Medium WID-SEC-2024-2155 5 CVEs

Apple Safari: Mehrere Schwachstellen

Published Sep 16, 2024 · Updated Oct 28, 2024 · Revision 2 · de-DE

Vendor: Apple Product: Safari

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple Safari ausnutzen, um beliebigen Programmcode auszuführen, Cross-Site-Scripting (XSS) und Spoofing-Angriffe durchzuführen.

Product

Safari ist der auf Apple Geräten eingesetzte Web Browser.

Vulnerabilities 5

Medium 6.5

CVE-2024-40866

The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious webs…

Apple macOS Safari qtwebkit-source macOS Browsers Debian Ubuntu

Sep 16, 2024
Medium 6.5

CVE-2024-44155

A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 18, iOS …

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers

Oct 28, 2024
Medium 6.5

CVE-2024-44187

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. Thi…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu

Sep 16, 2024
Medium 6.1

CVE-2024-40857

This issue was addressed through improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, mac…

Apple macOS iOS and iPadOS watchOS macOS iOS Browsers

Sep 16, 2024
Medium 5.3

CVE-2024-44202

An authentication issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPad…

Apple iOS and iPadOS Safari iOS Browsers

Sep 16, 2024

Revision history

2024-10-28 #2
CVE's ergänzt
2024-09-16 #1
Initiale Fassung

References

About the security content of Safari 18 vom 2024-09-16
https://support.apple.com/en-us/121241
APPLE-SA-09-16-2024-6 Safari 18 vom 2024-09-16
https://lists.apple.com/archives/security-announce/2024/Sep/msg00005.html