Vulnerability-Lookup

NCSC-2024-0487

Vulnerability from csaf_ncscnl - Published: 2024-12-12 10:30 - Updated: 2024-12-12 10:30

Summary

Kwetsbaarheden verholpen in Apple iPadOS en iOS

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten: Apple heeft kwetsbaarheden verholpen in iPadOS (Specifiek voor versies 17.7.3 en 18.2) en iOS (Specifiek voor 18.2).

Interpretaties: De kwetsbaarheden omvatten onder andere een denial-of-service probleem, logica-issues die ongeautoriseerde privilege-escalatie mogelijk maakten, en onverwachte systeemterminaties door geheugen-corruptie. Deze kwetsbaarheden konden worden misbruikt door kwaadwillenden via het verwerken van kwaadwillig vervaardigde bestanden, webinhoud of afbeeldingen. De updates verbeteren de algehele stabiliteit en beveiliging van de systemen door verbeterde geheugenbeheertechnieken en validatiecontroles te implementeren.

Oplossingen: Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans: medium

Schade: high

CWE-131: Incorrect Calculation of Buffer Size

CWE-265: CWE-265

CWE-190: Integer Overflow or Wraparound

CWE-275: CWE-275

CWE-284: Improper Access Control

CWE-611: Improper Restriction of XML External Entity Reference

CVE-2024-44201

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
ipados apple	`cpe:2.3:a:apple:ipados::::::::`	—
ios_and_ipados apple	`cpe:2.3:a:apple:ios_and_ipados::::::::`	—

CVE-2024-44225

Affected products

Known affected 3 products

Product	Identifier	Version
ipados apple	`cpe:2.3:a:apple:ipados::::::::`	—
ios_and_ipados apple	`cpe:2.3:a:apple:ios_and_ipados::::::::`	—
ios apple	`cpe:2.3:a:apple:ios::::::::`	—

CVE-2024-44245

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-44246

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-45490

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
ipados apple	`cpe:2.3:a:apple:ipados::::::::`	—
ios apple	`cpe:2.3:a:apple:ios::::::::`	—

CVE-2024-54479

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54485

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54486

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54492

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54494

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54500

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54501

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54502

Affected products

Known affected 3 products

Product	Identifier	Version
ios_and_ipados apple	`cpe:2.3:a:apple:ios_and_ipados::::::::`	—
ios apple	`cpe:2.3:a:apple:ios::::::::`	—
ipados apple	`cpe:2.3:a:apple:ipados::::::::`	—

CVE-2024-54503

Affected products

Known affected 3 products, the same list as for CVE-2024-54502

CVE-2024-54505

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54508

Affected products

Known affected 3 products, the same list as for CVE-2024-54502

CVE-2024-54510

Affected products

Known affected 3 products, the same list as for CVE-2024-44225

CVE-2024-54513

CWE-275 - -

Affected products

Known affected 3 products, the same list as for CVE-2024-54502

CVE-2024-54514

CWE-265 - -

Affected products

Known affected 3 products, the same list as for CVE-2024-54502

CVE-2024-54526

CWE-284 - Improper Access Control

Affected products

Known affected 3 products, the same list as for CVE-2024-54502

CVE-2024-54527

CWE-284 - Improper Access Control

Affected products

Known affected 3 products, the same list as for CVE-2024-54502

CVE-2024-54534

Affected products

Known affected 3 products, the same list as for CVE-2024-54502

References

24 references

URL	Category
https://support.apple.com/en-us/121838	external
https://support.apple.com/en-us/121837	external
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self
https://api.ncsc.nl/velma/v1/vulnerabilities/2024…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Apple heeft kwetsbaarheden verholpen in iPadOS (Specifiek voor versies 17.7.3 en 18.2) en iOS (Specifiek voor 18.2).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden omvatten onder andere een denial-of-service probleem, logica-issues die ongeautoriseerde privilege-escalatie mogelijk maakten, en onverwachte systeemterminaties door geheugen-corruptie. Deze kwetsbaarheden konden worden misbruikt door kwaadwillenden via het verwerken van kwaadwillig vervaardigde bestanden, webinhoud of afbeeldingen. De updates verbeteren de algehele stabiliteit en beveiliging van de systemen door verbeterde geheugenbeheertechnieken en validatiecontroles te implementeren.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Incorrect Calculation of Buffer Size",
        "title": "CWE-131"
      },
      {
        "category": "general",
        "text": "CWE-265",
        "title": "CWE-265"
      },
      {
        "category": "general",
        "text": "Integer Overflow or Wraparound",
        "title": "CWE-190"
      },
      {
        "category": "general",
        "text": "CWE-275",
        "title": "CWE-275"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improper Restriction of XML External Entity Reference",
        "title": "CWE-611"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; nvd",
        "url": "https://support.apple.com/en-us/121838"
      },
      {
        "category": "external",
        "summary": "Reference - cveprojectv5; nvd",
        "url": "https://support.apple.com/en-us/121837"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Apple iPadOS en iOS",
    "tracking": {
      "current_release_date": "2024-12-12T10:30:17.550009Z",
      "id": "NCSC-2024-0487",
      "initial_release_date": "2024-12-12T10:30:17.550009Z",
      "revision_history": [
        {
          "date": "2024-12-12T10:30:17.550009Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "ios_and_ipados",
            "product": {
              "name": "ios_and_ipados",
              "product_id": "CSAFPID-551327",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ipados",
            "product": {
              "name": "ipados",
              "product_id": "CSAFPID-1691048",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:apple:ipados:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ios",
            "product": {
              "name": "ios",
              "product_id": "CSAFPID-548768",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:apple:ios:*:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "apple"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-44201",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-44201",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-44201.json"
        }
      ],
      "title": "CVE-2024-44201"
    },
    {
      "cve": "CVE-2024-44225",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-44225",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-44225.json"
        }
      ],
      "title": "CVE-2024-44225"
    },
    {
      "cve": "CVE-2024-44245",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-44245",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-44245.json"
        }
      ],
      "title": "CVE-2024-44245"
    },
    {
      "cve": "CVE-2024-44246",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-44246",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-44246.json"
        }
      ],
      "title": "CVE-2024-44246"
    },
    {
      "cve": "CVE-2024-45490",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "other",
          "text": "Incorrect Calculation of Buffer Size",
          "title": "CWE-131"
        },
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45490",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-45490.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1691048",
            "CSAFPID-548768"
          ]
        }
      ],
      "title": "CVE-2024-45490"
    },
    {
      "cve": "CVE-2024-54479",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54479",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54479.json"
        }
      ],
      "title": "CVE-2024-54479"
    },
    {
      "cve": "CVE-2024-54485",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54485",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54485.json"
        }
      ],
      "title": "CVE-2024-54485"
    },
    {
      "cve": "CVE-2024-54486",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54486",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54486.json"
        }
      ],
      "title": "CVE-2024-54486"
    },
    {
      "cve": "CVE-2024-54492",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54492",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54492.json"
        }
      ],
      "title": "CVE-2024-54492"
    },
    {
      "cve": "CVE-2024-54494",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54494",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54494.json"
        }
      ],
      "title": "CVE-2024-54494"
    },
    {
      "cve": "CVE-2024-54500",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54500",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54500.json"
        }
      ],
      "title": "CVE-2024-54500"
    },
    {
      "cve": "CVE-2024-54501",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54501",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54501.json"
        }
      ],
      "title": "CVE-2024-54501"
    },
    {
      "cve": "CVE-2024-54502",
      "product_status": {
        "known_affected": [
          "CSAFPID-551327",
          "CSAFPID-548768",
          "CSAFPID-1691048"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54502",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54502.json"
        }
      ],
      "title": "CVE-2024-54502"
    },
    {
      "cve": "CVE-2024-54503",
      "product_status": {
        "known_affected": [
          "CSAFPID-551327",
          "CSAFPID-548768",
          "CSAFPID-1691048"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54503",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54503.json"
        }
      ],
      "title": "CVE-2024-54503"
    },
    {
      "cve": "CVE-2024-54505",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54505",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54505.json"
        }
      ],
      "title": "CVE-2024-54505"
    },
    {
      "cve": "CVE-2024-54508",
      "product_status": {
        "known_affected": [
          "CSAFPID-551327",
          "CSAFPID-548768",
          "CSAFPID-1691048"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54508",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54508.json"
        }
      ],
      "title": "CVE-2024-54508"
    },
    {
      "cve": "CVE-2024-54510",
      "product_status": {
        "known_affected": [
          "CSAFPID-1691048",
          "CSAFPID-551327",
          "CSAFPID-548768"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54510",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54510.json"
        }
      ],
      "title": "CVE-2024-54510"
    },
    {
      "cve": "CVE-2024-54513",
      "cwe": {
        "id": "CWE-275",
        "name": "-"
      },
      "notes": [
        {
          "category": "other",
          "text": "CWE-275",
          "title": "CWE-275"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-551327",
          "CSAFPID-548768",
          "CSAFPID-1691048"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54513",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54513.json"
        }
      ],
      "title": "CVE-2024-54513"
    },
    {
      "cve": "CVE-2024-54514",
      "cwe": {
        "id": "CWE-265",
        "name": "-"
      },
      "notes": [
        {
          "category": "other",
          "text": "CWE-265",
          "title": "CWE-265"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-551327",
          "CSAFPID-548768",
          "CSAFPID-1691048"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54514",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54514.json"
        }
      ],
      "title": "CVE-2024-54514"
    },
    {
      "cve": "CVE-2024-54526",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-551327",
          "CSAFPID-548768",
          "CSAFPID-1691048"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54526",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54526.json"
        }
      ],
      "title": "CVE-2024-54526"
    },
    {
      "cve": "CVE-2024-54527",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-551327",
          "CSAFPID-548768",
          "CSAFPID-1691048"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54527",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54527.json"
        }
      ],
      "title": "CVE-2024-54527"
    },
    {
      "cve": "CVE-2024-54534",
      "product_status": {
        "known_affected": [
          "CSAFPID-551327",
          "CSAFPID-548768",
          "CSAFPID-1691048"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-54534",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54534.json"
        }
      ],
      "title": "CVE-2024-54534"
    }
  ]
}

CVE-2024-54527 (GCVE-0-2024-54527)

Vulnerability from cvelistv5 – Published: 2024-12-11 22:58 – Updated: 2026-04-02 18:15

Summary

This issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, watchOS 11.2. An app may be able to access sensitive user data.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-16 18:48 UTC

CWE

An app may be able to access sensitive user data
CWE-noinfo Not enough information

Assigner

apple CNA under the mitre root

CNA scorecard E 37/100 over 907 records in the last 180 days details

References

10 references

URL	Tags
https://support.apple.com/en-us/121837
https://support.apple.com/en-us/121839
https://support.apple.com/en-us/121840
https://support.apple.com/en-us/121842
https://support.apple.com/en-us/121843
https://support.apple.com/en-us/121844
http://seclists.org/fulldisclosure/2024/Dec/11
http://seclists.org/fulldisclosure/2024/Dec/9
http://seclists.org/fulldisclosure/2024/Dec/7
http://seclists.org/fulldisclosure/2024/Dec/5

Impacted products

4 products

Vendor	Product	Version
Apple	iOS and iPadOS	Affected: 0 , < 18.2 (custom)
Apple	macOS	Affected: 0 , < 13.7.2 (custom) Affected: 0 , < 14.7.2 (custom) Affected: 0 , < 15.2 (custom)
Apple	tvOS	Affected: 0 , < 18.2 (custom)
Apple	watchOS	Affected: 0 , < 11.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-54527",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-16T18:48:21.198164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-16T18:48:36.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:32:09.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/11"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/9"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/7"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "13.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.7.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, watchOS 11.2. An app may be able to access sensitive user data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "An app may be able to access sensitive user data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:15:59.972Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121837"
        },
        {
          "url": "https://support.apple.com/en-us/121839"
        },
        {
          "url": "https://support.apple.com/en-us/121840"
        },
        {
          "url": "https://support.apple.com/en-us/121842"
        },
        {
          "url": "https://support.apple.com/en-us/121843"
        },
        {
          "url": "https://support.apple.com/en-us/121844"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-54527",
    "datePublished": "2024-12-11T22:58:05.841Z",
    "dateReserved": "2024-12-03T22:50:35.505Z",
    "dateUpdated": "2026-04-02T18:15:59.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-54534 (GCVE-0-2024-54534)

Vulnerability from cvelistv5 – Published: 2024-12-11 22:58 – Updated: 2026-04-02 18:23

Summary

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-20 00:00 UTC

CWE

Processing maliciously crafted web content may lead to memory corruption
CWE-787 - Out-of-bounds Write

Assigner

apple CNA under the mitre root

CNA scorecard E 37/100 over 907 records in the last 180 days details

References

13 references

URL	Tags
https://support.apple.com/en-us/121837
https://support.apple.com/en-us/121839
https://support.apple.com/en-us/121843
https://support.apple.com/en-us/121844
https://support.apple.com/en-us/121845
https://support.apple.com/en-us/121846
https://support.apple.com/en-us/122372
https://security.netapp.com/advisory/ntap-2025041…
http://seclists.org/fulldisclosure/2025/Apr/5
http://seclists.org/fulldisclosure/2024/Dec/13
http://seclists.org/fulldisclosure/2024/Dec/11
http://seclists.org/fulldisclosure/2024/Dec/7
http://seclists.org/fulldisclosure/2024/Dec/5

Impacted products

7 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 18.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.2 (custom)
Apple	iPadOS	Affected: 0 , < 17.7.6 (custom)
Apple	macOS	Affected: 0 , < 15.2 (custom)
Apple	tvOS	Affected: 0 , < 18.2 (custom)
Apple	visionOS	Affected: 0 , < 2.2 (custom)
Apple	watchOS	Affected: 0 , < 11.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-54534",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-20T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-21T04:56:02.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:32:22.994Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250418-0002/"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/5"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/13"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/11"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/7"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.7.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "2.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to memory corruption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:23:13.588Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121837"
        },
        {
          "url": "https://support.apple.com/en-us/121839"
        },
        {
          "url": "https://support.apple.com/en-us/121843"
        },
        {
          "url": "https://support.apple.com/en-us/121844"
        },
        {
          "url": "https://support.apple.com/en-us/121845"
        },
        {
          "url": "https://support.apple.com/en-us/121846"
        },
        {
          "url": "https://support.apple.com/en-us/122372"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-54534",
    "datePublished": "2024-12-11T22:58:39.974Z",
    "dateReserved": "2024-12-03T22:50:35.511Z",
    "dateUpdated": "2026-04-02T18:23:13.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

NCSC-2024-0487

CVE-2024-54527 (GCVE-0-2024-54527)

CVE-2024-54534 (GCVE-0-2024-54534)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour