Lucene search

AppleCVE-2024-40784

HistoryJul 29, 2024 - 11:15 p.m.

CVE-2024-40784

2024-07-2923:15:11

apple

web.nvd.nist.gov

integer overflow

input validation

security patch

ios 16.7.9

ipados 16.7.9

macos ventura 13.6.8

ios 17.6

ipados 17.6

watchos 10.6

tvos 17.6

visionos 1.3

macos sonoma 14.6

unexpected termination

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.1

Confidence

Low

EPSS

0.001

Percentile

17.6%

JSON

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing a maliciously crafted file may lead to unexpected app termination.

Affected configurations

Vulners

Vulnrichment

Node

iphone_osRange<17.6

ipad_osRange<17.6

iphone_osRange<16.7

ipad_osRange<16.7

macosRange<13.6

watchosRange<10.6

macosRange<14.6

visionosRange<1.3

tvosRange<17.6

VendorProductVersionCPE
*iphone_os*cpe:2.3:apple:*:iphone_os:*:*:*:*:*:*:*:*
*ipad_os*cpe:2.3:apple:*:ipad_os:*:*:*:*:*:*:*:*
*macos*cpe:2.3:apple:*:macos:*:*:*:*:*:*:*:*
*watchos*cpe:2.3:apple:*:watchos:*:*:*:*:*:*:*:*
*visionos*cpe:2.3:apple:*:visionos:*:*:*:*:*:*:*:*
*tvos*cpe:2.3:apple:*:tvos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	iphone_os	*	cpe:2.3:apple::iphone_os::::::::*
*	ipad_os	*	cpe:2.3:apple::ipad_os::::::::*
*	macos	*	cpe:2.3:apple::macos::::::::*
*	watchos	*	cpe:2.3:apple::watchos::::::::*
*	visionos	*	cpe:2.3:apple::visionos::::::::*
*	tvos	*	cpe:2.3:apple::tvos::::::::*

CNA Affected

[
  {
    "vendor": "Apple",
    "product": "iOS and iPadOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "17.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "iOS and iPadOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "16.7",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "macOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "13.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "watchOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "10.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "macOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "14.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "visionOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "1.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "tvOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "17.6",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2024/Jul/16

seclists.org/fulldisclosure/2024/Jul/17

seclists.org/fulldisclosure/2024/Jul/18

seclists.org/fulldisclosure/2024/Jul/19

seclists.org/fulldisclosure/2024/Jul/21

seclists.org/fulldisclosure/2024/Jul/22

seclists.org/fulldisclosure/2024/Jul/23

support.apple.com/en-us/HT214116

support.apple.com/en-us/HT214117

support.apple.com/en-us/HT214119

support.apple.com/en-us/HT214120

support.apple.com/en-us/HT214122

support.apple.com/en-us/HT214123

support.apple.com/en-us/HT214124

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.1

Confidence

Low

EPSS

0.001

Percentile

17.6%

JSON

Related for CVE-2024-40784