Summary
Apple heeft kwetsbaarheden verholpen in iOS en iPadOS.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Cross-Site-Scripting (XSS)
- Denial-of-Service (DoS)
- Manipulatie van gegevens
- Omzeilen van beveiligingsmaatregel
- Toegang tot gevoelige gegevens
- Toegang tot systeemgegevens
Voor succesvol misbruik moet de kwaadwillende fysieke toegang hebben tot het kwetsbare apparaat, het slachtoffer misleiden een malafide app te installeren en draaien of een malafide link te volgen.
Oplossingen
Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen in iOS en iPadOS 17.7 en 18. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 36
-
Critical 9.1
OpenEXR Heap Overflow in Scanline Deep Data Parsing
Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This …
-
High 8.1CVE-2024-27876 Public exploit
A race condition was addressed with improved locking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadO…
-
High 8.1
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15…
-
High 8.1
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPad…
-
High 7.7
This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An app may gai…
-
High 7.5
The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may…
-
High 7.5
This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A remote attac…
-
High 7.5
The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS…
-
High 7.5
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18…
-
High 7.5
An integrity issue was addressed with Beacon Protection. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15,…
-
High 7.5
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18…
-
High 7.1
This issue was addressed with improved checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS…
-
Medium 6.5
This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A malicious Bl…
-
Medium 6.5
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. Thi…
-
Medium 6.1
A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequo…
-
Medium 6.1
This issue was addressed through improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, mac…
-
Medium 5.5
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17…
-
Medium 5.5
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.7 and iPadOS 17.…
-
Medium 5.5
A file access issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS …
-
Medium 5.5
This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able…
-
Medium 5.5
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequo…
-
Medium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.7 and iPadOS 1…
-
Medium 5.5
A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 18 and iPa…
-
Medium 5.5
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.7 and iPadOS 1…
-
Medium 5.5
A logic error was addressed with improved error handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and i…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18…
-
Medium 5.5
This issue was addressed through improved state management. This issue is fixed in Xcode 16, iOS 17.7 and iPadOS 17.7, …
-
Medium 5.5
An integer overflow was addressed through improved input validation. This issue is fixed in iOS 18 and iPadOS 18, macOS…
-
Medium 5.3
This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and…
-
Medium 5.3
An authentication issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPad…
-
Medium 4.6
This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An attacker wi…
-
Medium 4.6
This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7 and…
-
Low 3.3
This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able…
-
Low 2.4
The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical ac…
-
Low 2.4
The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical ac…
Revision history
-
#0
Initiele versie
References
-
Reference - certbundde; cveprojectv5; hkcert; nvd
https://support.apple.com/en-us/121250
-
Reference - certbundde; cveprojectv5; hkcert; nvd
https://support.apple.com/en-us/121246