Refine your search

36 vulnerabilities found for xcode by apple

CVE-2025-43505 (GCVE-0-2025-43505)
Vulnerability from nvd
Published
2025-11-04 01:16
Modified
2025-11-04 13:12
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • Processing a maliciously crafted file may lead to heap corruption
Summary
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-04T13:11:58.914865Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-04T13:12:03.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing a maliciously crafted file may lead to heap corruption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-04T01:16:46.705Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125641"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43505",
    "datePublished": "2025-11-04T01:16:46.705Z",
    "dateReserved": "2025-04-16T15:27:21.193Z",
    "dateUpdated": "2025-11-04T13:12:03.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43504 (GCVE-0-2025-43504)
Vulnerability from nvd
Published
2025-11-04 01:17
Modified
2025-11-04 13:07
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE
  • A user in a privileged network position may be able to cause a denial-of-service
Summary
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 4.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43504",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-04T13:07:16.935477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-04T13:07:19.240Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A user in a privileged network position may be able to cause a denial-of-service",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-04T01:17:21.026Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125641"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43504",
    "datePublished": "2025-11-04T01:17:21.026Z",
    "dateReserved": "2025-04-16T15:27:21.193Z",
    "dateUpdated": "2025-11-04T13:07:19.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43375 (GCVE-0-2025-43375)
Vulnerability from nvd
Published
2025-09-15 22:35
Modified
2025-11-03 18:12
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • Processing an overly large path value may crash a process
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T13:36:48.222793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T17:24:28.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:12:52.650Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing an overly large path value may crash a process",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:35:27.230Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43375",
    "datePublished": "2025-09-15T22:35:27.230Z",
    "dateReserved": "2025-04-16T15:24:37.115Z",
    "dateUpdated": "2025-11-03T18:12:52.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43371 (GCVE-0-2025-43371)
Vulnerability from nvd
Published
2025-09-15 22:34
Modified
2025-11-03 18:12
Severity ?
8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE
  • An app may be able to break out of its sandbox
Summary
This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T13:40:41.659342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T17:26:58.156Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:12:47.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to break out of its sandbox",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:34:35.897Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43371",
    "datePublished": "2025-09-15T22:34:35.897Z",
    "dateReserved": "2025-04-16T15:24:37.114Z",
    "dateUpdated": "2025-11-03T18:12:47.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43370 (GCVE-0-2025-43370)
Vulnerability from nvd
Published
2025-09-15 22:34
Modified
2025-11-03 18:12
Severity ?
4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Processing an overly large path value may crash a process
Summary
A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T15:01:11.182130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T15:02:24.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:12:46.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing an overly large path value may crash a process",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:34:21.797Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43370",
    "datePublished": "2025-09-15T22:34:21.797Z",
    "dateReserved": "2025-04-16T15:24:37.114Z",
    "dateUpdated": "2025-11-03T18:12:46.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43263 (GCVE-0-2025-43263)
Vulnerability from nvd
Published
2025-09-15 22:34
Modified
2025-11-03 18:09
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE
  • An app may be able to read and write files outside of its sandbox
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T13:40:33.815609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T17:26:52.323Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:09:50.030Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to read and write files outside of its sandbox",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:34:36.899Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43263",
    "datePublished": "2025-09-15T22:34:36.899Z",
    "dateReserved": "2025-04-16T15:24:37.099Z",
    "dateUpdated": "2025-11-03T18:09:50.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-48384 (GCVE-0-2025-48384)
Vulnerability from nvd
Published
2025-07-08 18:23
Modified
2025-11-04 21:11
Severity ?
8.0 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE
  • CWE-436 - Interpretation Conflict
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
References
Impacted products
Vendor Product Version
git git Version: < 2.43.7
Version: >= 2.44.0-rc0, < 2.44.4
Version: >= 2.45.0-rc0, < 2.45.4
Version: >= 2.46.0-rc0, < 2.46.4
Version: >= 2.47.0-rc0, < 2.47.3
Version: >= 2.48.0-rc0, < 2.48.2
Version: >= 2.49.0-rc0, < 2.49.1
Version: >= 2.50.0-rc0, < 2.50.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-48384",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-26T03:55:23.181071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-08-25",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:45:22.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-08-25T00:00:00+00:00",
            "value": "CVE-2025-48384 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:11:00.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.43.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T18:23:48.710Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
        }
      ],
      "source": {
        "advisory": "GHSA-vwqx-4fm8-6qc9",
        "discovery": "UNKNOWN"
      },
      "title": "Git allows arbitrary code execution through broken config quoting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-48384",
    "datePublished": "2025-07-08T18:23:48.710Z",
    "dateReserved": "2025-05-19T15:46:00.397Z",
    "dateUpdated": "2025-11-04T21:11:00.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-30441 (GCVE-0-2025-30441)
Vulnerability from nvd
Published
2025-03-31 22:23
Modified
2025-11-03 21:14
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE
  • An app may be able to overwrite arbitrary files
Summary
This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-30441",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-01T20:44:42.442262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-01T20:45:25.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:14:47.381Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to overwrite arbitrary files",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T22:23:27.966Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/122380"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-30441",
    "datePublished": "2025-03-31T22:23:27.966Z",
    "dateReserved": "2025-03-22T00:04:43.717Z",
    "dateUpdated": "2025-11-03T21:14:47.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24226 (GCVE-0-2025-24226)
Vulnerability from nvd
Published
2025-03-31 22:23
Modified
2025-11-03 21:09
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE
  • A malicious app may be able to access private information
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-01T14:18:32.896619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-01T14:19:17.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:09:10.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A malicious app may be able to access private information",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T22:23:04.994Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/122380"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-24226",
    "datePublished": "2025-03-31T22:23:04.994Z",
    "dateReserved": "2025-01-17T00:00:45.005Z",
    "dateUpdated": "2025-11-03T21:09:10.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44191 (GCVE-0-2024-44191)
Vulnerability from nvd
Published
2024-09-16 23:23
Modified
2025-11-04 16:15
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE
  • An app may gain unauthorized access to Bluetooth
Summary
This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, Xcode 16, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. An app may gain unauthorized access to Bluetooth.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-17T19:19:41.075670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:20:44.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:15:41.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/39"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/36"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/33"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/32"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, Xcode 16, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. An app may gain unauthorized access to Bluetooth."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may gain unauthorized access to Bluetooth",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T23:23:17.982Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121239"
        },
        {
          "url": "https://support.apple.com/en-us/121238"
        },
        {
          "url": "https://support.apple.com/en-us/121248"
        },
        {
          "url": "https://support.apple.com/en-us/121249"
        },
        {
          "url": "https://support.apple.com/en-us/121246"
        },
        {
          "url": "https://support.apple.com/en-us/121250"
        },
        {
          "url": "https://support.apple.com/en-us/121240"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-44191",
    "datePublished": "2024-09-16T23:23:17.982Z",
    "dateReserved": "2024-08-20T21:42:05.934Z",
    "dateUpdated": "2025-11-04T16:15:41.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44162 (GCVE-0-2024-44162)
Vulnerability from nvd
Published
2024-09-16 23:23
Modified
2025-11-04 16:14
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • A malicious application may gain access to a user's Keychain items
Summary
This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-44162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-19T18:28:17.083664Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T18:28:29.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:14:26.819Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/38"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user\u0027s Keychain items."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A malicious application may gain access to a user\u0027s Keychain items",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T23:23:01.988Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-44162",
    "datePublished": "2024-09-16T23:23:01.988Z",
    "dateReserved": "2024-08-20T21:42:05.925Z",
    "dateUpdated": "2025-11-04T16:14:26.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-40862 (GCVE-0-2024-40862)
Vulnerability from nvd
Published
2024-09-16 23:23
Modified
2025-11-04 16:13
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • An attacker may be able to determine the Apple ID of the owner of the computer
Summary
A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apple:xcode:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xcode",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "16",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-40862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-17T14:10:09.478452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-17T14:17:02.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:13:35.763Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/38"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An attacker may be able to determine the Apple ID of the owner of the computer",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T23:23:05.016Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-40862",
    "datePublished": "2024-09-16T23:23:05.016Z",
    "dateReserved": "2024-07-10T17:11:04.714Z",
    "dateUpdated": "2025-11-04T16:13:35.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-23298 (GCVE-0-2024-23298)
Vulnerability from nvd
Published
2024-03-15 22:29
Modified
2025-11-04 18:28
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE
  • An app may bypass Gatekeeper checks
Summary
A logic issue was addressed with improved state management.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 15.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-23298",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T15:04:11.759061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T19:09:20.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:28:36.532Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214092"
          },
          {
            "url": "https://support.apple.com/kb/HT214092"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A logic issue was addressed with improved state management."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may bypass Gatekeeper checks",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-15T22:33:47.552Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT214092"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-23298",
    "datePublished": "2024-03-15T22:29:38.958Z",
    "dateReserved": "2024-01-12T22:22:21.502Z",
    "dateUpdated": "2025-11-04T18:28:36.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-40435 (GCVE-0-2023-40435)
Vulnerability from nvd
Published
2023-09-26 20:14
Modified
2025-11-04 19:19
Severity ?
CWE
  • An app may be able to access App Store credentials
Summary
This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 15
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T19:19:29.186Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213939"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/7"
          },
          {
            "url": "https://support.apple.com/kb/HT213939"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-40435",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T13:49:34.443009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T13:49:49.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to access App Store credentials",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T05:07:09.547Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT213939"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/7"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2023-40435",
    "datePublished": "2023-09-26T20:14:57.611Z",
    "dateReserved": "2023-08-14T20:26:36.260Z",
    "dateUpdated": "2025-11-04T19:19:29.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-40391 (GCVE-0-2023-40391)
Vulnerability from nvd
Published
2023-09-26 20:14
Modified
2025-11-04 19:17
Severity ?
CWE
  • An app may be able to disclose kernel memory
Summary
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14, Xcode 15. An app may be able to disclose kernel memory.
References
Impacted products
Vendor Product Version
Apple iOS and iPadOS Version: unspecified   < 17
 Create a notification for this product.
   Apple Xcode Version: unspecified   < 15
 Create a notification for this product.
   Apple tvOS Version: unspecified   < 17
 Create a notification for this product.
   Apple macOS Version: unspecified   < 14
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T19:17:57.377Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213938"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213939"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213936"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213940"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/3"
          },
          {
            "url": "https://support.apple.com/kb/HT213940"
          },
          {
            "url": "https://support.apple.com/kb/HT213939"
          },
          {
            "url": "https://support.apple.com/kb/HT213936"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-40391",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:36:28.626277Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:36:35.677Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14, Xcode 15. An app may be able to disclose kernel memory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to disclose kernel memory",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T05:07:11.088Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT213938"
        },
        {
          "url": "https://support.apple.com/en-us/HT213939"
        },
        {
          "url": "https://support.apple.com/en-us/HT213936"
        },
        {
          "url": "https://support.apple.com/en-us/HT213940"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/7"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/8"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/3"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2023-40391",
    "datePublished": "2023-09-26T20:14:37.580Z",
    "dateReserved": "2023-08-14T20:26:36.253Z",
    "dateUpdated": "2025-11-04T19:17:57.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43504 (GCVE-0-2025-43504)
Vulnerability from cvelistv5
Published
2025-11-04 01:17
Modified
2025-11-04 13:07
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE
  • A user in a privileged network position may be able to cause a denial-of-service
Summary
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 4.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43504",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-04T13:07:16.935477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-04T13:07:19.240Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A user in a privileged network position may be able to cause a denial-of-service",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-04T01:17:21.026Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125641"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43504",
    "datePublished": "2025-11-04T01:17:21.026Z",
    "dateReserved": "2025-04-16T15:27:21.193Z",
    "dateUpdated": "2025-11-04T13:07:19.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43505 (GCVE-0-2025-43505)
Vulnerability from cvelistv5
Published
2025-11-04 01:16
Modified
2025-11-04 13:12
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • Processing a maliciously crafted file may lead to heap corruption
Summary
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-04T13:11:58.914865Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-04T13:12:03.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing a maliciously crafted file may lead to heap corruption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-04T01:16:46.705Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125641"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43505",
    "datePublished": "2025-11-04T01:16:46.705Z",
    "dateReserved": "2025-04-16T15:27:21.193Z",
    "dateUpdated": "2025-11-04T13:12:03.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43375 (GCVE-0-2025-43375)
Vulnerability from cvelistv5
Published
2025-09-15 22:35
Modified
2025-11-03 18:12
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • Processing an overly large path value may crash a process
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T13:36:48.222793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T17:24:28.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:12:52.650Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing an overly large path value may crash a process",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:35:27.230Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43375",
    "datePublished": "2025-09-15T22:35:27.230Z",
    "dateReserved": "2025-04-16T15:24:37.115Z",
    "dateUpdated": "2025-11-03T18:12:52.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43263 (GCVE-0-2025-43263)
Vulnerability from cvelistv5
Published
2025-09-15 22:34
Modified
2025-11-03 18:09
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE
  • An app may be able to read and write files outside of its sandbox
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T13:40:33.815609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T17:26:52.323Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:09:50.030Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to read and write files outside of its sandbox",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:34:36.899Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43263",
    "datePublished": "2025-09-15T22:34:36.899Z",
    "dateReserved": "2025-04-16T15:24:37.099Z",
    "dateUpdated": "2025-11-03T18:09:50.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43371 (GCVE-0-2025-43371)
Vulnerability from cvelistv5
Published
2025-09-15 22:34
Modified
2025-11-03 18:12
Severity ?
8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE
  • An app may be able to break out of its sandbox
Summary
This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T13:40:41.659342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T17:26:58.156Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:12:47.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to break out of its sandbox",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:34:35.897Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43371",
    "datePublished": "2025-09-15T22:34:35.897Z",
    "dateReserved": "2025-04-16T15:24:37.114Z",
    "dateUpdated": "2025-11-03T18:12:47.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43370 (GCVE-0-2025-43370)
Vulnerability from cvelistv5
Published
2025-09-15 22:34
Modified
2025-11-03 18:12
Severity ?
4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Processing an overly large path value may crash a process
Summary
A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T15:01:11.182130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T15:02:24.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:12:46.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing an overly large path value may crash a process",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:34:21.797Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43370",
    "datePublished": "2025-09-15T22:34:21.797Z",
    "dateReserved": "2025-04-16T15:24:37.114Z",
    "dateUpdated": "2025-11-03T18:12:46.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-48384 (GCVE-0-2025-48384)
Vulnerability from cvelistv5
Published
2025-07-08 18:23
Modified
2025-11-04 21:11
Severity ?
8.0 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE
  • CWE-436 - Interpretation Conflict
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Summary
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
References
Impacted products
Vendor Product Version
git git Version: < 2.43.7
Version: >= 2.44.0-rc0, < 2.44.4
Version: >= 2.45.0-rc0, < 2.45.4
Version: >= 2.46.0-rc0, < 2.46.4
Version: >= 2.47.0-rc0, < 2.47.3
Version: >= 2.48.0-rc0, < 2.48.2
Version: >= 2.49.0-rc0, < 2.49.1
Version: >= 2.50.0-rc0, < 2.50.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-48384",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-26T03:55:23.181071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-08-25",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:45:22.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-08-25T00:00:00+00:00",
            "value": "CVE-2025-48384 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:11:00.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/07/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.43.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.44.0-rc0, \u003c 2.44.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.45.0-rc0, \u003c 2.45.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.46.0-rc0, \u003c 2.46.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.47.0-rc0, \u003c 2.47.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.48.0-rc0, \u003c 2.48.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.49.0-rc0, \u003c 2.49.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.50.0-rc0, \u003c 2.50.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T18:23:48.710Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"
        }
      ],
      "source": {
        "advisory": "GHSA-vwqx-4fm8-6qc9",
        "discovery": "UNKNOWN"
      },
      "title": "Git allows arbitrary code execution through broken config quoting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-48384",
    "datePublished": "2025-07-08T18:23:48.710Z",
    "dateReserved": "2025-05-19T15:46:00.397Z",
    "dateUpdated": "2025-11-04T21:11:00.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-30441 (GCVE-0-2025-30441)
Vulnerability from cvelistv5
Published
2025-03-31 22:23
Modified
2025-11-03 21:14
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE
  • An app may be able to overwrite arbitrary files
Summary
This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-30441",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-01T20:44:42.442262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-01T20:45:25.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:14:47.381Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to overwrite arbitrary files",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T22:23:27.966Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/122380"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-30441",
    "datePublished": "2025-03-31T22:23:27.966Z",
    "dateReserved": "2025-03-22T00:04:43.717Z",
    "dateUpdated": "2025-11-03T21:14:47.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-24226 (GCVE-0-2025-24226)
Vulnerability from cvelistv5
Published
2025-03-31 22:23
Modified
2025-11-03 21:09
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE
  • A malicious app may be able to access private information
Summary
The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-01T14:18:32.896619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-01T14:19:17.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:09:10.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A malicious app may be able to access private information",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-31T22:23:04.994Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/122380"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-24226",
    "datePublished": "2025-03-31T22:23:04.994Z",
    "dateReserved": "2025-01-17T00:00:45.005Z",
    "dateUpdated": "2025-11-03T21:09:10.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44191 (GCVE-0-2024-44191)
Vulnerability from cvelistv5
Published
2024-09-16 23:23
Modified
2025-11-04 16:15
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE
  • An app may gain unauthorized access to Bluetooth
Summary
This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, Xcode 16, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. An app may gain unauthorized access to Bluetooth.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-44191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-17T19:19:41.075670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:20:44.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:15:41.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/39"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/36"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/33"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/32"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, Xcode 16, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. An app may gain unauthorized access to Bluetooth."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may gain unauthorized access to Bluetooth",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T23:23:17.982Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121239"
        },
        {
          "url": "https://support.apple.com/en-us/121238"
        },
        {
          "url": "https://support.apple.com/en-us/121248"
        },
        {
          "url": "https://support.apple.com/en-us/121249"
        },
        {
          "url": "https://support.apple.com/en-us/121246"
        },
        {
          "url": "https://support.apple.com/en-us/121250"
        },
        {
          "url": "https://support.apple.com/en-us/121240"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-44191",
    "datePublished": "2024-09-16T23:23:17.982Z",
    "dateReserved": "2024-08-20T21:42:05.934Z",
    "dateUpdated": "2025-11-04T16:15:41.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-40862 (GCVE-0-2024-40862)
Vulnerability from cvelistv5
Published
2024-09-16 23:23
Modified
2025-11-04 16:13
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • An attacker may be able to determine the Apple ID of the owner of the computer
Summary
A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apple:xcode:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xcode",
            "vendor": "apple",
            "versions": [
              {
                "lessThan": "16",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-40862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-17T14:10:09.478452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-17T14:17:02.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:13:35.763Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/38"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An attacker may be able to determine the Apple ID of the owner of the computer",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T23:23:05.016Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-40862",
    "datePublished": "2024-09-16T23:23:05.016Z",
    "dateReserved": "2024-07-10T17:11:04.714Z",
    "dateUpdated": "2025-11-04T16:13:35.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44162 (GCVE-0-2024-44162)
Vulnerability from cvelistv5
Published
2024-09-16 23:23
Modified
2025-11-04 16:14
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • A malicious application may gain access to a user's Keychain items
Summary
This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-44162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-19T18:28:17.083664Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T18:28:29.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:14:26.819Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/38"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user\u0027s Keychain items."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A malicious application may gain access to a user\u0027s Keychain items",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-16T23:23:01.988Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-44162",
    "datePublished": "2024-09-16T23:23:01.988Z",
    "dateReserved": "2024-08-20T21:42:05.925Z",
    "dateUpdated": "2025-11-04T16:14:26.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-23298 (GCVE-0-2024-23298)
Vulnerability from cvelistv5
Published
2024-03-15 22:29
Modified
2025-11-04 18:28
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE
  • An app may bypass Gatekeeper checks
Summary
A logic issue was addressed with improved state management.
References
Impacted products
Vendor Product Version
Apple Xcode Version: unspecified   < 15.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-23298",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T15:04:11.759061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T19:09:20.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:28:36.532Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT214092"
          },
          {
            "url": "https://support.apple.com/kb/HT214092"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A logic issue was addressed with improved state management."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may bypass Gatekeeper checks",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-15T22:33:47.552Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT214092"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-23298",
    "datePublished": "2024-03-15T22:29:38.958Z",
    "dateReserved": "2024-01-12T22:22:21.502Z",
    "dateUpdated": "2025-11-04T18:28:36.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2025-AVI-0961
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Apple macOS macOS Tahoe versions antérieures à 26.1
Apple iPadOS iPadOS versions antérieures à 26.1
Apple macOS macOS Sequoia versions antérieures à 15.7.2
Apple Safari Safari versions antérieures à 26.1
Apple Xcode Xcode versions antérieures à 26.1
Apple watchOS watchOS versions antérieures à 26.1
Apple iOS iOS versions antérieures à 26.1
Apple tvOS tvOS versions antérieures à 26.1
Apple macOS macOS Sonoma versions antérieures à 14.8.2
Apple visionOS visionOS versions antérieures à 26.1
References
Bulletin de sécurité Apple 125639 2025-11-03 vendor-advisory
Bulletin de sécurité Apple 125640 2025-11-03 vendor-advisory
Bulletin de sécurité Apple 125634 2025-11-03 vendor-advisory
Bulletin de sécurité Apple 125632 2025-11-03 vendor-advisory
Bulletin de sécurité Apple 125638 2025-11-03 vendor-advisory
Bulletin de sécurité Apple 125635 2025-11-03 vendor-advisory
Bulletin de sécurité Apple 125641 2025-11-03 vendor-advisory
Bulletin de sécurité Apple 125636 2025-11-03 vendor-advisory
Bulletin de sécurité Apple 125637 2025-11-03 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.1",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iPadOS versions ant\u00e9rieures \u00e0 26.1",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7.2",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Safari versions ant\u00e9rieures \u00e0 26.1",
      "product": {
        "name": "Safari",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Xcode versions ant\u00e9rieures \u00e0 26.1",
      "product": {
        "name": "Xcode",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "watchOS versions ant\u00e9rieures \u00e0 26.1",
      "product": {
        "name": "watchOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iOS versions ant\u00e9rieures \u00e0 26.1",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "tvOS versions ant\u00e9rieures \u00e0 26.1",
      "product": {
        "name": "tvOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8.2",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "visionOS versions ant\u00e9rieures \u00e0 26.1",
      "product": {
        "name": "visionOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-43292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43292"
    },
    {
      "name": "CVE-2025-43505",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43505"
    },
    {
      "name": "CVE-2025-43432",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43432"
    },
    {
      "name": "CVE-2025-43372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43372"
    },
    {
      "name": "CVE-2025-43426",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43426"
    },
    {
      "name": "CVE-2025-43480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43480"
    },
    {
      "name": "CVE-2025-43449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43449"
    },
    {
      "name": "CVE-2025-43348",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43348"
    },
    {
      "name": "CVE-2025-43351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43351"
    },
    {
      "name": "CVE-2025-43373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43373"
    },
    {
      "name": "CVE-2025-43441",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43441"
    },
    {
      "name": "CVE-2025-43443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43443"
    },
    {
      "name": "CVE-2025-43476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43476"
    },
    {
      "name": "CVE-2025-30465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30465"
    },
    {
      "name": "CVE-2025-43448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43448"
    },
    {
      "name": "CVE-2025-43497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43497"
    },
    {
      "name": "CVE-2025-43446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43446"
    },
    {
      "name": "CVE-2025-43500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43500"
    },
    {
      "name": "CVE-2025-43431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43431"
    },
    {
      "name": "CVE-2025-43452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43452"
    },
    {
      "name": "CVE-2025-43504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43504"
    },
    {
      "name": "CVE-2025-43467",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43467"
    },
    {
      "name": "CVE-2025-43496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43496"
    },
    {
      "name": "CVE-2025-43420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43420"
    },
    {
      "name": "CVE-2025-43450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43450"
    },
    {
      "name": "CVE-2025-43406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43406"
    },
    {
      "name": "CVE-2025-43402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43402"
    },
    {
      "name": "CVE-2025-43384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43384"
    },
    {
      "name": "CVE-2025-43434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43434"
    },
    {
      "name": "CVE-2025-43422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43422"
    },
    {
      "name": "CVE-2025-43503",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43503"
    },
    {
      "name": "CVE-2025-43502",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43502"
    },
    {
      "name": "CVE-2025-43440",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43440"
    },
    {
      "name": "CVE-2024-43398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43398"
    },
    {
      "name": "CVE-2025-43427",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43427"
    },
    {
      "name": "CVE-2025-43394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43394"
    },
    {
      "name": "CVE-2025-43335",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43335"
    },
    {
      "name": "CVE-2025-43458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43458"
    },
    {
      "name": "CVE-2025-43411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43411"
    },
    {
      "name": "CVE-2025-43469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43469"
    },
    {
      "name": "CVE-2025-43498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43498"
    },
    {
      "name": "CVE-2025-43424",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43424"
    },
    {
      "name": "CVE-2025-43423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43423"
    },
    {
      "name": "CVE-2025-43472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43472"
    },
    {
      "name": "CVE-2025-43459",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43459"
    },
    {
      "name": "CVE-2025-43392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43392"
    },
    {
      "name": "CVE-2025-43462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43462"
    },
    {
      "name": "CVE-2025-43401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43401"
    },
    {
      "name": "CVE-2025-43386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43386"
    },
    {
      "name": "CVE-2025-43493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43493"
    },
    {
      "name": "CVE-2025-43481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43481"
    },
    {
      "name": "CVE-2025-43405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43405"
    },
    {
      "name": "CVE-2025-43506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43506"
    },
    {
      "name": "CVE-2025-43322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43322"
    },
    {
      "name": "CVE-2025-32462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-32462"
    },
    {
      "name": "CVE-2025-43400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43400"
    },
    {
      "name": "CVE-2025-43468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43468"
    },
    {
      "name": "CVE-2025-43395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43395"
    },
    {
      "name": "CVE-2025-43421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43421"
    },
    {
      "name": "CVE-2025-43435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43435"
    },
    {
      "name": "CVE-2025-43464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43464"
    },
    {
      "name": "CVE-2025-43442",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43442"
    },
    {
      "name": "CVE-2025-43377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43377"
    },
    {
      "name": "CVE-2025-43438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43438"
    },
    {
      "name": "CVE-2025-43460",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43460"
    },
    {
      "name": "CVE-2025-43429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43429"
    },
    {
      "name": "CVE-2025-43407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43407"
    },
    {
      "name": "CVE-2025-43334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43334"
    },
    {
      "name": "CVE-2025-43414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43414"
    },
    {
      "name": "CVE-2025-43385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43385"
    },
    {
      "name": "CVE-2025-43444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43444"
    },
    {
      "name": "CVE-2025-43404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43404"
    },
    {
      "name": "CVE-2025-43495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43495"
    },
    {
      "name": "CVE-2025-43465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43465"
    },
    {
      "name": "CVE-2025-43461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43461"
    },
    {
      "name": "CVE-2025-43294",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43294"
    },
    {
      "name": "CVE-2025-43390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43390"
    },
    {
      "name": "CVE-2025-43499",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43499"
    },
    {
      "name": "CVE-2025-43350",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43350"
    },
    {
      "name": "CVE-2025-43391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43391"
    },
    {
      "name": "CVE-2025-43378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43378"
    },
    {
      "name": "CVE-2025-43473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43473"
    },
    {
      "name": "CVE-2025-43445",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43445"
    },
    {
      "name": "CVE-2025-43338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43338"
    },
    {
      "name": "CVE-2025-43409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43409"
    },
    {
      "name": "CVE-2025-43399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43399"
    },
    {
      "name": "CVE-2025-43383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43383"
    },
    {
      "name": "CVE-2025-43474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43474"
    },
    {
      "name": "CVE-2025-43471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43471"
    },
    {
      "name": "CVE-2025-43387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43387"
    },
    {
      "name": "CVE-2025-43479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43479"
    },
    {
      "name": "CVE-2025-43447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43447"
    },
    {
      "name": "CVE-2025-43477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43477"
    },
    {
      "name": "CVE-2025-43413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43413"
    },
    {
      "name": "CVE-2025-43507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43507"
    },
    {
      "name": "CVE-2025-43336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43336"
    },
    {
      "name": "CVE-2025-43433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43433"
    },
    {
      "name": "CVE-2025-43430",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43430"
    },
    {
      "name": "CVE-2025-43337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43337"
    },
    {
      "name": "CVE-2025-43380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43380"
    },
    {
      "name": "CVE-2025-43397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43397"
    },
    {
      "name": "CVE-2025-43455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43455"
    },
    {
      "name": "CVE-2025-53906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53906"
    },
    {
      "name": "CVE-2025-43412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43412"
    },
    {
      "name": "CVE-2025-43388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43388"
    },
    {
      "name": "CVE-2025-43396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43396"
    },
    {
      "name": "CVE-2025-43454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43454"
    },
    {
      "name": "CVE-2025-43439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43439"
    },
    {
      "name": "CVE-2025-43381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43381"
    },
    {
      "name": "CVE-2025-43382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43382"
    },
    {
      "name": "CVE-2025-43466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43466"
    },
    {
      "name": "CVE-2025-43364",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43364"
    },
    {
      "name": "CVE-2025-43393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43393"
    },
    {
      "name": "CVE-2025-43389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43389"
    },
    {
      "name": "CVE-2025-43457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43457"
    },
    {
      "name": "CVE-2025-43361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43361"
    },
    {
      "name": "CVE-2025-43398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43398"
    },
    {
      "name": "CVE-2025-31199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31199"
    },
    {
      "name": "CVE-2025-43408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43408"
    },
    {
      "name": "CVE-2025-43379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43379"
    },
    {
      "name": "CVE-2025-6442",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6442"
    },
    {
      "name": "CVE-2025-43425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43425"
    },
    {
      "name": "CVE-2025-43478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43478"
    },
    {
      "name": "CVE-2025-43436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43436"
    },
    {
      "name": "CVE-2024-49761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49761"
    },
    {
      "name": "CVE-2025-43463",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43463"
    }
  ],
  "initial_release_date": "2025-11-04T00:00:00",
  "last_revision_date": "2025-11-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0961",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-11-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
  "vendor_advisories": [
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125639",
      "url": "https://support.apple.com/en-us/125639"
    },
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125640",
      "url": "https://support.apple.com/en-us/125640"
    },
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125634",
      "url": "https://support.apple.com/en-us/125634"
    },
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125632",
      "url": "https://support.apple.com/en-us/125632"
    },
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125638",
      "url": "https://support.apple.com/en-us/125638"
    },
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125635",
      "url": "https://support.apple.com/en-us/125635"
    },
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125641",
      "url": "https://support.apple.com/en-us/125641"
    },
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125636",
      "url": "https://support.apple.com/en-us/125636"
    },
    {
      "published_at": "2025-11-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125637",
      "url": "https://support.apple.com/en-us/125637"
    }
  ]
}

CERTFR-2025-AVI-0791
Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Apple indique que la vulnérabilité CVE-2025-43300 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Apple iPadOS iPadOS versions antérieures à 26
Apple watchOS watchOS versions antérieures à 26
Apple iOS iOS versions 16.x antérieures à 16.7.12
Apple macOS macOS Sonoma versions antérieures à 14.8
Apple tvOS tvOS versions antérieures à 26
Apple macOS macOS Sequoia versions antérieures à 15.7
Apple iOS iOS versions antérieures à 26
Apple iOS iOS versions 15.x antérieures à 15.8.5
Apple iOS iOS versions 18.x antérieures à 18.7
Apple visionOS visionOS versions antérieures à 26
Apple Xcode Xcode versions antérieures à 26
Apple Safari Safari versions antérieures à 26
Apple iPadOS iPadOS versions 15.x antérieures à 15.8.5
Apple iPadOS iPadOS versions 16.x antérieures à 16.7.12
Apple macOS macOS Tahoe versions antérieures à 26
Apple iPadOS iPadOS versions 18.x antérieures à 18.7
References
Bulletin de sécurité Apple 125112 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125116 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125110 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125115 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125141 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125117 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125114 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125108 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125111 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125109 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125142 2025-09-15 vendor-advisory
Bulletin de sécurité Apple 125113 2025-09-15 vendor-advisory

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "iPadOS versions ant\u00e9rieures \u00e0 26",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "watchOS versions ant\u00e9rieures \u00e0 26",
      "product": {
        "name": "watchOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iOS versions 16.x ant\u00e9rieures \u00e0 16.7.12",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.8",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "tvOS versions ant\u00e9rieures \u00e0 26",
      "product": {
        "name": "tvOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.7",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iOS versions ant\u00e9rieures \u00e0 26",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iOS versions 15.x ant\u00e9rieures \u00e0 15.8.5",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iOS versions 18.x ant\u00e9rieures \u00e0 18.7",
      "product": {
        "name": "iOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "visionOS versions ant\u00e9rieures \u00e0 26",
      "product": {
        "name": "visionOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Xcode versions ant\u00e9rieures \u00e0 26",
      "product": {
        "name": "Xcode",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Safari versions ant\u00e9rieures \u00e0 26",
      "product": {
        "name": "Safari",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iPadOS versions 15.x ant\u00e9rieures \u00e0 15.8.5",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iPadOS versions 16.x ant\u00e9rieures \u00e0 16.7.12",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "iPadOS versions 18.x ant\u00e9rieures \u00e0 18.7",
      "product": {
        "name": "iPadOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-43292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43292"
    },
    {
      "name": "CVE-2025-43372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43372"
    },
    {
      "name": "CVE-2025-43332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43332"
    },
    {
      "name": "CVE-2025-31270",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31270"
    },
    {
      "name": "CVE-2025-43362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43362"
    },
    {
      "name": "CVE-2025-43319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43319"
    },
    {
      "name": "CVE-2025-43340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43340"
    },
    {
      "name": "CVE-2025-43327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43327"
    },
    {
      "name": "CVE-2025-30468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30468"
    },
    {
      "name": "CVE-2025-43359",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43359"
    },
    {
      "name": "CVE-2025-43262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43262"
    },
    {
      "name": "CVE-2024-27280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27280"
    },
    {
      "name": "CVE-2025-31269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31269"
    },
    {
      "name": "CVE-2025-43354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43354"
    },
    {
      "name": "CVE-2025-43326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43326"
    },
    {
      "name": "CVE-2025-43204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43204"
    },
    {
      "name": "CVE-2025-43273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43273"
    },
    {
      "name": "CVE-2025-43347",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43347"
    },
    {
      "name": "CVE-2025-43302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43302"
    },
    {
      "name": "CVE-2025-43321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43321"
    },
    {
      "name": "CVE-2025-31254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31254"
    },
    {
      "name": "CVE-2025-43299",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43299"
    },
    {
      "name": "CVE-2025-43316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43316"
    },
    {
      "name": "CVE-2025-43263",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43263"
    },
    {
      "name": "CVE-2025-31255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31255"
    },
    {
      "name": "CVE-2025-43375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43375"
    },
    {
      "name": "CVE-2025-6965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
    },
    {
      "name": "CVE-2025-43355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43355"
    },
    {
      "name": "CVE-2025-43207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43207"
    },
    {
      "name": "CVE-2025-43285",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43285"
    },
    {
      "name": "CVE-2025-43370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43370"
    },
    {
      "name": "CVE-2025-43312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43312"
    },
    {
      "name": "CVE-2025-43317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43317"
    },
    {
      "name": "CVE-2025-31271",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31271"
    },
    {
      "name": "CVE-2025-43208",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43208"
    },
    {
      "name": "CVE-2025-43283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43283"
    },
    {
      "name": "CVE-2025-48384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48384"
    },
    {
      "name": "CVE-2025-43277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43277"
    },
    {
      "name": "CVE-2025-43325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43325"
    },
    {
      "name": "CVE-2025-43231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43231"
    },
    {
      "name": "CVE-2025-24197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-24197"
    },
    {
      "name": "CVE-2025-43358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43358"
    },
    {
      "name": "CVE-2025-43328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43328"
    },
    {
      "name": "CVE-2025-43368",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43368"
    },
    {
      "name": "CVE-2025-43315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43315"
    },
    {
      "name": "CVE-2025-43331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43331"
    },
    {
      "name": "CVE-2025-43310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43310"
    },
    {
      "name": "CVE-2025-43333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43333"
    },
    {
      "name": "CVE-2025-43203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43203"
    },
    {
      "name": "CVE-2025-43307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43307"
    },
    {
      "name": "CVE-2025-43297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43297"
    },
    {
      "name": "CVE-2025-43190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43190"
    },
    {
      "name": "CVE-2025-24088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-24088"
    },
    {
      "name": "CVE-2025-43293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43293"
    },
    {
      "name": "CVE-2025-43343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43343"
    },
    {
      "name": "CVE-2025-43294",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43294"
    },
    {
      "name": "CVE-2025-43286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43286"
    },
    {
      "name": "CVE-2025-43353",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43353"
    },
    {
      "name": "CVE-2025-43356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43356"
    },
    {
      "name": "CVE-2025-43330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43330"
    },
    {
      "name": "CVE-2025-43272",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43272"
    },
    {
      "name": "CVE-2025-31259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31259"
    },
    {
      "name": "CVE-2025-31268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31268"
    },
    {
      "name": "CVE-2025-43366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43366"
    },
    {
      "name": "CVE-2025-43298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43298"
    },
    {
      "name": "CVE-2025-43369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43369"
    },
    {
      "name": "CVE-2025-43308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43308"
    },
    {
      "name": "CVE-2025-43346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43346"
    },
    {
      "name": "CVE-2025-40909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40909"
    },
    {
      "name": "CVE-2025-43337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43337"
    },
    {
      "name": "CVE-2025-24133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-24133"
    },
    {
      "name": "CVE-2025-43279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43279"
    },
    {
      "name": "CVE-2025-43314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43314"
    },
    {
      "name": "CVE-2025-43300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43300"
    },
    {
      "name": "CVE-2025-43342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43342"
    },
    {
      "name": "CVE-2025-43349",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43349"
    },
    {
      "name": "CVE-2025-43341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43341"
    },
    {
      "name": "CVE-2025-43301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43301"
    },
    {
      "name": "CVE-2025-43318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43318"
    },
    {
      "name": "CVE-2025-43344",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43344"
    },
    {
      "name": "CVE-2025-43311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43311"
    },
    {
      "name": "CVE-2025-43287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43287"
    },
    {
      "name": "CVE-2025-43303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43303"
    },
    {
      "name": "CVE-2025-43304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43304"
    },
    {
      "name": "CVE-2025-43291",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43291"
    },
    {
      "name": "CVE-2025-43329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43329"
    },
    {
      "name": "CVE-2025-43357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43357"
    },
    {
      "name": "CVE-2025-43367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43367"
    },
    {
      "name": "CVE-2025-43371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43371"
    },
    {
      "name": "CVE-2025-43295",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43295"
    },
    {
      "name": "CVE-2025-43305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-43305"
    }
  ],
  "initial_release_date": "2025-09-16T00:00:00",
  "last_revision_date": "2025-09-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0791",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-09-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nApple indique que la vuln\u00e9rabilit\u00e9 CVE-2025-43300 est activement exploit\u00e9e.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
  "vendor_advisories": [
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125112",
      "url": "https://support.apple.com/en-us/125112"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125116",
      "url": "https://support.apple.com/en-us/125116"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125110",
      "url": "https://support.apple.com/en-us/125110"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125115",
      "url": "https://support.apple.com/en-us/125115"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125141",
      "url": "https://support.apple.com/en-us/125141"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125117",
      "url": "https://support.apple.com/en-us/125117"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125114",
      "url": "https://support.apple.com/en-us/125114"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125108",
      "url": "https://support.apple.com/en-us/125108"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125111",
      "url": "https://support.apple.com/en-us/125111"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125109",
      "url": "https://support.apple.com/en-us/125109"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125142",
      "url": "https://support.apple.com/en-us/125142"
    },
    {
      "published_at": "2025-09-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 125113",
      "url": "https://support.apple.com/en-us/125113"
    }
  ]
}