Lucene search

AppleCVE-2024-23300

HistoryMar 12, 2024 - 9:15 p.m.

CVE-2024-23300

2024-03-1221:15:58

CWE-416

apple

web.nvd.nist.gov

cve-2024-23300

use-after-free

garageband

memory management

security

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

Percentile

9.0%

JSON

A use-after-free issue was addressed with improved memory management. This issue is fixed in GarageBand 10.4.11. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

Affected configurations

Vulners

Vulnrichment

Node

applegaragebandRange<10.4

VendorProductVersionCPE
applegarageband*cpe:2.3:a:apple:garageband:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	garageband	*	cpe:2.3:a:apple:garageband::::::::

CNA Affected

[
  {
    "vendor": "Apple",
    "product": "GarageBand",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "10.4",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2024/Mar/27

support.apple.com/en-us/HT214090

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-23300