Latest high severity vulnerabilities for "apple iphone os" 17.0

Where

AND

Sort:

Apple macOS SonomaInput Validation, Buffer Overflow

Risk 53

Severity

7.1

Input Validation, Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Accounts. The issue was addressed with improved checks.

1 / 11

Source: Apple

First published (updated )

CVE-2024-40799

Apple macOS SonomaInput Validation, Integer Overflow, Race Condition, Buffer Overflow

Risk 71

Severity

7.8

Input Validation, Integer Overflow, Race Condition, Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Accounts. The issue was addressed with improved checks.

1 / 21

Source: Apple

First published (updated )

CVE-2024-40784

Apple macOS SonomaInput Validation, Race Condition, Integer Overflow, Buffer Overflow, Infoleak

Risk 45

Severity

7.5

Input Validation, Race Condition, Integer Overflow, Buffer Overflow, Infoleak

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. A shortcut may be able to use sensitive data with certain actions without prompting the user.

1 / 45

Source: MITRE

First published (updated )

CVE-2024-40836

Apple macOS SonomaInput Validation, Race Condition, Integer Overflow, Buffer Overflow

Risk 72

Severity

7.8

Input Validation, Race Condition, Integer Overflow, Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, visionOS 1.3, watchOS 10.6. A shortcut may be able to bypass Internet permission requirements.

1 / 53

Source: MITRE

First published (updated )

CVE-2024-40809

Apple macOS SonomaInput Validation, Race Condition, Integer Overflow, Buffer Overflow

Risk 72

Severity

7.8

Input Validation, Race Condition, Integer Overflow, Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

1 / 53

Source: MITRE

First published (updated )

CVE-2024-40812

Apple WatchOSInput Validation, Race Condition, Integer Overflow, Use After Free

Risk 45

Severity

7.5

Input Validation, Race Condition, Integer Overflow, Use After Free

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AirDrop. This issue was addressed through improved state management.

1 / 43

Source: Apple

First published (updated )

CVE-2024-40829

Apple tvOSInput Validation

Risk 62

Severity

7.5

Input Validation

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Apple Neural Engine. The issue was addressed with improved memory handling.

1 / 21

Source: Apple

First published (updated )

CVE-2024-27840

Apple macOS SonomaInput Validation, Race Condition

Risk 53

Severity

7.1

Input Validation, Race Condition

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Apple Neural Engine. The issue was addressed with improved memory handling.

1 / 35

Source: Apple

First published (updated )

CVE-2024-27800

Apple macOS SonomaInput Validation, Race Condition, Integer Overflow, Buffer Overflow

Risk 82

Severity

8.8

Input Validation, Race Condition, Integer Overflow, Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Apple Neural Engine. The issue was addressed with improved memory handling.

1 / 67

Source: Apple

First published (updated )

CVE-2024-27820

Apple tvOSCode Injection, Input Validation, Race Condition

Risk 73

Severity

7.8

Code Injection, Input Validation, Race Condition

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Apple Neural Engine. The issue was addressed with improved memory handling.

1 / 59

Source: Apple

First published (updated )

CVE-2024-27856

Apple tvOSAppleVA. The issue was addressed with improved memory handling.

Risk 74

Severity

8.4

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apple Neural Engine. The issue was addressed with improved memory handling.

1 / 9

Source: Apple

First published (updated )

CVE-2024-40771

Apple Multiple ProductsApple Multiple Products Memory Corruption Vulnerability

Risk 91

Severity

7.8

Exploited

Zeroday

Buffer Overflow, Input Validation, Race Condition

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

1 / 30

Source: MITRE

First published (updated )

CVE-2024-23225

Apple Multiple ProductsApple Multiple Products Memory Corruption Vulnerability

Risk 91

Severity

7.8

Exploited

Zeroday

Input Validation, Race Condition, Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

1 / 86

Source: MITRE

First published (updated )

CVE-2024-23296

Apple macOS SonomaRace Condition, Infoleak, Buffer Overflow, Input Validation

Risk 78

Severity

8.1

Race Condition, Infoleak, Buffer Overflow, Input Validation

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

A race condition was addressed with additional validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. An app may be able to access user-sensitive data.

1 / 28

Source: MITRE

First published (updated )

CVE-2024-23235

Apple macOS SonomaCode Injection, Buffer Overflow, Race Condition, Input Validation

Risk 74

Severity

8.6

Code Injection, Buffer Overflow, Race Condition, Input Validation

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

1 / 32

Source: Apple

First published (updated )

CVE-2024-23278

Apple macOS SonomaRace Condition, Input Validation, Buffer Overflow

Risk 74

Severity

8.6

Race Condition, Input Validation, Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

1 / 77

Source: Apple

First published (updated )

CVE-2024-23246

ubuntu/webkit2gtkInput Validation, Race Condition, Buffer Overflow

Risk 62

Severity

8.1

Input Validation, Race Condition, Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

1 / 84

Source: Ubuntu

First published (updated )

CVE-2024-23263

Apple macOS SonomaInteger overflow in VideoLAN dav1d

Risk 82

Severity

8.8

Integer Overflow, Input Validation

AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

1 / 3

Source: MITRE

First published (updated )

CVE-2024-1580

debian/webkit2gtkApple Multiple Products WebKit Type Confusion Vulnerability

Risk 83

Severity

8.8

Exploited

Zeroday

EPSS

0.11%

Use After Free

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A type confusion issue was addressed with improved checks. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited.

Reference: https://webkitgtk.org/security/WSA-2024-0001.html

1 / 7

Source: Red Hat

First published (updated )

CVE-2024-23222

Apple iOSCallKit. This issue was addressed with improved checks

Risk 45

Severity

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

1 / 7

Source: Apple

First published (updated )

CVE-2023-42962

Apple iOSUse After Free, Input Validation, Race Condition

Risk 82

Severity

8.8

Use After Free, Input Validation, Race Condition

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

1 / 43

Source: Apple

First published (updated )

CVE-2023-43010

Apple macOS SonomaInput Validation, Use After Free

Risk 70

Severity

7.8

Input Validation, Use After Free

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

1 / 22

Source: Apple

First published (updated )

CVE-2023-42899

debian/webkit2gtkApple Multiple Products WebKit Memory Corruption Vulnerability

Risk 95

Severity

8.8

Exploited

Input Validation

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

1 / 17

Source: Ubuntu

First published (updated )

CVE-2023-42917