About the security content of Safari 17.5

This document describes the security content of Safari 17.5.

About Apple security updates

For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

Safari 17.5

Safari

Available for: macOS Monterey and macOS Ventura

Impact: A website’s permission dialog may persist after navigation away from the site

Description: The issue was addressed with improved checks.

CVE-2024-27844: Narendra Bhati of Suma Soft Pvt. Ltd in Pune (India), Shaheen Fazim

Entry added June 10, 2024

WebKit

Available for: macOS Monterey and macOS Ventura

Impact: An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication

Description: The issue was addressed with improved checks.

WebKit Bugzilla: 272750

CVE-2024-27834: Manfred Paul (@_manfp) working with Trend Micro’s Zero Day Initiative

WebKit

Available for: macOS Monterey and macOS Ventura

Impact: A maliciously crafted webpage may be able to fingerprint the user

Description: The issue was addressed by adding additional logic.

WebKit Bugzilla: 262337

CVE-2024-27838: Emilio Cobos of Mozilla

Entry added June 10, 2024

WebKit

Available for: macOS Monterey and macOS Ventura

Impact: Processing web content may lead to arbitrary code execution

Description: The issue was addressed with improved memory handling.

WebKit Bugzilla: 268221

CVE-2024-27808: Lukas Bernhard of CISPA Helmholtz Center for Information Security

Entry added June 10, 2024

WebKit

Available for: macOS Monterey and macOS Ventura

Impact: A maliciously crafted webpage may be able to fingerprint the user

Description: This issue was addressed with improvements to the noise injection algorithm.

WebKit Bugzilla: 270767

CVE-2024-27850: an anonymous researcher

Entry added June 10, 2024

WebKit

Available for: macOS Monterey and macOS Ventura

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: An integer overflow was addressed with improved input validation.

WebKit Bugzilla: 271491

CVE-2024-27833: Manfred Paul (@_manfp) working with Trend Micro Zero Day Initiative

Entry added June 10, 2024

WebKit

Available for: macOS Monterey and macOS Ventura

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: The issue was addressed with improved bounds checks.

WebKit Bugzilla: 272106

CVE-2024-27851: Nan Wang (@eternalsakura13) of 360 Vulnerability Research Institute

Entry added June 10, 2024

WebKit Canvas

Available for: macOS Monterey and macOS Ventura

Impact: A maliciously crafted webpage may be able to fingerprint the user

Description: This issue was addressed through improved state management.

WebKit Bugzilla: 271159

CVE-2024-27830: Joe Rutkowski (@Joe12387) of Crawless and @abrahamjuliot

Entry added June 10, 2024

WebKit Web Inspector

Available for: macOS Monterey and macOS Ventura

Impact: Processing web content may lead to arbitrary code execution

Description: The issue was addressed with improved memory handling.

WebKit Bugzilla: 270139

CVE-2024-27820: Jeff Johnson of underpassapp.com

Entry added June 10, 2024

Additional recognition

Safari Downloads

We would like to acknowledge Arsenii Kostromin (0x3c3e) for their assistance.