Action not permitted
Modal body text goes here.
wid-sec-w-2024-0175
Vulnerability from csaf_certbund
Published
2024-01-22 23:00
Modified
2024-05-09 22:00
Summary
Apple macOS: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Apple macOS ist ein Betriebssystem, das auf FreeBSD und Mach basiert.
Angriff
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.
Betroffene Betriebssysteme
- MacOS X
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Apple macOS ist ein Betriebssystem, das auf FreeBSD und Mach basiert.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- MacOS X", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0175 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0175.json" }, { "category": "self", "summary": "WID-SEC-2024-0175 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0175" }, { "category": "external", "summary": "Apple Security Advisory vom 2024-01-22", "url": "https://support.apple.com/kb/HT214057" }, { "category": "external", "summary": "Apple Security Advisory vom 2024-01-22", "url": "https://support.apple.com/kb/HT214058" }, { "category": "external", "summary": "Apple Security Advisory vom 2024-01-22", "url": "https://support.apple.com/kb/HT214061" } ], "source_lang": "en-US", "title": "Apple macOS: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-09T22:00:00.000+00:00", "generator": { "date": "2024-08-15T18:04:08.687+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2024-0175", "initial_release_date": "2024-01-22T23:00:00.000+00:00", "revision_history": [ { "date": "2024-01-22T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-05-09T22:00:00.000+00:00", "number": "2", "summary": "CVE-Nummern erg\u00e4nzt" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c12.7.3", "product": { "name": "Apple macOS \u003c12.7.3", "product_id": "T032287" } }, { "category": "product_version_range", "name": "\u003c13.6.4", "product": { "name": "Apple macOS \u003c13.6.4", "product_id": "T032288" } }, { "category": "product_version_range", "name": "\u003c14.3", "product": { "name": "Apple macOS \u003c14.3", "product_id": "T032289" } } ], "category": "product_name", "name": "macOS" } ], "category": "vendor", "name": "Apple" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-38039", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-38039" }, { "cve": "CVE-2023-38545", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-38545" }, { "cve": "CVE-2023-38546", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-38546" }, { "cve": "CVE-2023-40528", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-40528" }, { "cve": "CVE-2023-42887", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-42887" }, { "cve": "CVE-2023-42888", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-42888" }, { "cve": "CVE-2023-42915", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-42915" }, { "cve": "CVE-2023-42935", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-42935" }, { "cve": "CVE-2023-42937", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2023-42937" }, { "cve": "CVE-2024-23203", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23203" }, { "cve": "CVE-2024-23204", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23204" }, { "cve": "CVE-2024-23206", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23206" }, { "cve": "CVE-2024-23207", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23207" }, { "cve": "CVE-2024-23208", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23208" }, { "cve": "CVE-2024-23209", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23209" }, { "cve": "CVE-2024-23210", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23210" }, { "cve": "CVE-2024-23211", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23211" }, { "cve": "CVE-2024-23212", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23212" }, { "cve": "CVE-2024-23213", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23213" }, { "cve": "CVE-2024-23214", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23214" }, { "cve": "CVE-2024-23215", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23215" }, { "cve": "CVE-2024-23217", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23217" }, { "cve": "CVE-2024-23218", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23218" }, { "cve": "CVE-2024-23222", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23222" }, { "cve": "CVE-2024-23223", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23223" }, { "cve": "CVE-2024-23224", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23224" }, { "cve": "CVE-2024-23271", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-23271" }, { "cve": "CVE-2024-27791", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Apple macOS. Diese Fehler bestehen in mehreren Komponenten und Modulen wie Finder, Mail Search oder WebKit, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie unsachgem\u00e4\u00dfe Speicherbehandlung oder unsachgem\u00e4\u00dfe Behandlung von Dateien. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "release_date": "2024-01-22T23:00:00.000+00:00", "title": "CVE-2024-27791" } ] }
cve-2024-23218
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-29 14:26
Severity ?
EPSS score ?
Summary
A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An attacker may be able to decrypt legacy RSA PKCS#1 v1.5 ciphertexts without having the private key.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.071Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/40" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214082" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214083" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214085" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Mar/22" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Mar/23" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-23218", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-01-23T16:07:56.317583Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-29T14:26:33.596Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An attacker may be able to decrypt legacy RSA PKCS#1 v1.5 ciphertexts without having the private key." } ], "problemTypes": [ { "descriptions": [ { "description": "An attacker may be able to decrypt legacy RSA PKCS#1 v1.5 ciphertexts without having the private key", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:38.999Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/40" }, { "url": "https://support.apple.com/kb/HT214082" }, { "url": "https://support.apple.com/kb/HT214083" }, { "url": "https://support.apple.com/kb/HT214085" }, { "url": "http://seclists.org/fulldisclosure/2024/Mar/22" }, { "url": "http://seclists.org/fulldisclosure/2024/Mar/23" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23218", "datePublished": "2024-01-23T00:25:38.999Z", "dateReserved": "2024-01-12T22:22:21.477Z", "dateUpdated": "2024-08-29T14:26:33.596Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-27791
Vulnerability from cvelistv5
Published
2024-04-24 16:43
Modified
2024-08-02 00:41
Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, tvOS 17.3, macOS Ventura 13.6.4, iOS 16.7.5 and iPadOS 16.7.5, macOS Monterey 12.7.3, macOS Sonoma 14.3. An app may be able to corrupt coprocessor memory.
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:apple:tvos:17.3:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "tvos", "vendor": "apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "iphone_os", "vendor": "apple", "versions": [ { "status": "affected", "version": "0" } ] }, { "cpes": [ "cpe:2.3:o:apple:ipad_os:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ipad_os", "vendor": "apple", "versions": [ { "status": "affected", "version": "0" } ] }, { "cpes": [ "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "iphone_os", "vendor": "apple", "versions": [ { "status": "affected", "version": "0" } ] }, { "cpes": [ "cpe:2.3:o:apple:ipad_os:-:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ipad_os", "vendor": "apple", "versions": [ { "status": "affected", "version": "0" } ] }, { "cpes": [ "cpe:2.3:o:apple:macos:12.0:*:*:*:*:*:*:*", "cpe:2.3:o:apple:macos:13.0:*:*:*:*:*:*:*", "cpe:2.3:o:apple:macos:14.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "macos", "vendor": "apple", "versions": [ { "lessThan": "12.7.3", "status": "affected", "version": "12.0", "versionType": "custom" }, { "lessThan": "13.6.4", "status": "affected", "version": "13.0", "versionType": "custom" }, { "lessThan": "14.3", "status": "affected", "version": "14.0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-27791", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-04-26T17:07:22.920160Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-07-30T14:31:36.409Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:41:55.246Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214057" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "12.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, tvOS 17.3, macOS Ventura 13.6.4, iOS 16.7.5 and iPadOS 16.7.5, macOS Monterey 12.7.3, macOS Sonoma 14.3. An app may be able to corrupt coprocessor memory." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to corrupt coprocessor memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-04-24T16:43:44.979Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214063" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "https://support.apple.com/en-us/HT214057" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-27791", "datePublished": "2024-04-24T16:43:44.979Z", "dateReserved": "2024-02-26T15:32:28.514Z", "dateUpdated": "2024-08-02T00:41:55.246Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-42935
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-02 19:37
Severity ?
EPSS score ?
Summary
An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:37:21.911Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213984" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be able to view the previous logged in user\u2019s desktop from the fast user switching screen." } ], "problemTypes": [ { "descriptions": [ { "description": "A local attacker may be able to view the previous logged in user\u2019s desktop from the fast user switching screen", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:17.840Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/kb/HT213984" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-42935", "datePublished": "2024-01-23T00:25:17.840Z", "dateReserved": "2023-09-14T19:05:11.470Z", "dateUpdated": "2024-08-02T19:37:21.911Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23215
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to access user-sensitive data.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.066Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to access user-sensitive data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access user-sensitive data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:33.950Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23215", "datePublished": "2024-01-23T00:25:33.950Z", "dateReserved": "2024-01-12T22:22:21.477Z", "dateUpdated": "2024-08-01T22:59:32.066Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23222
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.056Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214057" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214056" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A type confusion issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited.", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-08T01:36:17.423Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "https://support.apple.com/kb/HT214063" }, { "url": "https://support.apple.com/kb/HT214059" }, { "url": "https://support.apple.com/kb/HT214057" }, { "url": "https://support.apple.com/kb/HT214058" }, { "url": "https://support.apple.com/kb/HT214061" }, { "url": "https://support.apple.com/kb/HT214055" }, { "url": "https://support.apple.com/kb/HT214056" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23222", "datePublished": "2024-01-23T00:25:37.095Z", "dateReserved": "2024-01-12T22:22:21.478Z", "dateUpdated": "2024-08-01T22:59:32.056Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-42887
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-02 19:30
Severity ?
EPSS score ?
Summary
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.6.4, macOS Sonoma 14.2. An app may be able to read arbitrary files.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:30:25.361Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214036" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214036" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.6.4, macOS Sonoma 14.2. An app may be able to read arbitrary files." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to read arbitrary files", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:38.040Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/en-us/HT214036" }, { "url": "https://support.apple.com/kb/HT214036" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-42887", "datePublished": "2024-01-23T00:25:38.040Z", "dateReserved": "2023-09-14T19:05:11.459Z", "dateUpdated": "2024-08-02T19:30:25.361Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23212
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, macOS Ventura 13.6.4, macOS Monterey 12.7.3. An app may be able to execute arbitrary code with kernel privileges.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | macOS |
Version: unspecified < 13.6 |
||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.008Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214057" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/38" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "12.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, macOS Ventura 13.6.4, macOS Monterey 12.7.3. An app may be able to execute arbitrary code with kernel privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to execute arbitrary code with kernel privileges", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:29.242Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214063" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "https://support.apple.com/en-us/HT214057" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/38" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23212", "datePublished": "2024-01-23T00:25:29.242Z", "dateReserved": "2024-01-12T22:22:21.476Z", "dateUpdated": "2024-08-01T22:59:32.008Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-42888
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-11-13 16:33
Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. Processing a maliciously crafted image may result in disclosure of process memory.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:30:24.978Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214035" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214036" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214041" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214057" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214036" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214035" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214041" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/38" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-42888", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-01-26T18:38:03.041264Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-13T16:33:23.373Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "12.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. Processing a maliciously crafted image may result in disclosure of process memory." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing a maliciously crafted image may result in disclosure of process memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:16.836Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214035" }, { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/en-us/HT214063" }, { "url": "https://support.apple.com/en-us/HT214036" }, { "url": "https://support.apple.com/en-us/HT214041" }, { "url": "https://support.apple.com/en-us/HT214057" }, { "url": "https://support.apple.com/kb/HT214036" }, { "url": "https://support.apple.com/kb/HT214035" }, { "url": "https://support.apple.com/kb/HT214041" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/38" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-42888", "datePublished": "2024-01-23T00:25:16.836Z", "dateReserved": "2023-09-14T19:05:11.459Z", "dateUpdated": "2024-11-13T16:33:23.373Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23224
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.3, macOS Ventura 13.6.4. An app may be able to access sensitive user data.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.032Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.3, macOS Ventura 13.6.4. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:26.314Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23224", "datePublished": "2024-01-23T00:25:26.314Z", "dateReserved": "2024-01-12T22:22:21.478Z", "dateUpdated": "2024-08-01T22:59:32.032Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23217
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3. An app may be able to bypass certain Privacy preferences.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.048Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214085" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Mar/22" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3. An app may be able to bypass certain Privacy preferences." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to bypass certain Privacy preferences", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:15.760Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "https://support.apple.com/kb/HT214085" }, { "url": "http://seclists.org/fulldisclosure/2024/Mar/22" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23217", "datePublished": "2024-01-23T00:25:15.760Z", "dateReserved": "2024-01-12T22:22:21.477Z", "dateUpdated": "2024-08-01T22:59:32.048Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23204
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3. A shortcut may be able to use sensitive data with certain actions without prompting the user.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:31.999Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214082" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214083" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214085" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Mar/22" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Mar/23" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3. A shortcut may be able to use sensitive data with certain actions without prompting the user." } ], "problemTypes": [ { "descriptions": [ { "description": "A shortcut may be able to use sensitive data with certain actions without prompting the user", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:30.276Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "https://support.apple.com/kb/HT214082" }, { "url": "https://support.apple.com/kb/HT214083" }, { "url": "https://support.apple.com/kb/HT214085" }, { "url": "http://seclists.org/fulldisclosure/2024/Mar/22" }, { "url": "http://seclists.org/fulldisclosure/2024/Mar/23" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23204", "datePublished": "2024-01-23T00:25:30.276Z", "dateReserved": "2024-01-12T22:22:21.475Z", "dateUpdated": "2024-08-01T22:59:31.999Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-38039
Vulnerability from cvelistv5
Published
2023-09-15 03:21
Modified
2024-08-02 17:30
Severity ?
EPSS score ?
Summary
When curl retrieves an HTTP response, it stores the incoming headers so that
they can be accessed later via the libcurl headers API.
However, curl did not have a limit in how many or how large headers it would
accept in a response, allowing a malicious server to stream an endless series
of headers and eventually cause curl to run out of heap memory.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T17:30:12.356Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://hackerone.com/reports/2072338" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/" }, { "tags": [ "x_transferred" ], "url": "https://security.gentoo.org/glsa/202310-12" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20231013-0005/" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2023/Oct/17" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214036" }, { "tags": [ "x_transferred" ], "url": "https://www.insyde.com/security-pledge/SA-2023064" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214057" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214058" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/38" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "curl", "vendor": "curl", "versions": [ { "lessThan": "8.3.0", "status": "affected", "version": "8.3.0", "versionType": "semver" }, { "lessThan": "7.84.0", "status": "unaffected", "version": "7.84.0", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "value": "When curl retrieves an HTTP response, it stores the incoming headers so that\nthey can be accessed later via the libcurl headers API.\n\nHowever, curl did not have a limit in how many or how large headers it would\naccept in a response, allowing a malicious server to stream an endless series\nof headers and eventually cause curl to run out of heap memory." } ], "providerMetadata": { "dateUpdated": "2023-09-15T03:21:54.348Z", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "url": "https://hackerone.com/reports/2072338" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/" }, { "url": "https://security.gentoo.org/glsa/202310-12" }, { "url": "https://security.netapp.com/advisory/ntap-20231013-0005/" }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/17" }, { "url": "https://support.apple.com/kb/HT214036" }, { "url": "https://www.insyde.com/security-pledge/SA-2023064" }, { "url": "https://support.apple.com/kb/HT214063" }, { "url": "https://support.apple.com/kb/HT214057" }, { "url": "https://support.apple.com/kb/HT214058" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/38" } ] } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2023-38039", "datePublished": "2023-09-15T03:21:54.348Z", "dateReserved": "2023-07-12T01:00:11.881Z", "dateUpdated": "2024-08-02T17:30:12.356Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23271
Vulnerability from cvelistv5
Published
2024-04-24 16:43
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, Safari 17.3, tvOS 17.3, macOS Sonoma 14.3, watchOS 10.3. A malicious website may cause unexpected cross-origin behavior.
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "ios", "vendor": "apple", "versions": [ { "status": "affected", "version": "*" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-23271", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-01T17:21:25.656286Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:45:53.010Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.112Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214056" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214056" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A logic issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, Safari 17.3, tvOS 17.3, macOS Sonoma 14.3, watchOS 10.3. A malicious website may cause unexpected cross-origin behavior." } ], "problemTypes": [ { "descriptions": [ { "description": "A malicious website may cause unexpected cross-origin behavior", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-04-24T16:43:43.625Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214056" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "https://support.apple.com/kb/HT214060" }, { "url": "https://support.apple.com/kb/HT214059" }, { "url": "https://support.apple.com/kb/HT214061" }, { "url": "https://support.apple.com/kb/HT214055" }, { "url": "https://support.apple.com/kb/HT214056" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23271", "datePublished": "2024-04-24T16:43:43.625Z", "dateReserved": "2024-01-12T22:22:21.498Z", "dateUpdated": "2024-08-01T22:59:32.112Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23208
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-10-21 10:25
Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to execute arbitrary code with kernel privileges.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.063Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-23208", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-02-06T05:00:11.545144Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-21T10:25:31.031Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to execute arbitrary code with kernel privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to execute arbitrary code with kernel privileges", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:28.334Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23208", "datePublished": "2024-01-23T00:25:28.334Z", "dateReserved": "2024-01-12T22:22:21.476Z", "dateUpdated": "2024-10-21T10:25:31.031Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23209
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3. Processing web content may lead to arbitrary code execution.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:31.869Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3. Processing web content may lead to arbitrary code execution." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing web content may lead to arbitrary code execution", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:25.374Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23209", "datePublished": "2024-01-23T00:25:25.374Z", "dateReserved": "2024-01-12T22:22:21.476Z", "dateUpdated": "2024-08-01T22:59:31.869Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-40528
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-10-21 10:27
Severity ?
EPSS score ?
Summary
This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An app may be able to bypass Privacy preferences.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T18:38:50.249Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT213938" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT213936" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT213940" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT213937" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213940" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213937" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213938" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213936" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-40528", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-21T10:26:32.063715Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-21T10:27:08.932Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An app may be able to bypass Privacy preferences." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to bypass Privacy preferences", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:18.752Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT213938" }, { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/en-us/HT213936" }, { "url": "https://support.apple.com/en-us/HT213940" }, { "url": "https://support.apple.com/en-us/HT213937" }, { "url": "https://support.apple.com/kb/HT213940" }, { "url": "https://support.apple.com/kb/HT213937" }, { "url": "https://support.apple.com/kb/HT213938" }, { "url": "https://support.apple.com/kb/HT213936" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-40528", "datePublished": "2024-01-23T00:25:18.752Z", "dateReserved": "2023-08-14T21:54:53.723Z", "dateUpdated": "2024-10-21T10:27:08.932Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23210
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-11-13 16:32
Severity ?
EPSS score ?
Summary
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to view a user's phone number in system logs.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:31.997Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-23210", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-13T16:32:19.377821Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-13T16:32:33.427Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to view a user\u0027s phone number in system logs." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to view a user\u0027s phone number in system logs", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:23.602Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23210", "datePublished": "2024-01-23T00:25:23.602Z", "dateReserved": "2024-01-12T22:22:21.476Z", "dateUpdated": "2024-11-13T16:32:33.427Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-42915
Vulnerability from cvelistv5
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{ "containers": { "cna": { "providerMetadata": { "dateUpdated": "2024-02-14T00:46:18.252Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "rejectedReasons": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority." } ], "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority." } ], "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-42915", "datePublished": "2024-01-23T00:25:19.706Z", "dateRejected": "2024-02-14T00:46:18.252Z", "dateReserved": "2023-09-14T19:05:11.463Z", "dateUpdated": "2024-02-14T00:46:18.252Z", "state": "REJECTED" }, "dataType": "CVE_RECORD", "dataVersion": "5.0" }
cve-2024-23203
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14.3, iOS 17.3 and iPadOS 17.3. A shortcut may be able to use sensitive data with certain actions without prompting the user.
References
Impacted products
Vendor | Product | Version | |||||
---|---|---|---|---|---|---|---|
▼ | Apple | iOS and iPadOS |
Version: unspecified < 17.3 |
||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:31.889Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214082" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214085" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Mar/22" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14.3, iOS 17.3 and iPadOS 17.3. A shortcut may be able to use sensitive data with certain actions without prompting the user." } ], "problemTypes": [ { "descriptions": [ { "description": "A shortcut may be able to use sensitive data with certain actions without prompting the user", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:33.071Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "https://support.apple.com/kb/HT214082" }, { "url": "https://support.apple.com/kb/HT214085" }, { "url": "http://seclists.org/fulldisclosure/2024/Mar/22" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23203", "datePublished": "2024-01-23T00:25:33.071Z", "dateReserved": "2024-01-12T22:22:21.475Z", "dateUpdated": "2024-08-01T22:59:31.889Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-42937
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-02 19:37
Severity ?
EPSS score ?
Summary
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. An app may be able to access sensitive user data.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:37:21.926Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214035" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214036" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214041" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214057" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214036" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214035" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214041" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/38" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.2", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "12.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:36.060Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214035" }, { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/en-us/HT214063" }, { "url": "https://support.apple.com/en-us/HT214036" }, { "url": "https://support.apple.com/en-us/HT214041" }, { "url": "https://support.apple.com/en-us/HT214057" }, { "url": "https://support.apple.com/kb/HT214036" }, { "url": "https://support.apple.com/kb/HT214035" }, { "url": "https://support.apple.com/kb/HT214041" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/38" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-42937", "datePublished": "2024-01-23T00:25:36.060Z", "dateReserved": "2023-09-14T19:05:11.471Z", "dateUpdated": "2024-08-02T19:37:21.926Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23206
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
An access issue was addressed with improved access restrictions. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. A maliciously crafted webpage may be able to fingerprint the user.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:31.757Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214056" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214056" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/27" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/40" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/02/05/8" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2VJMEDT4GL42AQVHSYOT6DIVJDZWIV4/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/US43EQFC2IS66EA2CPAZFH2RQ6WD7PKF/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An access issue was addressed with improved access restrictions. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. A maliciously crafted webpage may be able to fingerprint the user." } ], "problemTypes": [ { "descriptions": [ { "description": "A maliciously crafted webpage may be able to fingerprint the user", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:22.555Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214063" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214056" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "https://support.apple.com/kb/HT214060" }, { "url": "https://support.apple.com/kb/HT214063" }, { "url": "https://support.apple.com/kb/HT214059" }, { "url": "https://support.apple.com/kb/HT214061" }, { "url": "https://support.apple.com/kb/HT214055" }, { "url": "https://support.apple.com/kb/HT214056" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/27" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/40" }, { "url": "http://www.openwall.com/lists/oss-security/2024/02/05/8" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2VJMEDT4GL42AQVHSYOT6DIVJDZWIV4/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/US43EQFC2IS66EA2CPAZFH2RQ6WD7PKF/" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23206", "datePublished": "2024-01-23T00:25:22.555Z", "dateReserved": "2024-01-12T22:22:21.476Z", "dateUpdated": "2024-08-01T22:59:31.757Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-38545
Vulnerability from cvelistv5
Published
2023-10-18 03:52
Modified
2024-10-17 21:16
Severity ?
EPSS score ?
Summary
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
handshake.
When curl is asked to pass along the host name to the SOCKS5 proxy to allow
that to resolve the address instead of it getting done by curl itself, the
maximum length that host name can be is 255 bytes.
If the host name is detected to be longer, curl switches to local name
resolving and instead passes on the resolved address only. Due to this bug,
the local variable that means "let the host resolve the name" could get the
wrong value during a slow SOCKS5 handshake, and contrary to the intention,
copy the too long host name to the target buffer instead of copying just the
resolved address there.
The target buffer being a heap based buffer, and the host name coming from the
URL that curl has been told to operate with.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T17:46:56.235Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://curl.se/docs/CVE-2023-38545.html" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20231027-0009/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/" }, { "tags": [ "x_transferred" ], "url": "https://www.secpod.com/blog/high-severity-heap-buffer-overflow-vulnerability/" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214036" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214057" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214058" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/38" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240201-0005/" }, { "tags": [ "x_transferred" ], "url": "https://forum.vmssoftware.com/viewtopic.php?f=8\u0026t=8868" } ], "title": "CVE Program Container" }, { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2023-38545", "options": [ { "Exploitation": "PoC" }, { "Automatable": "No" }, { "Technical Impact": "Total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-17T21:11:03.346985Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-17T21:16:30.994Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "exploit" ], "url": "https://github.com/bcdannyboy/CVE-2023-38545" }, { "tags": [ "exploit" ], "url": "https://github.com/dbrugman/CVE-2023-38545-POC" }, { "tags": [ "exploit" ], "url": "https://github.com/UTsweetyfish/CVE-2023-38545" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "curl", "vendor": "curl", "versions": [ { "lessThan": "8.4.0", "status": "affected", "version": "8.4.0", "versionType": "semver" }, { "lessThan": "7.69.0", "status": "unaffected", "version": "7.69.0", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "value": "This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy\nhandshake.\n\nWhen curl is asked to pass along the host name to the SOCKS5 proxy to allow\nthat to resolve the address instead of it getting done by curl itself, the\nmaximum length that host name can be is 255 bytes.\n\nIf the host name is detected to be longer, curl switches to local name\nresolving and instead passes on the resolved address only. Due to this bug,\nthe local variable that means \"let the host resolve the name\" could get the\nwrong value during a slow SOCKS5 handshake, and contrary to the intention,\ncopy the too long host name to the target buffer instead of copying just the\nresolved address there.\n\nThe target buffer being a heap based buffer, and the host name coming from the\nURL that curl has been told to operate with.\n" } ], "providerMetadata": { "dateUpdated": "2023-10-18T03:52:00.816Z", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "url": "https://curl.se/docs/CVE-2023-38545.html" }, { "url": "https://security.netapp.com/advisory/ntap-20231027-0009/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/" }, { "url": "https://www.secpod.com/blog/high-severity-heap-buffer-overflow-vulnerability/" }, { "url": "https://support.apple.com/kb/HT214036" }, { "url": "https://support.apple.com/kb/HT214063" }, { "url": "https://support.apple.com/kb/HT214057" }, { "url": "https://support.apple.com/kb/HT214058" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/38" }, { "url": "https://security.netapp.com/advisory/ntap-20240201-0005/" }, { "url": "https://forum.vmssoftware.com/viewtopic.php?f=8\u0026t=8868" } ] } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2023-38545", "datePublished": "2023-10-18T03:52:00.816Z", "dateReserved": "2023-07-20T01:00:12.444Z", "dateUpdated": "2024-10-17T21:16:30.994Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23207
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-29 14:27
Severity ?
EPSS score ?
Summary
This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 10.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, macOS Monterey 12.7.3. An app may be able to access sensitive user data.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.005Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214058" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214057" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/38" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-23207", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-01-23T16:11:13.095021Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-29T14:27:04.095Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.6", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "12.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 10.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, macOS Monterey 12.7.3. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:21.694Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214058" }, { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "https://support.apple.com/en-us/HT214057" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/38" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23207", "datePublished": "2024-01-23T00:25:21.694Z", "dateReserved": "2024-01-12T22:22:21.476Z", "dateUpdated": "2024-08-29T14:27:04.095Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23213
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. Processing web content may lead to arbitrary code execution.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:31.836Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214056" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214056" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/27" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/40" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/02/05/8" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2VJMEDT4GL42AQVHSYOT6DIVJDZWIV4/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/US43EQFC2IS66EA2CPAZFH2RQ6WD7PKF/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. Processing web content may lead to arbitrary code execution." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing web content may lead to arbitrary code execution", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:24.505Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214063" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214056" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "https://support.apple.com/kb/HT214060" }, { "url": "https://support.apple.com/kb/HT214063" }, { "url": "https://support.apple.com/kb/HT214059" }, { "url": "https://support.apple.com/kb/HT214061" }, { "url": "https://support.apple.com/kb/HT214055" }, { "url": "https://support.apple.com/kb/HT214056" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/27" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/40" }, { "url": "http://www.openwall.com/lists/oss-security/2024/02/05/8" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2VJMEDT4GL42AQVHSYOT6DIVJDZWIV4/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/US43EQFC2IS66EA2CPAZFH2RQ6WD7PKF/" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23213", "datePublished": "2024-01-23T00:25:24.505Z", "dateReserved": "2024-01-12T22:22:21.477Z", "dateUpdated": "2024-08-01T22:59:31.836Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23223
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-11-13 16:31
Severity ?
EPSS score ?
Summary
A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to access sensitive user data.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.075Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214055" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-23223", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-13T16:30:05.074917Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-13T16:31:17.666Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:32.185Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214055" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/40" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23223", "datePublished": "2024-01-23T00:25:32.185Z", "dateReserved": "2024-01-12T22:22:21.478Z", "dateUpdated": "2024-11-13T16:31:17.666Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23211
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
A privacy issue was addressed with improved handling of user preferences. This issue is fixed in watchOS 10.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. A user's private browsing activity may be visible in Settings.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | iOS and iPadOS |
Version: unspecified < 17.3 |
||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.037Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214056" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214060" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/27" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/39" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "10.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A privacy issue was addressed with improved handling of user preferences. This issue is fixed in watchOS 10.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. A user\u0027s private browsing activity may be visible in Settings." } ], "problemTypes": [ { "descriptions": [ { "description": "A user\u0027s private browsing activity may be visible in Settings", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:20.675Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214063" }, { "url": "https://support.apple.com/en-us/HT214056" }, { "url": "https://support.apple.com/en-us/HT214060" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/27" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/39" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23211", "datePublished": "2024-01-23T00:25:20.675Z", "dateReserved": "2024-01-12T22:22:21.476Z", "dateUpdated": "2024-08-01T22:59:32.037Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-23214
Vulnerability from cvelistv5
Published
2024-01-23 00:25
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3. Processing maliciously crafted web content may lead to arbitrary code execution.
References
Impacted products
Vendor | Product | Version | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | iOS and iPadOS |
Version: unspecified < 17.3 |
||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:31.901Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT214061" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214059" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214061" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3. Processing maliciously crafted web content may lead to arbitrary code execution." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to arbitrary code execution", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-23T00:25:34.993Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT214059" }, { "url": "https://support.apple.com/en-us/HT214063" }, { "url": "https://support.apple.com/en-us/HT214061" }, { "url": "https://support.apple.com/kb/HT214063" }, { "url": "https://support.apple.com/kb/HT214059" }, { "url": "https://support.apple.com/kb/HT214061" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/33" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/36" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2024-23214", "datePublished": "2024-01-23T00:25:34.993Z", "dateReserved": "2024-01-12T22:22:21.477Z", "dateUpdated": "2024-08-01T22:59:31.901Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-38546
Vulnerability from cvelistv5
Published
2023-10-18 03:51
Modified
2024-09-13 15:02
Severity ?
EPSS score ?
Summary
This flaw allows an attacker to insert cookies at will into a running program
using libcurl, if the specific series of conditions are met.
libcurl performs transfers. In its API, an application creates "easy handles"
that are the individual handles for single transfers.
libcurl provides a function call that duplicates en easy handle called
[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).
If a transfer has cookies enabled when the handle is duplicated, the
cookie-enable state is also cloned - but without cloning the actual
cookies. If the source handle did not read any cookies from a specific file on
disk, the cloned version of the handle would instead store the file name as
`none` (using the four ASCII letters, no quotes).
Subsequent use of the cloned handle that does not explicitly set a source to
load cookies from would then inadvertently load cookies from a file named
`none` - if such a file exists and is readable in the current directory of the
program using libcurl. And if using the correct file format of course.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T17:46:55.785Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://curl.se/docs/CVE-2023-38546.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214036" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214063" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214057" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT214058" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2024/Jan/38" }, { "tags": [ "x_transferred" ], "url": "https://forum.vmssoftware.com/viewtopic.php?f=8\u0026t=8868" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2023-38546", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-09-13T15:01:53.358515Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-09-13T15:02:37.137Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "curl", "vendor": "curl", "versions": [ { "lessThan": "8.4.0", "status": "affected", "version": "8.4.0", "versionType": "semver" }, { "lessThan": "7.9.1", "status": "unaffected", "version": "7.9.1", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "value": "This flaw allows an attacker to insert cookies at will into a running program\nusing libcurl, if the specific series of conditions are met.\n\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\nthat are the individual handles for single transfers.\n\nlibcurl provides a function call that duplicates en easy handle called\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\n\nIf a transfer has cookies enabled when the handle is duplicated, the\ncookie-enable state is also cloned - but without cloning the actual\ncookies. If the source handle did not read any cookies from a specific file on\ndisk, the cloned version of the handle would instead store the file name as\n`none` (using the four ASCII letters, no quotes).\n\nSubsequent use of the cloned handle that does not explicitly set a source to\nload cookies from would then inadvertently load cookies from a file named\n`none` - if such a file exists and is readable in the current directory of the\nprogram using libcurl. And if using the correct file format of course.\n" } ], "providerMetadata": { "dateUpdated": "2023-10-18T03:51:31.276Z", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone" }, "references": [ { "url": "https://curl.se/docs/CVE-2023-38546.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/" }, { "url": "https://support.apple.com/kb/HT214036" }, { "url": "https://support.apple.com/kb/HT214063" }, { "url": "https://support.apple.com/kb/HT214057" }, { "url": "https://support.apple.com/kb/HT214058" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/34" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/37" }, { "url": "http://seclists.org/fulldisclosure/2024/Jan/38" }, { "url": "https://forum.vmssoftware.com/viewtopic.php?f=8\u0026t=8868" } ] } }, "cveMetadata": { "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2023-38546", "datePublished": "2023-10-18T03:51:31.276Z", "dateReserved": "2023-07-20T01:00:12.444Z", "dateUpdated": "2024-09-13T15:02:37.137Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.