Recently modified high severity vulnerabilities for "apple macos monterey"

Where

AND

Sort:

Apple macOS Big SurUse After Free in vim/vim

Risk 71

Severity

7.8

Use After Free, Input Validation, Race Condition, Buffer Overflow, SQL Injection

AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

1 / 90

Source: Apple

First published (updated )

CVE-2022-2042

Apple macOS Big SurHeap-based Buffer Overflow in vim/vim

Risk 71

Severity

7.8

Buffer Overflow, Input Validation, Use After Free

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

apache. Multiple issues were addressed by updating apache to version 2.4.53.

1 / 38

Source: Apple

First published (updated )

CVE-2021-4136

Apple macOS Big SurBuffer Over-read in vim/vim

Risk 71

Severity

7.8

Input Validation, Race Condition, Use After Free, Buffer Overflow, SQL Injection

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

1 / 90

Source: Apple

First published (updated )

CVE-2022-2124

Apple macOS Big SurHeap-based Buffer Overflow in vim/vim

Risk 71

Severity

7.8

Buffer Overflow, Race Condition, Input Validation, SQL Injection, Use After Free

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

1 / 90

Source: Apple

First published (updated )

CVE-2022-2125

Apple macOS Big SurOut-of-bounds Read in vim/vim

Risk 71

Severity

7.8

Input Validation, Race Condition, Use After Free, Buffer Overflow, SQL Injection

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

1 / 90

Source: Apple

First published (updated )

CVE-2022-2126

Apple macOS MontereyAccess of Memory Location Before Start of Buffer in vim/vim

Risk 77

Severity

7.8

Input Validation, Race Condition, Use After Free, Buffer Overflow, SQL Injection

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

1 / 90

Source: Apple

First published (updated )

CVE-2022-0351

Apple macOS Big SurOut-of-bounds Read in vim/vim

Risk 53

Severity

7.1

Input Validation, Use After Free

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

apache. Multiple issues were addressed by updating apache to version 2.4.53.

1 / 39

Source: Apple

First published (updated )

CVE-2021-4166

Apple macOS Big SurBuffer Overflow, Input Validation, Use After Free, Race Condition

Risk 79

Severity

8.8

Buffer Overflow, Input Validation, Use After Free, Race Condition

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accelerate Framework. A memory consumption issue was addressed with improved memory handling.

1 / 62

Source: Apple

First published (updated )

CVE-2021-39537

Apple macOS Big SurHeap-based Buffer Overflow in vim/vim

Risk 70

Severity

7.8

Buffer Overflow, Use After Free, Input Validation, Integer Overflow, Race Condition

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AMD. A buffer overflow issue was addressed with improved memory handling.

1 / 65

Source: Apple

First published (updated )

CVE-2023-0433

Microsoft Azure Arc Resource BridgeOpenSSH regreSSHion Attack (CVE-2024-6387)

Risk 92

Severity

8.1

Exploited

EPSS

71.47%

Race Condition, Input Validation, Integer Overflow, Buffer Overflow

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

1 / 36

Source: MITRE

First published (updated )

CVE-2024-6387

redhat/jbcs-httpd24-apr-utilVulnerability in OpenSSL library

Risk 47

Severity

7.5

Input Validation, Use After Free, Buffer Overflow, Integer Overflow, Race Condition

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in OpenSSL. It is possible to trigger an infinite loop by crafting a certificate that has invalid elliptic curve parameters. Since certificate parsing happens before verification of the certificate signature, any process that parses an externally supplied certificate may be subject to a denial of service attack.

1 / 48

First published (updated )

CVE-2022-0778

redhat/zlibBuffer Overflow, Input Validation, Use After Free, Integer Overflow, Race Condition

Risk 57

Severity

8.2

Buffer Overflow, Input Validation, Use After Free, Integer Overflow, Race Condition

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

AMD. A buffer overflow issue was addressed with improved memory handling.

1 / 73

Source: Apple

First published (updated )

CVE-2018-25032

debian/curlHTTP/2 push headers memory-leak

Risk 47

Severity

8.6

EPSS

0.04%

Input Validation, Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Accounts. The issue was addressed with improved checks.

1 / 17

Source: Apple

First published (updated )

CVE-2024-2398

redhat/httpdmod_lua Use of uninitialized value of in r:parsebody

Risk 45

Severity

7.5

Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

1 / 6

First published (updated )

CVE-2022-22719

redhat/libxml2Integer Overflow, Input Validation, Race Condition, Double Free

Risk 45

Severity

7.5

Integer Overflow, Input Validation, Race Condition, Double Free

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation.

1 / 20

First published (updated )

CVE-2022-40303

redhat/libxml2Double Free, Input Validation, Race Condition, Integer Overflow

Risk 71

Severity

7.8

Double Free, Input Validation, Race Condition, Integer Overflow

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free.

1 / 21

First published (updated )

CVE-2022-40304

redhat/jbcs-httpd24-apr-utilUse After Free, Input Validation, Buffer Overflow, Integer Overflow, Race Condition

Risk 78

Severity

8.1

Use After Free, Input Validation, Buffer Overflow, Integer Overflow, Race Condition

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in libxml2. A call to the xmlGetID function can return a pointer already freed when parsing an XML document with the XMLPARSEDTDVALID option and without the XMLPARSENOENT option, resulting in a use-after-free issue.

1 / 43

First published (updated )

CVE-2022-23308

Apple macOS MontereyWebRTC Heap Buffer Overflow Vulnerability

Risk 95

Severity

8.8

Exploited

Input Validation, Integer Overflow, Null Pointer Dereference, Buffer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AMD. A memory corruption issue was addressed with improved input validation.

1 / 62

Source: Apple

First published (updated )

CVE-2022-2294

Apple macOS Big SurRace Condition, Buffer Overflow, Use After Free, Input Validation, Integer Overflow

Risk 74

Severity

7.8

Race Condition, Buffer Overflow, Use After Free, Input Validation, Integer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Accounts. A privacy issue was addressed with improved private data redaction for log entries.

1 / 33

Source: Apple

First published (updated )

CVE-2023-29491

Apple macOS Big SurInteger Overflow or Wraparound in vim/vim

Risk 71

Severity

7.8

Integer Overflow, Race Condition, Buffer Overflow, Use After Free, Input Validation

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accounts. A privacy issue was addressed with improved private data redaction for log entries.

1 / 47

Source: Apple

First published (updated )

CVE-2023-2610

Apple Multiple ProductsApple Multiple Products Memory Corruption Vulnerability

Risk 91

Severity

7.8

Exploited

Zeroday

Input Validation, Race Condition, Buffer Overflow

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

1 / 86

Source: MITRE

First published (updated )

CVE-2024-23296

Apple Multiple ProductsApple Multiple Products Memory Corruption Vulnerability

Risk 91

Severity

7.8

Exploited

Zeroday

Buffer Overflow, Input Validation, Race Condition

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

1 / 30

Source: MITRE

First published (updated )

CVE-2024-23225

debian/webkit2gtkApple Multiple Products WebKit Type Confusion Vulnerability

Risk 83

Severity

8.8

Exploited

Zeroday

EPSS

0.11%

Use After Free

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A type confusion issue was addressed with improved checks. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited.

Reference: https://webkitgtk.org/security/WSA-2024-0001.html

1 / 7

Source: Red Hat

First published (updated )

CVE-2024-23222