BIT-java-min-2024-54534: Critical severity Apple WatchOS vulnerability

Q: Which platform releases include the fix?

The issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2, and iPadOS 18.2.

Q: What does an attacker need to exploit this issue?

An attacker needs to cause processing of maliciously crafted web content. The supplied vector indicates network reachability, low attack complexity, and no required privileges or user interaction.

Q: What should teams do to remediate the issue?

Update affected Apple operating systems and Safari to the listed fixed releases or later available security updates.

Published Dec 12, 2024

Updated

The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption.

Affected Software

7 affected components

Apple WatchOS<11.2

Apple visionOS<2.2

Apple tvOS<18.2

Apple macOS Sequoia<15.2

Apple Safari<18.2

Apple iOS<18.2

Apple iPadOS<18.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade watchOS to a version that resolves this vulnerability.
Fixed in 11.2
Upgrade
Upgrade visionOS to a version that resolves this vulnerability.
Fixed in 2.2
Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 18.2
Upgrade
Upgrade macOS Sequoia to a version that resolves this vulnerability.
Fixed in 15.2
Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 18.2
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 18.2
Upgrade
Upgrade iPadOS to a version that resolves this vulnerability.
Fixed in 18.2

Event History

Dec 12, 2024

CVE Published

via OSV·02:15 AM

Data Sourced

via OSV·02:15 AM

DescriptionSeverity

Frequently Asked Questions

Which platform releases include the fix?

The issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2, and iPadOS 18.2.

What does an attacker need to exploit this issue?

An attacker needs to cause processing of maliciously crafted web content. The supplied vector indicates network reachability, low attack complexity, and no required privileges or user interaction.

What should teams do to remediate the issue?

Update affected Apple operating systems and Safari to the listed fixed releases or later available security updates.

BIT-java-min-2024-54534: Critical severity Apple WatchOS vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which platform releases include the fix?

What does an attacker need to exploit this issue?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which platform releases include the fix?

What does an attacker need to exploit this issue?

What should teams do to remediate the issue?