macOS Sequoia has officially launched with fresh features and improvements specified as window tiling, iPhone Mirroring, the fresh Password app, and more. But under the hood, Apple delivered a staggering amount of patched bugs/vulnerabilities to Mac users. These are the 76 safety patches that come with the first public release of macOS 15 Sequoia.
The release of macOS Sequoia includes a crucial number of security fixes, which is not amazing for a major .0 release. However, this is the most extended list of CVEs I’ve always seen in a single update. It’s large to see so many researchers and developers working to study bugs and flaws to aid make the release of Sequoia as airtight as possible.
Apple shared details of each on its Security Updates page. The CVEs scope from kernel vulnerabilities to addressing access to delicate data in apps like Siri, Maps, and Shortcuts. These fixes aid prevent possible exploits like arbitrary code execution, privilege escalation, and memory leaks. Apple besides implemented patches to defend against various attacks by improving memory handling, input validation, and sandbox restrictions.
Here’s the full list of 76 safety fixes with macOS Sequoia:
Accounts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to leak delicate user information
Description: The issue was addressed with improved checks.
CVE-2024-44129
Accounts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access user-sensitive data
Description: The issue was addressed with improved permissions logic.
CVE-2024-44153: Mickey Jin (@patch1t)
Accounts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-44188: Bohdan Stasiuk (@Bohdan_Stasiuk)
APFS
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A malicious app with root privileges may be able to modify the contents of strategy files
Description: The issue was addressed with improved checks.
CVE-2024-40825: Pedro Tôrres (@t0rr3sp3dr0)
APNs
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app with root privileges may be able to access private information
Description: This issue was addressed with improved data protection.
CVE-2024-44130
App Intents
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access delicate data logged erstwhile a shortcut fails to launch another app
Description: This issue was addressed with improved redaction of delicate information.
CVE-2024-44182: Kirin (@Pwnrin)
AppleGraphicsControl
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted file may lead to unexpected app termination
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2024-44154: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
AppleGraphicsControl
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted video file may lead to unexpected app termination
Description: The issue was addressed with improved memory handling.
CVE-2024-40845: Pwn2car working with Trend Micro Zero Day Initiative
CVE-2024-40846: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
AppleMobileFileIntegrity
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to bypass Privacy preferences
Description: This issue was addressed with improved checks.
CVE-2024-44164: Mickey Jin (@patch1t)
AppleMobileFileIntegrity
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40837: Kirin (@Pwnrin)
AppleMobileFileIntegrity
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access delicate user data
Description: The issue was addressed with additional code-signing restrictions.
CVE-2024-40847: Mickey Jin (@patch1t)
AppleMobileFileIntegrity
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An attacker may be able to read delicate information
Description: A downgrade issue was addressed with additional code-signing restrictions.
CVE-2024-40848: Mickey Jin (@patch1t)
AppleMobileFileIntegrity
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to modify protected parts of the file system
Description: A library injection issue was addressed with additional restrictions.
CVE-2024-44168: Claudio Bozzato and Francesco Benvenuto of Cisco Talos
AppleVA
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An application may be able to read restricted memory
Description: The issue was addressed with improved memory handling.
CVE-2024-27860: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
CVE-2024-27861: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
AppleVA
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted video file may lead to unexpected app termination
Description: An out-of-bounds compose issue was addressed with improved bounds checking.
CVE-2024-40841: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
AppSandbox
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A camera extension may be able to access the internet
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-27795: Halle Winkler, Politepix @hallewinkler
AppSandbox
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access protected files within an App Sandbox container
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-44135: Mickey Jin (@patch1t)
ArchiveService
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to break out of its sandbox
Description: This issue was addressed with improved handling of symlinks.
CVE-2024-44132: Mickey Jin (@patch1t)
Automator
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An Automator fast Action workflow may be able to bypass Gatekeeper
Description: This issue was addressed by adding an additional prompt for user consent.
CVE-2024-44128: Anton Boegler
bless
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to modify protected parts of the file system
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-44151: Mickey Jin (@patch1t)
Compression
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Unpacking a maliciously crafted archive may let an attacker to compose arbitrary files
Description: A race condition was addressed with improved locking.
CVE-2024-27876: Snoolie Keffaber (@0xilis)
Control Center
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to evidence the screen without an indicator
Description: The issue was addressed with improved checks.
CVE-2024-27869: an anonymous researcher
Control Center
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Privacy Indicators for microphone or camera access may be attributed incorrectly
Description: A logic issue was addressed with improved state management.
CVE-2024-27875: Yiğit Can YILMAZ (@yilmazcanyigit)
copyfile
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to break out of its sandbox
Description: A logic issue was addressed with improved file handling.
CVE-2024-44146: an anonymous researcher
CUPS
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted file may lead to unexpected app termination
Description: This is simply a vulnerability in open origin code and Apple Software is among the affected projects. The CVE-ID was assigned by a 3rd party. Learn more about the issue and CVE-ID at cve.org.
CVE-2023-4504
Disk Images
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to break out of its sandbox
Description: This issue was addressed with improved validation of file attributes.
CVE-2024-44148: an anonymous researcher
Dock
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access user-sensitive data
Description: A privacy issue was addressed by removing delicate data.
CVE-2024-44177: an anonymous researcher
FileProvider
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access delicate user data
Description: This issue was addressed with improved validation of symlinks.
CVE-2024-44131: @08Tc3wBB of Jamf
Game Center
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access user-sensitive data
Description: A file access issue was addressed with improved input validation.
CVE-2024-40850: Denis Tokarev (@illusionofcha0s)
Image Capture
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access a user’s Photos Library
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40831: Mickey Jin (@patch1t)
ImageIO
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted file may lead to unexpected app termination
Description: An out-of-bounds read issue was addressed with improved input validation.
CVE-2024-27880: Junsung Lee
ImageIO
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing an image may lead to a denial-of-service
Description: An out-of-bounds access issue was addressed with improved bounds checking.
CVE-2024-44176: dw0r of ZeroPointer laboratory working with Trend Micro Zero Day Initiative, an anonymous researcher
Installer
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to gain root privileges
Description: The issue was addressed with improved checks.
CVE-2024-40861: Mickey Jin (@patch1t)
Intel Graphics Driver
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted texture may lead to unexpected app termination
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2024-44160: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
Intel Graphics Driver
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted texture may lead to unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2024-44161: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative
IOSurfaceAccelerator
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to origin unexpected strategy termination
Description: The issue was addressed with improved memory handling.
CVE-2024-44169: Antonio Zekić
Kernel
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Network traffic may leak outside a VPN tunnel
Description: A logic issue was addressed with improved checks.
CVE-2024-44165: Andrew Lytvynov
Kernel
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may gain unauthorized access to Bluetooth
Description: This issue was addressed through improved state management.
CVE-2024-44191: Alexander Heinrich, SEEMOO, DistriNet, KU Leuven (@vanhoefm), TU Darmstadt (@Sn0wfreeze) and Mathy Vanhoef
libxml2
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: An integer overflow was addressed through improved input validation.
CVE-2024-44198: OSS-Fuzz, Ned Williamson of Google task Zero
Mail Accounts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access information about a user’s contacts
Description: A privacy issue was addressed with improved private data redaction for log entries.
CVE-2024-40791: Rodolphe BRUNETTI (@eisw0lf)
Maps
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to read delicate location information
Description: An issue was addressed with improved handling of temporary files.
CVE-2024-44181: Kirin(@Pwnrin) and LFY(@secsys) from Fudan University
mDNSResponder
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to origin a denial-of-service
Description: A logic mistake was addressed with improved mistake handling.
CVE-2024-44183: Olivier Levon
Model I/O
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted image may lead to a denial-of-service
Description: This is simply a vulnerability in open origin code and Apple Software is among the affected projects. The CVE-ID was assigned by a 3rd party. Learn more about the issue and CVE-ID at cve.org.
CVE-2023-5841
Music
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-27858: Meng Zhang (鲸落) of NorthSea, Csaba Fitzl (@theevilbit) of Offensive Security
Notes
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to overwrite arbitrary files
Description: This issue was addressed by removing the susceptible code.
CVE-2024-44167: ajajfxhj
Notification Center
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A malicious app may be able to access notifications from the user’s device
Description: A privacy issue was addressed by moving delicate data to a protected location.
CVE-2024-40838: Brian McNulty, Cristian Dinca of “Tudor Vianu” National advanced School of Computer Science, Romania, Vaibhav Prajapati
NSColor
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access protected user data
Description: An access issue was addressed with additional sandbox restrictions.
CVE-2024-44186: an anonymous researcher
OpenSSH
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Multiple issues in OpenSSH
Description: This is simply a vulnerability in open origin code and Apple Software is among the affected projects. The CVE-ID was assigned by a 3rd party. Learn more about the issue and CVE-ID at cve.org.
CVE-2024-39894
PackageKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to modify protected parts of the file system
Description: This issue was addressed with improved validation of symlinks.
CVE-2024-44178: Mickey Jin (@patch1t)
Printing
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An unencrypted paper may be written to a temporary file erstwhile utilizing print preview
Description: A privacy issue was addressed with improved handling of files.
CVE-2024-40826: an anonymous researcher
Quick Look
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-44149: Wojciech Regula of SecuRing (wojciechregula.blog), Csaba Fitzl (@theevilbit) of OffSec
Safari
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Visiting a malicious website may lead to user interface spoofing
Description: This issue was addressed through improved state management.
CVE-2024-40797: Rifa’i Rejal Maynando
Sandbox
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A malicious application may be able to leak delicate user information
Description: The issue was addressed with improved checks.
CVE-2024-44125: Zhongquan Li (@Guluisacat)
Sandbox
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A malicious application may be able to access private information
Description: The issue was addressed with improved checks.
CVE-2024-44163: Zhongquan Li (@Guluisacat)
Security Initialization
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40801: Zhongquan Li (@Guluisacat), Pedro José Pereira Vieito (@pvieito), an anonymous researcher
Shortcuts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40837: Kirin (@Pwnrin)
Shortcuts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A shortcut may output delicate user data without consent
Description: This issue was addressed with improved redaction of delicate information.
CVE-2024-44158: Kirin (@Pwnrin)
Shortcuts
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to observe data displayed to the user by Shortcuts
Description: A privacy issue was addressed with improved handling of temporary files.
CVE-2024-40844: Kirin (@Pwnrin) and luckyu (@uuulucky) of NorthSea
Siri
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access user-sensitive data
Description: A privacy issue was addressed by moving delicate data to a more safe location.
CVE-2024-44170: K宝, LFY (@secsys), Smi1e, yulige, Cristian Dinca (icmd.tech), Rodolphe BRUNETTI (@eisw0lf)
sudo
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to modify protected parts of the file system
Description: A logic issue was addressed with improved checks.
CVE-2024-40860: Arsenii Kostromin (0x3c3e)
System Settings
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access user-sensitive data
Description: A privacy issue was addressed with improved private data redaction for log entries.
CVE-2024-44152: Kirin (@Pwnrin)
CVE-2024-44166: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University
System Settings
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to read arbitrary files
Description: A way handling issue was addressed with improved validation.
CVE-2024-44190: Rodolphe BRUNETTI (@eisw0lf)
TCC
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: On MDM managed devices, an app may be able to bypass certain Privacy preferences
Description: This issue was addressed by removing the susceptible code.
CVE-2024-44133: Jonathan Bar Or (@yo_yo_yo_jbo) of Microsoft
Transparency
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access user-sensitive data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-44184: Bohdan Stasiuk (@Bohdan_Stasiuk)
TV App
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access user-sensitive data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40859: Csaba Fitzl (@theevilbit) of Offensive Security
Vim
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing a maliciously crafted file may lead to unexpected app termination
Description: This is simply a vulnerability in open origin code and Apple Software is among the affected projects. The CVE-ID was assigned by a 3rd party. Learn more about the issue and CVE-ID at cve.org.
CVE-2024-41957
WebKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: This issue was addressed through improved state management.
WebKit Bugzilla: 268724
CVE-2024-40857: Ron Masas
WebKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: Visiting a malicious website may lead to address bar spoofing
Description: The issue was addressed with improved UI.
WebKit Bugzilla: 279451
CVE-2024-40866: Hafiizh and YoKo Kho (@yokoacc) of HakTrak
WebKit
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A malicious website may exfiltrate data cross-origin
Description: A cross-origin issue existed with “iframe” elements. This was addressed with improved tracking of safety origins.
WebKit Bugzilla: 279452
CVE-2024-44187: Narendra Bhati, manager of Cyber safety at Suma Soft Pvt. Ltd, Pune (India)
Wi-Fi
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A non-privileged user may be able to modify restricted network settings
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40770: Yiğit Can YILMAZ (@yilmazcanyigit)
Wi-Fi
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to origin a denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2024-23237: Charly Suchanek
Wi-Fi
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to read delicate location information
Description: This issue was addressed with improved redaction of delicate information.
CVE-2024-44134
Wi-Fi
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An attacker may be able to force a device to disconnect from a safe network
Description: An integrity issue was addressed with Beacon Protection.
CVE-2024-40856: Domien Schepers
WindowServer
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: A logic issue existed where a process may be able to capture screen contents without user consent
Description: The issue was addressed with improved checks.
CVE-2024-44189: Tim Clem
XProtect
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to access user-sensitive data
Description: An issue was addressed with improved validation of environment variables.
CVE-2024-40842: Gergely Kalman (@gergely_kalman)
XProtect
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)
Impact: An app may be able to modify protected parts of the file system
Description: The issue was addressed with improved checks.
CVE-2024-40843: Koh M. Nakagawa (@tsunek0h)
Additional recognition
Admin Framework
We would like to admit Csaba Fitzl (@theevilbit) of Offensive safety for their assistance.
Airport
We would like to admit David Dudok de Wit, Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.
APFS
We would like to admit Georgi Valkov of httpstorm.com for their assistance.
App Store
We would like to admit Csaba Fitzl (@theevilbit) of Offensive safety for their assistance.
AppKit
We would like to admit @08Tc3wBB of Jamf for their assistance.
Apple Neural Engine
We would like to admit Jiaxun Zhu (@svnswords) and Minghao Lin (@Y1nKoc) for their assistance.
Automator
We would like to admit Koh M. Nakagawa (@tsunek0h) for their assistance.
Core Bluetooth
We would like to admit Nicholas C. of Onymos Inc. (onymos.com) for their assistance.
Core Services
We would like to admit Cristian Dinca of “Tudor Vianu” National advanced School of Computer Science, Romania, Kirin (@Pwnrin) and 7feilee, Snoolie Keffaber (@0xilis), Tal Lossos, Zhongquan Li (@Guluisacat) for their assistance.
Disk Utility
We would like to admit Csaba Fitzl (@theevilbit) of Kandji for their assistance.
FileProvider
We would like to admit Kirin (@Pwnrin) for their assistance.
Foundation
We would like to admit Ostorlab for their assistance.
Kernel
We would like to admit Braxton Anderson, Fakhri Zulkifli (@d0lph1n98) of PixiePoint safety for their assistance.
libxpc
We would like to admit Rasmus Sten, F-Secure (Mastodon: @[email protected]) for their assistance.
LLVM
We would like to admit Victor Duta of Universiteit Amsterdam, Fabio Pagani of University of California, Santa Barbara, Cristiano Giuffrida of Universiteit Amsterdam, Marius Muench, and Fabian Freyer for their assistance.
Maps
We would like to admit Kirin (@Pwnrin) for their assistance.
Music
We would like to admit Khiem Tran of databaselog.com/khiemtran, K宝 and LFY@secsys from Fudan University, Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.
Notifications
We would like to admit an anonymous investigator for their assistance.
PackageKit
We would like to admit Csaba Fitzl (@theevilbit) of OffSec, Mickey Jin (@patch1t), Zhongquan Li (@Guluisacat) for their assistance.
Passwords
We would like to admit Richard Hyunho Im (@r1cheeta) for their assistance.
Photos
We would like to admit Abhay Kailasia (@abhay_kailasia) of Lakshmi Narain College of Technology Bhopal India, Harsh Tyagi, Leandro Chaves for their assistance.
Podcasts
We would like to admit Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.
Quick Look
We would like to admit Zhipeng Huo (@R3dF09) of Tencent safety Xuanwu laboratory (xlab.tencent.com) for their assistance.
Safari
We would like to admit Hafiizh and YoKo Kho (@yokoacc) of HakTrak, Junsung Lee, Shaheen Fazim for their assistance.
Sandbox
We would like to admit Cristian Dinca of “Tudor Vianu” National advanced School of Computer Science, Romania, Kirin (@Pwnrin) of NorthSea, Wojciech Regula of SecuRing (wojciechregula.blog), Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.
Screen Capture
We would like to admit Joshua Jewett (@JoshJewett33), Yiğit Can YILMAZ (@yilmazcanyigit), an anonymous investigator for their assistance.
Shortcuts
We would like to admit Cristian Dinca of “Tudor Vianu” National advanced School of Computer Science, Romania, Jacob Braun, an anonymous investigator for their assistance.
Siri
We would like to admit Rohan Paudel for their assistance.
SystemMigration
We would like to admit Jamey Wicklund, Kevin Jansen, an anonymous investigator for their assistance.
TCC
We would like to admit Noah Gregory (wts.dev), Vaibhav Prajapati for their assistance.
UIKit
We would like to admit Andr.Ess for their assistance.
Voice Memos
We would like to admit Lisa B for their assistance.
WebKit
We would like to admit Avi Lumelsky, Uri Katz, (Oligo Security), Johan Carlsson (joaxcar) for their assistance.
Wi-Fi
We would like to admit Antonio Zekic (@antoniozekic) and ant4g0nist, Tim Michaud (@TimGMichaud) of Moveworks.ai for their assistance.
WindowServer
We would like to admit Felix Kratz, an anonymous investigator for their assistance.
FTC: We usage income earning car affiliate links. More.
![Wideo: Podnieś poziom swojego MacBooka dzięki nowej linii FusionDock iVANKY [Sponsored]](https://9to5mac.com/wp-content/uploads/sites/6/2024/10/IMG_A0EF9DBE2F61-1-e1729865718367.jpeg?quality=82&strip=all&w=1600)
