macOS Sequoia has officially launched with new features and improvements such as window tiling, iPhone Mirroring, the new Password app, and more.But under the hood, Apple delivered a staggering amount of patched bugs/vulnerabilities to Mac users.These are the 76 security patches that come with the first public release of macOS 15 Sequoia.
The release of macOS Sequoia includes a significant number of security fixes, which is not surprising for a major .0 release.However, this is the most extensive list of CVEs I’ve ever seen in a single update.It’s great to see so many researchers and developers working to report bugs and flaws to help make the release of Sequoia as airtight as possible.
Apple shared details of each on its Security Updates page.The CVEs range from kernel vulnerabilities to addressing access to sensitive data in apps like Siri, Maps, and Shortcuts.These fixes help prevent potential exploits like arbitrary code execution, privilege escalation, and memory leaks.
Apple also implemented patches to protect against various attacks by improving memory handling, input validation, and sandbox restrictions.Here’s the full list of 76 security fixes with macOS Sequoia: Accounts Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to leak sensitive user information Description: The issue was addressed with improved checks.CVE-2024-44129 Accounts Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access user-sensitive data Description: The issue was addressed with improved permissions logic.
CVE-2024-44153: Mickey Jin (@patch1t) Accounts Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions.CVE-2024-44188: Bohdan Stasiuk (@Bohdan_Stasiuk) APFS Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A malicious app with root privileges may be able to modify the contents of system files Description: The issue was addressed with improved checks.CVE-2024-40825: Pedro Tôrres (@t0rr3sp3dr0) APNs Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app with root privileges may be able to access private information Description: This issue was addressed with improved data protection.
CVE-2024-44130 App Intents Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access sensitive data logged when a shortcut fails to launch another app Description: This issue was addressed with improved redaction of sensitive information.CVE-2024-44182: Kirin (@Pwnrin) AppleGraphicsControl Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: A memory initialization issue was addressed with improved memory handling.CVE-2024-44154: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative AppleGraphicsControl Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: The issue was addressed with improved memory handling.
CVE-2024-40845: Pwn2car working with Trend Micro Zero Day Initiative CVE-2024-40846: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative AppleMobileFileIntegrity Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to bypass Privacy preferences Description: This issue was addressed with improved checks.CVE-2024-44164: Mickey Jin (@patch1t) AppleMobileFileIntegrity Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions.CVE-2024-40837: Kirin (@Pwnrin) AppleMobileFileIntegrity Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access sensitive user data Description: The issue was addressed with additional code-signing restrictions.
CVE-2024-40847: Mickey Jin (@patch1t) AppleMobileFileIntegrity Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An attacker may be able to read sensitive information Description: A downgrade issue was addressed with additional code-signing restrictions.CVE-2024-40848: Mickey Jin (@patch1t) AppleMobileFileIntegrity Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to modify protected parts of the file system Description: A library injection issue was addressed with additional restrictions.CVE-2024-44168: Claudio Bozzato and Francesco Benvenuto of Cisco Talos AppleVA Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An application may be able to read restricted memory Description: The issue was addressed with improved memory handling.
CVE-2024-27860: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative CVE-2024-27861: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative AppleVA Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking.CVE-2024-40841: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative AppSandbox Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A camera extension may be able to access the internet Description: A permissions issue was addressed with additional restrictions.CVE-2024-27795: Halle Winkler, Politepix @hallewinkler AppSandbox Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access protected files within an App Sandbox container Description: A permissions issue was addressed with additional restrictions.
CVE-2024-44135: Mickey Jin (@patch1t) ArchiveService Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to break out of its sandbox Description: This issue was addressed with improved handling of symlinks.CVE-2024-44132: Mickey Jin (@patch1t) Automator Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An Automator Quick Action workflow may be able to bypass Gatekeeper Description: This issue was addressed by adding an additional prompt for user consent.CVE-2024-44128: Anton Boegler bless Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to modify protected parts of the file system Description: A permissions issue was addressed with additional restrictions.
CVE-2024-44151: Mickey Jin (@patch1t) Compression Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files Description: A race condition was addressed with improved locking.CVE-2024-27876: Snoolie Keffaber (@0xilis) Control Center Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to record the screen without an indicator Description: The issue was addressed with improved checks.CVE-2024-27869: an anonymous researcher Control Center Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Privacy Indicators for microphone or camera access may be attributed incorrectly Description: A logic issue was addressed with improved state management.
CVE-2024-27875: Yiğit Can YILMAZ (@yilmazcanyigit) copyfile Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to break out of its sandbox Description: A logic issue was addressed with improved file handling.CVE-2024-44146: an anonymous researcher CUPS Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: This is a vulnerability in open source code and Apple Software is among the affected projects.The CVE-ID was assigned by a third party.
Learn more about the issue and CVE-ID at cve.org.CVE-2023-4504 Disk Images Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to break out of its sandbox Description: This issue was addressed with improved validation of file attributes.CVE-2024-44148: an anonymous researcher Dock Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access user-sensitive data Description: A privacy issue was addressed by removing sensitive data.
CVE-2024-44177: an anonymous researcher FileProvider Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved validation of symlinks.CVE-2024-44131: @08Tc3wBB of Jamf Game Center Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access user-sensitive data Description: A file access issue was addressed with improved input validation.CVE-2024-40850: Denis Tokarev (@illusionofcha0s) Image Capture Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access a user’s Photos Library Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40831: Mickey Jin (@patch1t) ImageIO Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read issue was addressed with improved input validation.CVE-2024-27880: Junsung Lee ImageIO Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing an image may lead to a denial-of-service Description: An out-of-bounds access issue was addressed with improved bounds checking.CVE-2024-44176: dw0r of ZeroPointer Lab working with Trend Micro Zero Day Initiative, an anonymous researcher Installer Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to gain root privileges Description: The issue was addressed with improved checks.
CVE-2024-40861: Mickey Jin (@patch1t) Intel Graphics Driver Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: A buffer overflow issue was addressed with improved memory handling.CVE-2024-44160: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Intel Graphics Driver Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking.CVE-2024-44161: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative IOSurfaceAccelerator Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved memory handling.
CVE-2024-44169: Antonio Zekić Kernel Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Network traffic may leak outside a VPN tunnel Description: A logic issue was addressed with improved checks.CVE-2024-44165: Andrew Lytvynov Kernel Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may gain unauthorized access to Bluetooth Description: This issue was addressed through improved state management.CVE-2024-44191: Alexander Heinrich, SEEMOO, DistriNet, KU Leuven (@vanhoefm), TU Darmstadt (@Sn0wfreeze) and Mathy Vanhoef libxml2 Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: An integer overflow was addressed through improved input validation.
CVE-2024-44198: OSS-Fuzz, Ned Williamson of Google Project Zero Mail Accounts Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access information about a user’s contacts Description: A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-40791: Rodolphe BRUNETTI (@eisw0lf) Maps Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to read sensitive location information Description: An issue was addressed with improved handling of temporary files.CVE-2024-44181: Kirin(@Pwnrin) and LFY(@secsys) from Fudan University mDNSResponder Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to cause a denial-of-service Description: A logic error was addressed with improved error handling.
CVE-2024-44183: Olivier Levon Model I/O Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted image may lead to a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects.The CVE-ID was assigned by a third party.Learn more about the issue and CVE-ID at cve.org.
CVE-2023-5841 Music Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions.CVE-2024-27858: Meng Zhang (鲸落) of NorthSea, Csaba Fitzl (@theevilbit) of Offensive Security Notes Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to overwrite arbitrary files Description: This issue was addressed by removing the vulnerable code.CVE-2024-44167: ajajfxhj Notification Center Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A malicious app may be able to access notifications from the user’s device Description: A privacy issue was addressed by moving sensitive data to a protected location.
CVE-2024-40838: Brian McNulty, Cristian Dinca of “Tudor Vianu” National High School of Computer Science, Romania, Vaibhav Prajapati NSColor Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access protected user data Description: An access issue was addressed with additional sandbox restrictions.CVE-2024-44186: an anonymous researcher OpenSSH Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Multiple issues in OpenSSH Description: This is a vulnerability in open source code and Apple Software is among the affected projects.The CVE-ID was assigned by a third party.
Learn more about the issue and CVE-ID at cve.org.CVE-2024-39894 PackageKit Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to modify protected parts of the file system Description: This issue was addressed with improved validation of symlinks.CVE-2024-44178: Mickey Jin (@patch1t) Printing Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An unencrypted document may be written to a temporary file when using print preview Description: A privacy issue was addressed with improved handling of files.
CVE-2024-40826: an anonymous researcher Quick Look Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions.CVE-2024-44149: Wojciech Regula of SecuRing (wojciechregula.blog), Csaba Fitzl (@theevilbit) of OffSec Safari Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Visiting a malicious website may lead to user interface spoofing Description: This issue was addressed through improved state management.CVE-2024-40797: Rifa’i Rejal Maynando Sandbox Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A malicious application may be able to leak sensitive user information Description: The issue was addressed with improved checks.
CVE-2024-44125: Zhongquan Li (@Guluisacat) Sandbox Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A malicious application may be able to access private information Description: The issue was addressed with improved checks.CVE-2024-44163: Zhongquan Li (@Guluisacat) Security Initialization Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions.CVE-2024-40801: Zhongquan Li (@Guluisacat), Pedro José Pereira Vieito (@pvieito), an anonymous researcher Shortcuts Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40837: Kirin (@Pwnrin) Shortcuts Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A shortcut may output sensitive user data without consent Description: This issue was addressed with improved redaction of sensitive information.CVE-2024-44158: Kirin (@Pwnrin) Shortcuts Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to observe data displayed to the user by Shortcuts Description: A privacy issue was addressed with improved handling of temporary files.CVE-2024-40844: Kirin (@Pwnrin) and luckyu (@uuulucky) of NorthSea Siri Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access user-sensitive data Description: A privacy issue was addressed by moving sensitive data to a more secure location.
CVE-2024-44170: K宝, LFY (@secsys), Smi1e, yulige, Cristian Dinca (icmd.tech), Rodolphe BRUNETTI (@eisw0lf) sudo Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to modify protected parts of the file system Description: A logic issue was addressed with improved checks.CVE-2024-40860: Arsenii Kostromin (0x3c3e) System Settings Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access user-sensitive data Description: A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-44152: Kirin (@Pwnrin) CVE-2024-44166: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University System Settings Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to read arbitrary files Description: A path handling issue was addressed with improved validation.
CVE-2024-44190: Rodolphe BRUNETTI (@eisw0lf) TCC Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: On MDM managed devices, an app may be able to bypass certain Privacy preferences Description: This issue was addressed by removing the vulnerable code.CVE-2024-44133: Jonathan Bar Or (@yo_yo_yo_jbo) of Microsoft Transparency Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access user-sensitive data Description: A permissions issue was addressed with additional restrictions.CVE-2024-44184: Bohdan Stasiuk (@Bohdan_Stasiuk) TV App Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access user-sensitive data Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40859: Csaba Fitzl (@theevilbit) of Offensive Security Vim Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: This is a vulnerability in open source code and Apple Software is among the affected projects.The CVE-ID was assigned by a third party.Learn more about the issue and CVE-ID at cve.org.
CVE-2024-41957 WebKit Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: This issue was addressed through improved state management.WebKit Bugzilla: 268724 CVE-2024-40857: Ron Masas WebKit Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: Visiting a malicious website may lead to address bar spoofing Description: The issue was addressed with improved UI.WebKit Bugzilla: 279451 CVE-2024-40866: Hafiizh and YoKo Kho (@yokoacc) of HakTrak WebKit Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A malicious website may exfiltrate data cross-origin Description: A cross-origin issue existed with “iframe” elements.
This was addressed with improved tracking of security origins.WebKit Bugzilla: 279452 CVE-2024-44187: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt.Ltd, Pune (India) Wi-Fi Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A non-privileged user may be able to modify restricted network settings Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40770: Yiğit Can YILMAZ (@yilmazcanyigit) Wi-Fi Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to cause a denial-of-service Description: The issue was addressed with improved memory handling.CVE-2024-23237: Charly Suchanek Wi-Fi Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to read sensitive location information Description: This issue was addressed with improved redaction of sensitive information.CVE-2024-44134 Wi-Fi Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An attacker may be able to force a device to disconnect from a secure network Description: An integrity issue was addressed with Beacon Protection.
CVE-2024-40856: Domien Schepers WindowServer Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: A logic issue existed where a process may be able to capture screen contents without user consent Description: The issue was addressed with improved checks.CVE-2024-44189: Tim Clem XProtect Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to access user-sensitive data Description: An issue was addressed with improved validation of environment variables.CVE-2024-40842: Gergely Kalman (@gergely_kalman) XProtect Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later) Impact: An app may be able to modify protected parts of the file system Description: The issue was addressed with improved checks.
CVE-2024-40843: Koh M.Nakagawa (@tsunek0h) Additional recognition Admin Framework We would like to acknowledge Csaba Fitzl (@theevilbit) of Offensive Security for their assistance.Airport We would like to acknowledge David Dudok de Wit, Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.
APFS We would like to acknowledge Georgi Valkov of httpstorm.com for their assistance.App Store We would like to acknowledge Csaba Fitzl (@theevilbit) of Offensive Security for their assistance.AppKit We would like to acknowledge @08Tc3wBB of Jamf for their assistance.
Apple Neural Engine We would like to acknowledge Jiaxun Zhu (@svnswords) and Minghao Lin (@Y1nKoc) for their assistance.Automator We would like to acknowledge Koh M.Nakagawa (@tsunek0h) for their assistance.
Core Bluetooth We would like to acknowledge Nicholas C.of Onymos Inc.(onymos.com) for their assistance.
Core Services We would like to acknowledge Cristian Dinca of “Tudor Vianu” National High School of Computer Science, Romania, Kirin (@Pwnrin) and 7feilee, Snoolie Keffaber (@0xilis), Tal Lossos, Zhongquan Li (@Guluisacat) for their assistance.Disk Utility We would like to acknowledge Csaba Fitzl (@theevilbit) of Kandji for their assistance.FileProvider We would like to acknowledge Kirin (@Pwnrin) for their assistance.
Foundation We would like to acknowledge Ostorlab for their assistance.Kernel We would like to acknowledge Braxton Anderson, Fakhri Zulkifli (@d0lph1n98) of PixiePoint Security for their assistance.libxpc We would like to acknowledge Rasmus Sten, F-Secure (Mastodon: @[email protected]) for their assistance.
LLVM We would like to acknowledge Victor Duta of Universiteit Amsterdam, Fabio Pagani of University of California, Santa Barbara, Cristiano Giuffrida of Universiteit Amsterdam, Marius Muench, and Fabian Freyer for their assistance.Maps We would like to acknowledge Kirin (@Pwnrin) for their assistance.Music We would like to acknowledge Khiem Tran of databaselog.com/khiemtran, K宝 and LFY@secsys from Fudan University, Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.
Notifications We would like to acknowledge an anonymous researcher for their assistance.PackageKit We would like to acknowledge Csaba Fitzl (@theevilbit) of OffSec, Mickey Jin (@patch1t), Zhongquan Li (@Guluisacat) for their assistance.Passwords We would like to acknowledge Richard Hyunho Im (@r1cheeta) for their assistance.
Photos We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi Narain College of Technology Bhopal India, Harsh Tyagi, Leandro Chaves for their assistance.Podcasts We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.Quick Look We would like to acknowledge Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (xlab.tencent.com) for their assistance.
Safari We would like to acknowledge Hafiizh and YoKo Kho (@yokoacc) of HakTrak, Junsung Lee, Shaheen Fazim for their assistance.Sandbox We would like to acknowledge Cristian Dinca of “Tudor Vianu” National High School of Computer Science, Romania, Kirin (@Pwnrin) of NorthSea, Wojciech Regula of SecuRing (wojciechregula.blog), Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.Screen Capture We would like to acknowledge Joshua Jewett (@JoshJewett33), Yiğit Can YILMAZ (@yilmazcanyigit), an anonymous researcher for their assistance.
Shortcuts We would like to acknowledge Cristian Dinca of “Tudor Vianu” National High School of Computer Science, Romania, Jacob Braun, an anonymous researcher for their assistance.Siri We would like to acknowledge Rohan Paudel for their assistance.SystemMigration We would like to acknowledge Jamey Wicklund, Kevin Jansen, an anonymous researcher for their assistance.
TCC We would like to acknowledge Noah Gregory (wts.dev), Vaibhav Prajapati for their assistance.UIKit We would like to acknowledge Andr.Ess for their assistance.Voice Memos We would like to acknowledge Lisa B for their assistance.
WebKit We would like to acknowledge Avi Lumelsky, Uri Katz, (Oligo Security), Johan Carlsson (joaxcar) for their assistance.Wi-Fi We would like to acknowledge Antonio Zekic (@antoniozekic) and ant4g0nist, Tim Michaud (@TimGMichaud) of Moveworks.ai for their assistance.WindowServer We would like to acknowledge Felix Kratz, an anonymous researcher for their assistance.
You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day.Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop.Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel
