:10:19.614Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120908"
        },
        {
          "url": "https://support.apple.com/en-us/120909"
        },
        {
          "url": "https://support.apple.com/en-us/120911"
        },
        {
          "url": "https://support.apple.com/en-us/120913"
        },
        {
          "url": "https://support.apple.com/en-us/120914"
        },
        {
          "url": "https://support.apple.com/en-us/120915"
        },
        {
          "url": "https://support.apple.com/en-us/120916"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-40780",
    "datePublished": "2024-07-29T22:16:37.836Z",
    "dateReserved": "2024-07-10T17:11:04.688Z",
    "dateUpdated": "2026-04-02T18:10:19.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-42917 (GCVE-0-2023-42917)

Vulnerability from cvelistv5 – Published: 2023-11-30 22:18 – Updated: 2025-10-21 23:05

Summary

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Assigner

apple

References

18 references

URL	Tags
https://support.apple.com/en-us/HT214033
https://support.apple.com/en-us/HT214032
https://support.apple.com/en-us/HT214031
https://support.apple.com/kb/HT214033
http://www.openwall.com/lists/oss-security/2023/12/05/1
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://support.apple.com/kb/HT214034
https://www.debian.org/security/2023/dsa-5575
http://seclists.org/fulldisclosure/2023/Dec/3
http://seclists.org/fulldisclosure/2023/Dec/4
http://seclists.org/fulldisclosure/2023/Dec/5
http://seclists.org/fulldisclosure/2023/Dec/8
http://seclists.org/fulldisclosure/2023/Dec/13
http://seclists.org/fulldisclosure/2023/Dec/12
https://security.gentoo.org/glsa/202401-04
https://support.apple.com/kb/HT214062
http://seclists.org/fulldisclosure/2024/Jan/35

Impacted products

3 products

Vendor	Product	Version
Apple	Safari	Affected: unspecified , < 17.1 (custom)
Apple	macOS	Affected: unspecified , < 14.1 (custom)
Apple	iOS and iPadOS	Affected: unspecified , < 17.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:30:24.968Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214033"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214032"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214031"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214033"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/12/05/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214034"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5575"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Dec/3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Dec/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Dec/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Dec/8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Dec/13"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Dec/12"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-04"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT214062"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jan/35"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-42917",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-12-02T05:00:19.060611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-12-04",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:31.441Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-12-04T00:00:00.000Z",
            "value": "CVE-2023-42917 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-12T09:05:54.874Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT214033"
        },
        {
          "url": "https://support.apple.com/en-us/HT214032"
        },
        {
          "url": "https://support.apple.com/en-us/HT214031"
        },
        {
          "url": "https://support.apple.com/kb/HT214033"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/12/05/1"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/"
        },
        {
          "url": "https://support.apple.com/kb/HT214034"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5575"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/3"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/4"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/5"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/8"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/13"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Dec/12"
        },
        {
          "url": "https://security.gentoo.org/glsa/202401-04"
        },
        {
          "url": "https://support.apple.com/kb/HT214062"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jan/35"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2023-42917",
    "datePublished": "2023-11-30T22:18:50.340Z",
    "dateReserved": "2023-09-14T19:05:11.463Z",
    "dateUpdated": "2025-10-21T23:05:31.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2024-3286

CVE-2024-40782 (GCVE-0-2024-40782)

CVE-2024-27851 (GCVE-0-2024-27851)

CVE-2024-27820 (GCVE-0-2024-27820)

CVE-2024-4558 (GCVE-0-2024-4558)

CVE-2024-40789 (GCVE-0-2024-40789)

CVE-2023-40397 (GCVE-0-2023-40397)

CVE-2024-40776 (GCVE-0-2024-40776)

CVE-2024-40779 (GCVE-0-2024-40779)

CVE-2023-42852 (GCVE-0-2023-42852)

CVE-2022-32885 (GCVE-0-2022-32885)

CVE-2024-40780 (GCVE-0-2024-40780)

CVE-2023-42917 (GCVE-0-2023-42917)

Tags

Sightings

Nomenclature