This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apple fixes 49 vulnerabilities
Apple fixes 49 vulnerabilities in its products. The most severe of them are described below; the remaining ones can be found at [1][2][3][4][5][6][7][8][9]. Products and their fixed versions: macOS - 13.7.2 [1], 14.7.2 [2], 15.2 [3] iOS - 18.2 [4] iPadOS - 17.7.3 [5], 18.2 [4] watchOS - 11.2 [6] tvOS - 18.2 [7] visionOS - 2.2 [8] Safari - 18.2 [9]
An unauthenticated remote attacker can corrupt data in memory in macOS, iOS, iPadOS, Safari, watchOS, visionOS and tvOS due to an out-of-bounds write in the WebKit component, by means of social engineering and specially crafted web content [3][10].
The vulnerability is present in products:
- Apple macOS; <15.2;
- Apple iOS; <18.2;
- Apple iPadOS; <18.2;
- Apple Safari; <18.2;
- Apple watchOS; <11.2;
- Apple visionOS; <2.2;
- Apple tvOS; <18.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
More information:
- CVE-2024-54534 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
An unauthenticated remote attacker can elevate application privileges due to a logic error in the LaunchServices component in macOS [3][11].
The vulnerability is present in product:
- Apple macOS; <15.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-54465 at cve.org, NVD
- CWE-281: Improper Preservation of Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
An unauthenticated remote attacker can execute code in the DCP firmware due to an out-of-bounds read in the IOMobileFrameBuffer component in macOS, and potentially carry out a DoS attack [3][12].
The vulnerability is present in product:
- Apple macOS; <15.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-54506 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
An unauthenticated local attacker can execute code with kernel privileges due to a logic error in the Audio component in macOS by means of social engineering [3][13].
The vulnerability is present in product:
- Apple macOS; >=13.0, <13.7.2; >=14.0, <14.7.2; >=15.0, <15.2
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-54529 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
An authenticated local attacker can escape the Sandbox in macOS, which may lead to unauthorized access to system resources and user data [3][14]. A PoC exploit for the vulnerability can be found at [15].
The vulnerability is present in product:
- Apple macOS; <13.7.2; >=14.0, <14.7.2; >=15.0, <15.2;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-54498 at cve.org, NVD
- CWE-732: Incorrect Permission Assignment for Critical Resource at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
An unauthenticated local attacker can escape the Sandbox in macOS, iOS, iPadOS, watchOS and tvOS by means of social engineering, which may lead to unauthorized access to system resources and user data [16][17].
The vulnerability is present in products:
- Apple macOS; >=13.0, <13.7.2; >=14.0, <14.7.2; >=15.0, <15.2;
- Apple iOS; <18.2;
- Apple iPadOS; <18.2;
- Apple watchOS; <11.2;
- Apple tvOS; <18.2;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
More information:
- CVE-2024-54514 at cve.org, NVD
- CWE-CWE-693: Protection Mechanism Failure at cwe.mitre.org
The vulnerability was publicly disclosed 11. 1. 2025.
An unauthenticated local attacker can obtain root privileges in macOS [3][18][19].
The vulnerability is present in product:
- Apple macOS; >=13.0, <13.7.2; >=14.0, <14.7.2; >=15.0, <15.2;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-44224 at cve.org, NVD
- CVE-2024-44291 at cve.org, NVD
- CWE-269: Improper Privilege Management at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
An unauthenticated local attacker can bypass System Integrity Protection (SIP) in macOS and modify protected parts of the file system, which may lead to a complete system compromise [3][20][21]. Detailed information about the vulnerability is available at [21].
The vulnerability is present in product:
- Apple macOS; >=15.0, <15.2;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
More information:
- CVE-2024-44243 at cve.org, NVD
- CWE-266: Incorrect Privilege Assignment at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
An authenticated local attacker can bypass the TCC (Transparency, Consent, and Control) protection in macOS, iOS, iPadOS, watchOS and tvOS and gain access to sensitive user data [3][22][23]. Detailed information and a PoC exploit for the vulnerability are available at [23][24].
The vulnerability is present in products:
- Apple macOS; >=13.0, <13.7.2; >=14.0, <14.7.2; >=15.0, <15.2;
- Apple iOS; <18.2;
- Apple iPadOS; <18.2;
- Apple watchOS; <11.2;
- Apple tvOS; <18.2;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-54527 at cve.org, NVD
- CWE-276: Incorrect Default Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 11. 12. 2024.
Links
- [1] https://support.apple.com/en-us/121842
- [2] https://support.apple.com/en-us/121840
- [3] https://support.apple.com/en-us/121839
- [4] https://support.apple.com/en-us/121837
- [5] https://support.apple.com/en-us/121838
- [6] https://support.apple.com/en-us/121843
- [7] https://support.apple.com/en-us/121844
- [8] https://support.apple.com/en-us/121845
- [9] https://support.apple.com/en-us/121846
- [10] https://nvd.nist.gov/vuln/detail/cve-2024-54534
- [11] https://nvd.nist.gov/vuln/detail/CVE-2024-54465
- [12] https://nvd.nist.gov/vuln/detail/CVE-2024-54506
- [13] https://nvd.nist.gov/vuln/detail/CVE-2024-54529
- [14] https://nvd.nist.gov/vuln/detail/CVE-2024-54498
- [15] https://github.com/wh1te4ever/CVE-2024-54498-PoC
- [16] https://support.apple.com/cs-cz/121839
- [17] https://nvd.nist.gov/vuln/detail/CVE-2024-54514
- [18] https://nvd.nist.gov/vuln/detail/CVE-2024-44224
- [19] https://nvd.nist.gov/vuln/detail/CVE-2024-44291
- [20] https://nvd.nist.gov/vuln/detail/CVE-2024-44243
- [21] https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024-44243-a-macos-system-integrity-protection-bypass-through-kernel-extensions/
- [22] https://nvd.nist.gov/vuln/detail/CVE-2024-54527
- [23] https://jhftss.github.io/CVE-2024-54527-MediaLibraryService-Full-TCC-Bypass/
- [24] https://github.com/jhftss/POC/tree/main/CVE-2024-54527
By CESNET, z.s.p.o. Michaela Ručková on 17. 1. 2025.