Summary
Apple heeft kwetsbaarheden verholpen in AirPlay, zoals gebruikt in diverse Apple-producten waaronder macOS, iOS en iPadOS.
Details
Interpretaties
De kwetsbaarheden worden misbruikt voor het veroorzaken van een Denial-of-Service, het omzeilen van authenticatie en het uitvoeren van willekeurige code. Hiertoe dient de kwaadwillende via AirPlay vanaf een lokaal netwerk malafide content naar een kwetsbaar systeem te sturen.
De kwetsbaarheden zijn ontdekt door onderzoekers van beveiligingsbedrijf Oligo. De onderzoekers geven aan dat de kwetsbaarheden achtereenvolgens kunnen worden misbruikt voor het uitvoeren van malafide code op een systeem, zonder dat hiervoor authenticatie is vereist.
Oplossingen
Apple heeft op 31 maart updates uitgebracht om de kwetsbaarheden te verhelpen in verschillende versies van macOS, iOS en iPadOS. Ook zijn updates uigebracht voor tvOS en AirPlay SDK's. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 13
-
Critical 9.8
An input validation issue was addressed. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, macOS Son…
-
High 8.8CVE-2025-24252 Public exploit
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.4 and iPadOS 18.4, …
-
High 7.7
An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, …
-
High 7.5
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequo…
-
High 7.5
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.…
-
Medium 6.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, …
-
Medium 6.5
The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Seq…
-
Medium 6.5
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7…
-
Medium 5.7
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.…
-
Medium 5.7
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.…
-
Medium 5.7
The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Seq…
-
Medium 5.5
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.…
-
Medium 5.4CVE-2025-24271 Public exploit
An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadO…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference - certbundde; cveprojectv5; nvd
https://support.apple.com/en-us/122371
-
Reference - certbundde; cveprojectv5; nvd
https://support.apple.com/en-us/122372
-
Reference - certbundde; cveprojectv5; nvd
https://support.apple.com/en-us/122373
-
Reference - certbundde; cveprojectv5; nvd
https://support.apple.com/en-us/122374
-
Reference - certbundde; cveprojectv5; nvd
https://support.apple.com/en-us/122375
-
Reference - cveprojectv5; nvd
https://support.apple.com/en-us/122377
-
Reference - ncscclear
https://support.apple.com/en-us/122403
-
Reference - ncscclear
https://www.oligo.security/blog/airborne