CVE-2024-27808
CVE-2024-27808
In short
A memory handling flaw in Safari and Apple operating systems allows attackers to execute arbitrary code by processing malicious web content. This could let an attacker take complete control of your device through a compromised website.
Technical detail
A memory safety vulnerability in WebKit's content processing enables arbitrary code execution through crafted web content. The flaw requires user interaction (visiting a malicious website) but results in out-of-process code execution with the privileges of the Safari process. Fixed through improved memory handling in Safari 17.5 and corresponding OS updates.
Summary generated and translated by AI from the official description.
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOS and iPadOSApple · macOSApple · SafariApple · tvOSApple · visionOSApple · watchOSWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://seclists.org/fulldisclosure/2024/Jun/5https://support.apple.com/en-us/120896https://support.apple.com/en-us/120901https://support.apple.com/en-us/120902https://support.apple.com/en-us/120903https://support.apple.com/en-us/120905https://support.apple.com/en-us/120906https://support.apple.com/en-us/HT214101https://support.apple.com/en-us/HT214102https://support.apple.com/en-us/HT214103https://support.apple.com/en-us/HT214104https://support.apple.com/en-us/HT214106