CVE-2024-27844 [moderate] Safari
The issue was addressed with improved checks.
A website's permission dialog may persist after navigation away from the site x     x         CVE-2024-27834 [moderate] WebKit
The issue was addressed with improved checks.
An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication x x x x     x x CVE-2024-27838 [moderate] WebKit
The issue was addressed by adding additional logic.
A maliciously crafted webpage may be able to fingerprint the user x x x x     x x CVE-2024-27808 [critical] WebKit
The issue was addressed with improved memory handling.
Processing web content may lead to arbitrary code execution x x   x     x x CVE-2024-27850 [moderate] WebKit
This issue was addressed with improvements to the noise injection algorithm.
A maliciously crafted webpage may be able to fingerprint the user x x   x         CVE-2024-27833 [critical] WebKit
An integer overflow was addressed with improved input validation.
Processing maliciously crafted web content may lead to arbitrary code execution x x x         x CVE-2024-27851 [critical] WebKit
The issue was addressed with improved bounds checks.
Processing maliciously crafted web content may lead to arbitrary code execution x x   x     x x CVE-2024-27830 [moderate] WebKit Canvas
This issue was addressed through improved state management.
A maliciously crafted webpage may be able to fingerprint the user x x   x     x x CVE-2024-27820 [critical] WebKit Web Inspector
The issue was addressed with improved memory handling.
Processing web content may lead to arbitrary code execution x x x x     x x CVE-2024-27826 [moderate] Apple Neural Engine
The issue was addressed with improved memory handling.
A local attackermay be able to cause unexpected system shutdown   x   x     x x CVE-2024-27804 [moderate] AppleAVD
The issue was addressed with improved memory handling.
An app may be able to cause unexpected system termination   x   x     x x CVE-2024-27816 [moderate] RemoteViewServices
A logic issue was addressed with improved checks.
An attacker may be able to access user data   x   x     x x CVE-2024-27841 [important] AVEVideoEncoder
The issue was addressed with improved memory handling.
An app may be able to disclose kernel memory   x   x         CVE-2024-27805 [moderate] Core Data
An issue was addressed with improved validation of environment variables.
An app may be able to access sensitive user data   x x x x x x x CVE-2024-27817 [important] CoreMedia
The issue was addressed with improved checks.
An app may be able to execute arbitrary code with kernel privileges   x x x x x   x CVE-2024-27831 [moderate] CoreMedia
An out-of-bounds write issue was addressed with improved input validation.
Processing a file may lead to unexpected app termination or arbitrary code execution   x x x x x   x CVE-2024-27832 [moderate] Disk Images
The issue was addressed with improved checks.
An app may be able to elevate privileges   x   x     x x CVE-2024-27839 [moderate] Find My
A privacy issue was addressed by moving sensitive data to a more secure location.
A malicious application may be able to determine a user's current location   x             CVE-2024-27801 [moderate] Foundation
The issue was addressed with improved checks.
An app may be able to elevate privileges   x   x     x x CVE-2024-27836 [critical] ImageIO
The issue was addressed with improved checks.
Processing a maliciously crafted image may lead to arbitrary code execution   x   x         CVE-2024-27828 [important] IOSurface
The issue was addressed with improved memory handling.
An app may be able to execute arbitrary code with kernel privileges   x         x x CVE-2024-27818 [moderate] Kernel
The issue was addressed with improved memory handling.
An attacker may be able to cause unexpected app termination or arbitrary code execution   x x x         CVE-2024-27840 [moderate] Kernel
The issue was addressed with improved memory handling.
An attacker that has already achieved kernel code execution may be able to bypass kernel memory protections   x x   x x x x CVE-2024-27815 [important] Kernel
An out-of-bounds write issue was addressed with improved input validation.
An app may be able to execute arbitrary code with kernel privileges   x   x     x x CVE-2024-27823 [moderate] Kernel
A race condition was addressed with improved locking.
An attacker in a privileged network position may be able to spoof network packets   x x x x x x x CVE-2024-27811 [moderate] libiconv
The issue was addressed with improved checks.
An app may be able to elevate privileges   x   x     x x CVE-2023-42893 [moderate] Libsystem
A permissions issue was addressed by removing vulnerable code and adding additional checks.
An app may be able to access protected user data   x   x         CVE-2024-23251 [moderate] Mail
An authentication issue was addressed with improved state management.
An attacker with physical access may be able to leak Mail account credentials   x x x     x   CVE-2024-23282 [moderate] Mail
The issue was addressed with improved checks.
A maliciously crafted email may be able to initiate FaceTime calls without user authorization   x x x     x   CVE-2024-27810 [important] Maps
A path handling issue was addressed with improved validation.
An app may be able to read sensitive location information   x   x x x x x CVE-2024-27852 [moderate] MarketplaceKit
A privacy issue was addressed with improved client ID handling for alternative app marketplaces.
A maliciously crafted webpage may be able to distribute a script that tracks users on other webpages   x             CVE-2024-27800 [moderate] Messages
This issue was addressed by removing the vulnerable code.
Processing a maliciously crafted message may lead to a denial-of-service   x x x x x x x CVE-2024-27802 [moderate] Metal
An out-of-bounds read was addressed with improved input validation.
Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution   x x x x x   x CVE-2024-27857 [moderate] Metal
An out-of-bounds access issue was addressed with improved bounds checking.
A remote attacker may be able to cause unexpected app termination or arbitrary code execution   x   x       x CVE-2024-27835 [moderate] Notes
This issue was addressed through improved state management.
An attacker with physical access to an iOS device may be able to access notes from the lock screen   x             CVE-2024-27845 [moderate] Notes
A privacy issue was addressed with improved handling of temporary files.
An app may be able to access Notes attachments   x             CVE-2024-27803 [moderate] Screenshots
A permissions issue was addressed with improved validation.
An attacker with physical access may be able to share items from the lock screen   x             CVE-2024-27821 [moderate] Shortcuts
A path handling issue was addressed with improved validation.
A shortcut may output sensitive user data without consent   x   x     x   CVE-2024-27855 [moderate] Shortcuts
The issue was addressed with improved checks.
A shortcut may be able to use sensitive data with certain actions without prompting the user   x x x x       CVE-2024-27819 [moderate] Siri
The issue was addressed by restricting options offered on a locked device.
An attacker with physical access may be able to access contacts from the lock screen   x             CVE-2024-27806 [moderate] Spotlight
This issue was addressed with improved environment sanitization.
An app may be able to access sensitive user data   x x x x x x x CVE-2024-27848 [moderate] StorageKit
This issue was addressed with improved permissions checking.
A malicious app may be able to gain root privileges   x   x         CVE-2024-27807 [moderate] Symptom Framework
The issue was addressed with improved checks.
An app may be able to circumvent App Privacy Report logging   x x           CVE-2024-27847 [important] Sync Services
This issue was addressed with improved checks
An app may be able to bypass Privacy preferences   x x x x x     CVE-2024-27884 [important] Transparency
This issue was addressed with a new entitlement.
An app may be able to access user-sensitive data   x   x     x x CVE-2024-27796 [important] Voice Control
The issue was addressed with improved checks.
A user may be able to elevate privileges   x x x x x     CVE-2024-27789 [important] Foundation
A logic issue was addressed with improved checks.
An app may be able to access user-sensitive data     x   x x     CVE-2024-27799 [moderate] IOHIDFamily
This issue was addressed with additional entitlement checks.
An unprivileged app may be able to log keystrokes in other apps including those using secure input mode     x x x x     CVE-2024-23296 [moderate] *** EXPLOITED *** RTKit
A memory corruption issue was addressed with improved validation.
An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.     x   x       CVE-2024-27837 [moderate] AppleMobileFileIntegrity
A downgrade issue was addressed with additional code-signing restrictions.
A local attacker may gain access to Keychain items       x         CVE-2024-27825 [moderate] AppleMobileFileIntegrity
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.
An app may be able to bypass certain Privacy preferences       x         CVE-2024-27829 [moderate] AppleVA
The issue was addressed with improved memory handling.
Processing a file may lead to unexpected app termination or arbitrary code execution       x         CVE-2024-23236 [moderate] CFNetwork
A correctness issue was addressed with improved checks.
An app may be able to read arbitrary files       x         CVE-2024-27827 [moderate] Finder
This issue was addressed through improved state management.
An app may be able to read arbitrary files       x x       CVE-2024-27822 [important] PackageKit
A logic issue was addressed with improved restrictions.
An app may be able to gain root privileges       x         CVE-2024-27824 [moderate] PackageKit
This issue was addressed by removing the vulnerable code.
An app may be able to elevate privileges       x x x     CVE-2024-27885 [important] PackageKit
This issue was addressed with improved validation of symlinks.
An app may be able to modify protected parts of the file system       x x x     CVE-2024-27813 [moderate] PrintCenter
The issue was addressed with improved checks.
An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges       x         CVE-2024-27843 [moderate] SharedFileList
A logic issue was addressed with improved checks.
An app may be able to elevate privileges       x x x     CVE-2024-27798 [important] Disk Management
An authorization issue was addressed with improved state management.
A user may be able to elevate privileges       x x x     CVE-2024-27842 [important] udf
The issue was addressed with improved checks.
An app may be able to execute arbitrary code with kernel privileges       x         CVE-2023-42861 [moderate] Login Window
A logic issue was addressed with improved state management.
An attacker with knowledge of a standard user's credentials can unlock another standard user's locked screen on the same Mac         x       CVE-2024-23229 [moderate] Find My
This issue was addressed with improved redaction of sensitive information.
A malicious application may be able to access Find My data           x     CVE-2024-27814 [moderate] Phone
This issue was addressed through improved state management.
A person with physical access to a device may be able to view contact information from the lock screen             x