Input validation

An out-of-bounds read was addressed with improved input validation. This issue is fixed in visionOS 1.1, macOS Sonoma 14.4. Processing an image may lead to arbitrary code execution...

Code injection

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. Processing a file may lead to unexpected app termination or arbitrary code execution...

Sql injection

In the module "Make an offer" makeanoffer = 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::checkUserExistingOffer and MakeOffers::addUserOffer...

Design/Logic Flaw

A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges...

Design/Logic Flaw

This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permissions granted to this app may be used by a malicious app...

Code injection

A permissions issue was addressed to help ensure Personas are always protected This issue is fixed in visionOS 1.1. An unauthenticated user may be able to use an unprotected Persona...

Design/Logic Flaw

This issue was addressed with improved file handling. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to access sensitive user data...

Input validation

A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being...

Design/Logic Flaw

A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to modify protected parts of the file system...

CVE-2024-23259

CVE-2024-23259 affects Apple systems (notably macOS Sonoma 14.4, Safari/WebKit components) where processing web content may lead to a denial-of-service. Apple’s advisory indicates fixes in macOS Sonoma 14.4 and various iOS/iPadOS versions (iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, iPadOS 17.4). The NV...

CVE-2024-23275

CVE-2024-23275 is a race-condition vulnerability affecting macOS components. The available documents identify the issue as a race condition addressed by additional validation, with fixes in macOS Sonoma 14.4, macOS Monterey 12.7.4, and macOS Ventura 13.6.5. The vulnerability is described as allow...

CVE-2024-23297

CVE-2024-23297 affects Apple’s tvOS, iOS, iPadOS and watchOS prior to updates; root cause described as improved checks, with the issue fixed in tvOS 17.4, iOS 17.4, iPadOS 17.4 and watchOS 10.4. The vulnerability could allow a malicious application to access private information. Connected sources...

CVE-2024-23242

CVE-2024-23242 describes a privacy issue where content in text fields was logged, allowing an app to view Mail data. The NCIS of this flaw is not logging such information and affects Apple platforms: the vulnerability is fixed in macOS Sonoma 14.4 and in iOS/iPadOS 17.4. The root cause is not det...

CVE-2024-23254

CVE-2024-23254 concerns WebKit/WebKitGTK components where a malicious website could exfiltrate audio data cross-origin. The initial entry notes the issue is fixed in Apple platforms: tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4, iPadOS 17.4, watchOS 10.4, and Safari 17.4. Public disclosur...

CVE-2024-23235

CVE-2024-23235 is a kernel race condition addressed by Apple with additional validation. It is fixed in macOS Sonoma 14.4, visionOS 1.1, iOS 17.4/iPadOS 17.4, watchOS 10.4, and iOS 16.7.6/iPadOS 16.7.6 and tvOS 17.4. The affected impact is that an app may be able to access user-sensitive data. Th...

CVE-2024-23258

CVE-2024-23258 is associated with Apple’s ImageIO in visionOS 1.1 and macOS Sonoma 14.4. The issue is described as an out-of-bounds read that occurs during image processing and may lead to arbitrary code execution. The root cause is stated as insufficient input validation, and Apple’s fixes are i...

CVE-2024-23286

CVE-2024-23286 concerns a buffer overflow fix tied to memory handling in Apple platforms. Affected components/versions (as stated): macOS Monterey 12.7.4; macOS Ventura 13.6.5; macOS Sonoma 14.4; visionOS 1.1; iOS 17.4 and iPadOS 17.4; watchOS 10.4; iOS 16.7.6 and iPadOS 16.7.6; tvOS 17.4. Underl...

CVE-2024-23269

CVE-2024-23269 describes a downgrade issue on Intel-based Mac computers that could allow an app to modify protected parts of the file system. Apple addressed this by adding code-signing restrictions, and the vulnerability is stated as fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, and macOS V...

CVE-2024-23272

CVE-2024-23272 involves a logic issue fixed by improved checks. Affected macOS versions include Sonoma 14.4, Monterey 12.7.4, and Ventura 13.6.5. The issue could allow a user to gain access to protected parts of the file system. Remediation per sources is upgrading to the listed fixed versions. I...

CVE-2024-23248

The CVE-2024-23248 issue affects ColorSync in macOS Sonoma prior to 14.4, where processing a file could lead to a denial of service or memory disclosure. Connected sources confirm the mitigation is in macOS Sonoma 14.4 with an improved memory handling fix. The vulnerability arises from how files ...