Apple regularly lists resolved vulnerabilities for iPhone, iPad, and Mac after each software update. Right on cue, the company has released an extensive list of which security resolutions are included in today's iOS 18.2 and macOS Sequoia 15.2 software updates. As ever, we recommend updating as soon as possible to protect your devices from these security risks.
Here are the fixed provided today for iPhone, iPad, and Mac:
Impact: An app may be able to access user-sensitive data
Description: The issue was addressed with improved checks.
CVE-2024-54477: Mickey Jin (@patch1t), Csaba Fitzl (@theevilbit) of Kandji
Impact: Parsing a maliciously crafted video file may lead to unexpected system termination
Description: The issue was addressed with improved memory handling.
Impact: A malicious app may be able to access private information
Description: The issue was addressed with improved checks.
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
Impact: A local attacker may gain access to user's Keychain items
Description: This issue was addressed by enabling hardened runtime.
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A logic issue was addressed with improved checks.
CVE-2024-54529: Dillon Franke working with Google Project Zero
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional restrictions.
Impact: An app may be able to access protected user data
Description: A logic issue was addressed with improved file handling.
Impact: An encrypted volume may be accessed by a different user without prompting for the password
Description: An authorization issue was addressed with improved state management.
Impact: Running a mount command may unexpectedly execute arbitrary code
Description: A path handling issue was addressed with improved validation.
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: The issue was addressed with improved checks.
CVE-2024-54486: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative
Impact: A malicious app may be able to gain root privileges
Description: A logic issue was addressed with improved file handling.
Impact: Processing a maliciously crafted image may result in disclosure of process memory
Description: The issue was addressed with improved checks.
CVE-2024-54500: Junsung Lee working with Trend Micro Zero Day Initiative
Impact: An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware
Description: An out-of-bounds access issue was addressed with improved bounds checking.
Impact: An attacker may be able to create a read-only memory mapping that can be written to
Description: A race condition was addressed with additional validation.
Impact: An app may be able to leak sensitive kernel state
Description: A race condition was addressed with improved locking.
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
Description: The issue was addressed with improved memory handling.
Description: A logic issue was addressed with improved state management.
Impact: A remote attacker may cause an unexpected app termination or arbitrary code execution
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
Impact: An app may be able to break out of its sandbox
Description: The issue was addressed with improved checks.
Impact: An app may be able to gain elevated privileges
Description: A logic issue was addressed with improved checks.
Impact: A malicious application may be able to determine a user's current location
Description: The issue was resolved by sanitizing logging
Impact: An app may be able to access user-sensitive data
Description: The issue was resolved by sanitizing logging.
Impact: An app may be able to access user-sensitive data
Description: A privacy issue was addressed with improved private data redaction for log entries.
Impact: An app may be able to access user-sensitive data
Description: The issue was addressed with improved checks.
CVE-2024-54474: Mickey Jin (@patch1t)
CVE-2024-54476: Mickey Jin (@patch1t), Bohdan Stasiuk (@Bohdan_Stasiuk)
Impact: An attacker in a privileged network position may be able to alter network traffic
Description: This issue was addressed by using HTTPS when sending information over the network.
CVE-2024-54492: Talal Haj Bakry and Tommy Mysk of Mysk Inc. (@mysk_co)
Impact: An app may be able to modify protected parts of the file system
Description: A logic issue was addressed with improved state management.
Impact: On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website
Description: The issue was addressed with improved routing of Safari-originated requests.
Impact: Processing a maliciously crafted file may lead to a denial of service
Description: The issue was addressed with improved checks.
CVE-2024-54501: Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
Impact: A malicious app may be able to gain root privileges
Description: A logic issue was addressed with improved restrictions.
Impact: An app may be able to overwrite arbitrary files
Description: A logic issue was addressed with improved restrictions.
Impact: A malicious app may be able to access arbitrary files
Description: A logic issue was addressed with improved file handling.
Impact: An app may be able to break out of its sandbox
Description: A path handling issue was addressed with improved validation.
Impact: Privacy indicators for microphone access may be attributed incorrectly
Description: This issue was addressed through improved state management.
Impact: An app may be able to modify protected parts of the file system
Description: A configuration issue was addressed with additional restrictions.
CVE-2024-44243: Mickey Jin (@patch1t), Jonathan Bar Or (@yo_yo_yo_jbo) of Microsoft
Impact: A malicious app may be able to gain root privileges
Description: A permissions issue was addressed with additional restrictions.
Impact: An app may be able to modify protected parts of the file system
Description: The issue was addressed with improved permissions logic.
CVE-2024-54495: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Arsenii Kostromin (0x3c3e)
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: The issue was addressed with improved checks.
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 282180
CVE-2024-54508: linjy of HKUS3Lab and chluo of WHUSecLab, Xiangwei Zhang of Tencent Security YUNDING LAB
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A type confusion issue was addressed with improved memory handling.
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: The issue was addressed with improved memory handling.