Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2024-AVI-1072
Vulnerability from certfr_avis - Published: 2024-12-12 - Updated: 2024-12-12
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | iOS | iOS versions antérieures à 18.2 | ||
| Apple | watchOS | watchOS versions antérieures à 11.2 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.7.2 | ||
| Apple | tvOS | tvOS versions antérieures à 18.2 | ||
| Apple | iPadOS | iPadOS versions antérieures à 18.2 | ||
| Apple | iPadOS | iPadOS versions antérieures à 17.7.3 | ||
| Apple | visionOS | visionOS versions antérieures à 2.2 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.2 | ||
| Apple | Safari | Safari versions antérieures à 18.2 | ||
| Apple | macOS | macOS Ventura versions antérieures à 13.7.2 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iOS\u00a0versions ant\u00e9rieures \u00e0 18.2",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS\u00a0versions ant\u00e9rieures \u00e0 11.2",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS\u00a0Sonoma\u00a0versions ant\u00e9rieures \u00e0 14.7.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS\u00a0versions ant\u00e9rieures \u00e0 18.2",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS\u00a0 versions ant\u00e9rieures \u00e0 18.2",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS\u00a0 versions ant\u00e9rieures \u00e0 17.7.3",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS\u00a0versions ant\u00e9rieures \u00e0 2.2",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS\u00a0Sequoia\u00a0versions ant\u00e9rieures \u00e0 15.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 18.2",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS\u00a0Ventura\u00a0versions ant\u00e9rieures \u00e0 13.7.2",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-54513",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54513"
},
{
"name": "CVE-2024-54508",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54508"
},
{
"name": "CVE-2024-54502",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54502"
},
{
"name": "CVE-2024-54515",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54515"
},
{
"name": "CVE-2024-44243",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44243"
},
{
"name": "CVE-2024-54505",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54505"
},
{
"name": "CVE-2024-54529",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54529"
},
{
"name": "CVE-2024-54498",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54498"
},
{
"name": "CVE-2024-54479",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54479"
},
{
"name": "CVE-2024-44224",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44224"
},
{
"name": "CVE-2024-54495",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54495"
},
{
"name": "CVE-2024-54514",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54514"
},
{
"name": "CVE-2024-54526",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54526"
},
{
"name": "CVE-2023-32395",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32395"
},
{
"name": "CVE-2024-54477",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54477"
},
{
"name": "CVE-2024-54506",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54506"
},
{
"name": "CVE-2024-54485",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54485"
},
{
"name": "CVE-2024-44225",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44225"
},
{
"name": "CVE-2024-54486",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54486"
},
{
"name": "CVE-2024-54490",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54490"
},
{
"name": "CVE-2024-54489",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54489"
},
{
"name": "CVE-2024-45490",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45490"
},
{
"name": "CVE-2024-54500",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54500"
},
{
"name": "CVE-2024-54465",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54465"
},
{
"name": "CVE-2024-54484",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54484"
},
{
"name": "CVE-2024-44248",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44248"
},
{
"name": "CVE-2024-54466",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54466"
},
{
"name": "CVE-2024-44246",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44246"
},
{
"name": "CVE-2024-54531",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54531"
},
{
"name": "CVE-2024-54493",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54493"
},
{
"name": "CVE-2024-54494",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54494"
},
{
"name": "CVE-2024-54476",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54476"
},
{
"name": "CVE-2024-54528",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54528"
},
{
"name": "CVE-2024-44220",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44220"
},
{
"name": "CVE-2024-54503",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54503"
},
{
"name": "CVE-2024-44201",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44201"
},
{
"name": "CVE-2024-44300",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44300"
},
{
"name": "CVE-2024-54491",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54491"
},
{
"name": "CVE-2024-54510",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54510"
},
{
"name": "CVE-2024-54504",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54504"
},
{
"name": "CVE-2024-54474",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54474"
},
{
"name": "CVE-2024-44291",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44291"
},
{
"name": "CVE-2024-54534",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54534"
},
{
"name": "CVE-2024-54527",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54527"
},
{
"name": "CVE-2024-44245",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44245"
},
{
"name": "CVE-2024-54524",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54524"
},
{
"name": "CVE-2024-54501",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54501"
},
{
"name": "CVE-2024-54492",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54492"
}
],
"initial_release_date": "2024-12-12T00:00:00",
"last_revision_date": "2024-12-12T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-1072",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-12-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121845",
"url": "https://support.apple.com/en-us/121845"
},
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121837",
"url": "https://support.apple.com/en-us/121837"
},
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121840",
"url": "https://support.apple.com/en-us/121840"
},
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121846",
"url": "https://support.apple.com/en-us/121846"
},
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121839",
"url": "https://support.apple.com/en-us/121839"
},
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121838",
"url": "https://support.apple.com/en-us/121838"
},
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121842",
"url": "https://support.apple.com/en-us/121842"
},
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121843",
"url": "https://support.apple.com/en-us/121843"
},
{
"published_at": "2024-12-11",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121844",
"url": "https://support.apple.com/en-us/121844"
}
]
}
CVE-2024-54486 (GCVE-0-2024-54486)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:56 – Updated: 2026-04-02 18:08
VLAI
EPSS
Summary
The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted font may result in the disclosure of process memory.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Processing a maliciously crafted font may result in the disclosure of process memory
- CWE-noinfo Not enough information
Assigner
References
13 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 18.2
(custom)
|
|
| Apple | iPadOS |
Affected:
0 , < 17.7.3
(custom)
|
|
| Apple | macOS |
Affected:
0 , < 13.7.2
(custom)
Affected: 0 , < 14.7.2 (custom) Affected: 0 , < 15.2 (custom) |
|
| Apple | tvOS |
Affected:
0 , < 18.2
(custom)
|
|
| Apple | visionOS |
Affected:
0 , < 2.2
(custom)
|
|
| Apple | watchOS |
Affected:
0 , < 11.2
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54486",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-20T19:03:28.757464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-20T19:03:33.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:24.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/8"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "17.7.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "11.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted font may result in the disclosure of process memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing a maliciously crafted font may result in the disclosure of process memory",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:08:21.515Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121837"
},
{
"url": "https://support.apple.com/en-us/121838"
},
{
"url": "https://support.apple.com/en-us/121839"
},
{
"url": "https://support.apple.com/en-us/121840"
},
{
"url": "https://support.apple.com/en-us/121842"
},
{
"url": "https://support.apple.com/en-us/121843"
},
{
"url": "https://support.apple.com/en-us/121844"
},
{
"url": "https://support.apple.com/en-us/121845"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54486",
"datePublished": "2024-12-11T22:56:57.968Z",
"dateReserved": "2024-12-03T22:50:35.496Z",
"dateUpdated": "2026-04-02T18:08:21.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54489 (GCVE-0-2024-54489)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:59 – Updated: 2026-04-02 18:26
VLAI
EPSS
Summary
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. Running a mount command may unexpectedly execute arbitrary code.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Running a mount command may unexpectedly execute arbitrary code
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54489",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-13T18:16:18.051617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-13T18:18:00.800Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:28.609Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/9"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/8"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. Running a mount command may unexpectedly execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Running a mount command may unexpectedly execute arbitrary code",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:26:25.827Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121839"
},
{
"url": "https://support.apple.com/en-us/121840"
},
{
"url": "https://support.apple.com/en-us/121842"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54489",
"datePublished": "2024-12-11T22:59:19.485Z",
"dateReserved": "2024-12-03T22:50:35.497Z",
"dateUpdated": "2026-04-02T18:26:25.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54490 (GCVE-0-2024-54490)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:56 – Updated: 2026-04-02 18:08
VLAI
EPSS
Summary
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2. A local attacker may gain access to user's Keychain items.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- A local attacker may gain access to user's Keychain items
- CWE-346 - Origin Validation Error
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54490",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-12T21:47:37.571183Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-12T21:48:30.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:31.558Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2. A local attacker may gain access to user\u0027s Keychain items."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A local attacker may gain access to user\u0027s Keychain items",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:08:44.545Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121839"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54490",
"datePublished": "2024-12-11T22:56:58.627Z",
"dateReserved": "2024-12-03T22:50:35.497Z",
"dateUpdated": "2026-04-02T18:08:44.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54491 (GCVE-0-2024-54491)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:57 – Updated: 2026-04-02 18:10
VLAI
EPSS
Summary
The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. A malicious application may be able to determine a user's current location.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- A malicious application may be able to determine a user's current location
- CWE-noinfo Not enough information
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54491",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-20T18:59:28.451615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-20T19:00:33.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:33.179Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. A malicious application may be able to determine a user\u0027s current location."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A malicious application may be able to determine a user\u0027s current location",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:10:38.923Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121839"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54491",
"datePublished": "2024-12-11T22:57:26.436Z",
"dateReserved": "2024-12-03T22:50:35.497Z",
"dateUpdated": "2026-04-02T18:10:38.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54492 (GCVE-0-2024-54492)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:59 – Updated: 2026-04-02 18:24
VLAI
EPSS
Summary
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, visionOS 2.2. An attacker in a privileged network position may be able to alter network traffic.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- An attacker in a privileged network position may be able to alter network traffic
- CWE-noinfo Not enough information
Assigner
References
7 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-12T15:21:50.565853Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-12T15:24:06.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:37.640Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "17.7.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, visionOS 2.2. An attacker in a privileged network position may be able to alter network traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An attacker in a privileged network position may be able to alter network traffic",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:24:25.790Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121837"
},
{
"url": "https://support.apple.com/en-us/121838"
},
{
"url": "https://support.apple.com/en-us/121839"
},
{
"url": "https://support.apple.com/en-us/121845"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54492",
"datePublished": "2024-12-11T22:59:01.815Z",
"dateReserved": "2024-12-03T22:50:35.497Z",
"dateUpdated": "2026-04-02T18:24:25.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54493 (GCVE-0-2024-54493)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:59 – Updated: 2026-04-02 18:25
VLAI
EPSS
Summary
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2. Privacy indicators for microphone access may be attributed incorrectly.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Privacy indicators for microphone access may be attributed incorrectly
- CWE-noinfo Not enough information
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-16T17:32:26.217228Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T17:48:17.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:39.081Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2. Privacy indicators for microphone access may be attributed incorrectly."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Privacy indicators for microphone access may be attributed incorrectly",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:25:35.480Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121839"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54493",
"datePublished": "2024-12-11T22:59:09.625Z",
"dateReserved": "2024-12-03T22:50:35.497Z",
"dateUpdated": "2026-04-02T18:25:35.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54494 (GCVE-0-2024-54494)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:58 – Updated: 2026-04-02 18:18
VLAI
EPSS
Summary
A race condition was addressed with additional validation. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. An attacker may be able to create a read-only memory mapping that can be written to.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- An attacker may be able to create a read-only memory mapping that can be written to
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
13 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 18.2
(custom)
|
|
| Apple | iPadOS |
Affected:
0 , < 17.7.3
(custom)
|
|
| Apple | macOS |
Affected:
0 , < 13.7.2
(custom)
Affected: 0 , < 14.7.2 (custom) Affected: 0 , < 15.2 (custom) |
|
| Apple | tvOS |
Affected:
0 , < 18.2
(custom)
|
|
| Apple | visionOS |
Affected:
0 , < 2.2
(custom)
|
|
| Apple | watchOS |
Affected:
0 , < 11.2
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-16T18:44:52.608510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-16T18:45:38.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:48.518Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/8"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "17.7.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "11.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A race condition was addressed with additional validation. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. An attacker may be able to create a read-only memory mapping that can be written to."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An attacker may be able to create a read-only memory mapping that can be written to",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:18:22.370Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121837"
},
{
"url": "https://support.apple.com/en-us/121838"
},
{
"url": "https://support.apple.com/en-us/121839"
},
{
"url": "https://support.apple.com/en-us/121840"
},
{
"url": "https://support.apple.com/en-us/121842"
},
{
"url": "https://support.apple.com/en-us/121843"
},
{
"url": "https://support.apple.com/en-us/121844"
},
{
"url": "https://support.apple.com/en-us/121845"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54494",
"datePublished": "2024-12-11T22:58:11.683Z",
"dateReserved": "2024-12-03T22:50:35.497Z",
"dateUpdated": "2026-04-02T18:18:22.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54495 (GCVE-0-2024-54495)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:58 – Updated: 2026-04-02 18:21
VLAI
EPSS
Summary
The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to modify protected parts of the file system.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- An app may be able to modify protected parts of the file system
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-12T15:47:21.791838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-12T15:49:14.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:51.427Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/8"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "14.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to modify protected parts of the file system."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to modify protected parts of the file system",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:21:42.954Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121839"
},
{
"url": "https://support.apple.com/en-us/121840"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54495",
"datePublished": "2024-12-11T22:58:23.672Z",
"dateReserved": "2024-12-03T22:50:35.498Z",
"dateUpdated": "2026-04-02T18:21:42.954Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54498 (GCVE-0-2024-54498)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:58 – Updated: 2026-04-02 18:19
VLAI
EPSS
Summary
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to break out of its sandbox.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- An app may be able to break out of its sandbox
- CWE-noinfo Not enough information
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54498",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-21T04:56:11.314Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:30:54.344Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/9"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to break out of its sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to break out of its sandbox",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:19:36.157Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121839"
},
{
"url": "https://support.apple.com/en-us/121840"
},
{
"url": "https://support.apple.com/en-us/121842"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54498",
"datePublished": "2024-12-11T22:58:15.810Z",
"dateReserved": "2024-12-03T22:50:35.499Z",
"dateUpdated": "2026-04-02T18:19:36.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54500 (GCVE-0-2024-54500)
Vulnerability from cvelistv5 – Published: 2024-12-11 22:57 – Updated: 2026-04-02 18:09
VLAI
EPSS
Summary
The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted image may result in disclosure of process memory.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Processing a maliciously crafted image may result in disclosure of process memory
- CWE-noinfo Not enough information
Assigner
References
13 references
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 18.2
(custom)
|
|
| Apple | iPadOS |
Affected:
0 , < 17.7.3
(custom)
|
|
| Apple | macOS |
Affected:
0 , < 13.7.2
(custom)
Affected: 0 , < 14.7.2 (custom) Affected: 0 , < 15.2 (custom) |
|
| Apple | tvOS |
Affected:
0 , < 18.2
(custom)
|
|
| Apple | visionOS |
Affected:
0 , < 2.2
(custom)
|
|
| Apple | watchOS |
Affected:
0 , < 11.2
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-54500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-20T19:00:47.386136Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-20T19:01:24.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:31:02.107Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/9"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/7"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Dec/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "17.7.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "11.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted image may result in disclosure of process memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing a maliciously crafted image may result in disclosure of process memory",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:09:16.567Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121837"
},
{
"url": "https://support.apple.com/en-us/121838"
},
{
"url": "https://support.apple.com/en-us/121839"
},
{
"url": "https://support.apple.com/en-us/121840"
},
{
"url": "https://support.apple.com/en-us/121842"
},
{
"url": "https://support.apple.com/en-us/121843"
},
{
"url": "https://support.apple.com/en-us/121844"
},
{
"url": "https://support.apple.com/en-us/121845"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-54500",
"datePublished": "2024-12-11T22:57:16.525Z",
"dateReserved": "2024-12-03T22:50:35.499Z",
"dateUpdated": "2026-04-02T18:09:16.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…