Apple patches 50+ flaws across iOS, macOS ecosystems
Apple released security updates for Safari, iOS, iPadOS, macOS, watchOS, tvOS, and visionOS addressing over 50 vulnerabilities, including critical flaws enabling arbitrary code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Apple has issued comprehensive security updates across its entire product ecosystem to address multiple vulnerabilities affecting Safari 18.2, iOS/iPadOS 18.2 and 17.7.3, macOS Sequoia 15.2, Sonoma 14.7.2, Ventura 13.7.2, watchOS 11.2, tvOS 18.2, and visionOS 2.2. The most severe vulnerabilities could allow arbitrary code execution with the privileges of the logged-on user, including kernel-level execution in some cases. Critical flaws include CVE-2024-54529, which allows apps to execute arbitrary code with kernel privileges, and CVE-2024-45490, which could cause unexpected app termination or arbitrary code execution.
The update addresses a broad range of security issues beyond code execution, including sandbox escapes, privilege escalation vulnerabilities, information disclosure flaws, and memory corruption issues in WebKit. Several vulnerabilities affect fundamental system components including the kernel, file system protections, and cryptographic implementations. Additional concerns include privacy-related issues such as Private Relay IP address disclosure when adding websites to Safari Reading List, and notification content visibility from lock screens on iOS and iPadOS devices.
MS-ISAC rates the risk as high for government and business environments, and medium for home users. No active exploitation has been reported for any of these vulnerabilities. Apple users should apply updates immediately after appropriate testing, with particular urgency for organizations operating with administrative privileges on affected systems.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apple-products-could-allow-for-arbitrary-code-execution_2024-138
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs