Lucene search

AppleCVE-2024-40777

HistoryJul 29, 2024 - 11:15 p.m.

CVE-2024-40777

2024-07-2923:15:11

apple

web.nvd.nist.gov

improper access

apple

os updates

bounds checking

unexpected termination

malicious file

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

AI Score

5.8

Confidence

Low

EPSS

Percentile

13.5%

JSON

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing a maliciously crafted file may lead to unexpected app termination.

Affected configurations

Vulners

Vulnrichment

Node

iphone_osRange<17.6

ipad_osRange<17.6

watchosRange<10.6

macosRange<14.6

visionosRange<1.3

tvosRange<17.6

VendorProductVersionCPE
*iphone_os*cpe:2.3:apple:*:iphone_os:*:*:*:*:*:*:*:*
*ipad_os*cpe:2.3:apple:*:ipad_os:*:*:*:*:*:*:*:*
*watchos*cpe:2.3:apple:*:watchos:*:*:*:*:*:*:*:*
*macos*cpe:2.3:apple:*:macos:*:*:*:*:*:*:*:*
*visionos*cpe:2.3:apple:*:visionos:*:*:*:*:*:*:*:*
*tvos*cpe:2.3:apple:*:tvos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	iphone_os	*	cpe:2.3:apple::iphone_os::::::::*
*	ipad_os	*	cpe:2.3:apple::ipad_os::::::::*
*	watchos	*	cpe:2.3:apple::watchos::::::::*
*	macos	*	cpe:2.3:apple::macos::::::::*
*	visionos	*	cpe:2.3:apple::visionos::::::::*
*	tvos	*	cpe:2.3:apple::tvos::::::::*

CNA Affected

[
  {
    "vendor": "Apple",
    "product": "iOS and iPadOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "17.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "watchOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "10.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "macOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "14.6",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "visionOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "1.3",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Apple",
    "product": "tvOS",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "17.6",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2024/Jul/16

seclists.org/fulldisclosure/2024/Jul/18

seclists.org/fulldisclosure/2024/Jul/21

seclists.org/fulldisclosure/2024/Jul/22

seclists.org/fulldisclosure/2024/Jul/23

support.apple.com/en-us/HT214117

support.apple.com/en-us/HT214119

support.apple.com/en-us/HT214122

support.apple.com/en-us/HT214123

support.apple.com/en-us/HT214124

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

AI Score

5.8

Confidence

Low

EPSS

Percentile

13.5%

JSON

Related for CVE-2024-40777