Aggregator

苹果修复了在英特尔 Mac 攻击中使用的两个零日漏洞

嘶吼
2 days 21 hours ago

本周，苹果发布了紧急安全更新提示，用于修复两个零日漏洞，这些漏洞针对英特尔的 Mac 系统攻击。据了解，这些是在 macOS 的 macOS Sequoia JavaScriptCore (CVE-2024-44308) 和 WebKit (CVE-2024-44309) 组件中发现的。

JavaScriptCore CVE-2024-44308 漏洞允许攻击者通过恶意制作的 Web 内容实现远程代码执行。另一个漏洞 CVE-2024-44309 允许跨站点脚本 (CSS) 攻击。

该公司表示，它解决了 macOS Sequoia 15.1.1 中的安全漏洞。由于其他 Apple 操作系统中也存在相同的组件，因此在 iOS 17.7.2 和 iPadOS 17.7.2、iOS 18.1.1 和 iPadOS 18.1.1 以及 VisionOS 2.1.1 中也修复了该问题。

虽然苹果表示这两个漏洞是由谷歌威胁分析小组发现的，但该公司尚未提供有关如何利用这些漏洞的更多详细信息。

加上这两个漏洞，苹果公司在 2024 年迄今已修复了 6 个零日漏洞，第一个于 1 月，两个于 3 月，第四个于 5 月。这个数字明显好于去年，当时苹果修复了总共 20 个被利用的零日漏洞，其中包括：

·11 月份的两个零日漏洞（CVE-2023-42916 和 CVE-2023-42917）

·10 月份的两个零日漏洞（CVE-2023-42824 和 CVE-2023-5217）

·10 月份的五个零日漏洞（CVE-2023-41061、CVE） -2023-41064、CVE-2023-41991、CVE-2023-41992 和 CVE-2023-41993）

·9 月份的两个零日漏洞（CVE-2023-37450 和 CVE-2023-38606）

·7 月份的三个零日漏洞（ CVE-2023-32434、CVE-2023-32435 和 CVE-2023-32439）

·6 月份出现另外三个零日漏洞（CVE-2023-32409、CVE-2023-2023-28204 和 CVE-2023-32373）

·5 月份出现两个零日漏洞4 月份的 -days（CVE-2023-28206 和 CVE-2023-28205）

·以及 2 月份的另一个 WebKit 零日漏洞（CVE-2023-23529）

胡金鱼

CVE-2000-0275 | CRYPTOCard CRYPTOAdmin 4.1 on PalmOS PIN improper authentication (EDB-19838 / BID-1097)

Vuldb Updates
2 days 21 hours ago
A vulnerability classified as problematic has been found in CRYPTOCard CRYPTOAdmin 4.1 on PalmOS. This affects an unknown part of the component PIN Handler. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2000-0275. The attack needs to be approached locally. Furthermore, there is an exploit available.
vuldb.com

CVE-2024-44236 | Apple macOS up to 13.6/14.6 File out-of-bounds (Nessus ID 211697)

Vuldb Updates
2 days 21 hours ago
A vulnerability, which was classified as problematic, was found in Apple macOS up to 13.6/14.6. Affected is an unknown function of the component File Handler. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2024-44236. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-44237 | Apple macOS up to 13.6/14.6 File out-of-bounds (Nessus ID 211697)

Vuldb Updates
2 days 21 hours ago
A vulnerability, which was classified as problematic, was found in Apple macOS up to 13.6/14.6. This affects an unknown part of the component File Handler. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2024-44237. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-44234 | Apple watchOS Video File memory corruption (Nessus ID 211697)

Vuldb Updates
2 days 21 hours ago
A vulnerability was found in Apple watchOS and classified as critical. This issue affects some unknown processing of the component Video File Handler. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2024-44234. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-44233 | Apple iOS/iPadOS Video File memory corruption (Nessus ID 211697)

Vuldb Updates
2 days 21 hours ago
A vulnerability was found in Apple iOS and iPadOS. It has been declared as critical. This vulnerability affects unknown code of the component Video File Handler. The manipulation leads to memory corruption. This vulnerability was named CVE-2024-44233. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-44234 | Apple visionOS Video File memory corruption (Nessus ID 211697)

Vuldb Updates
2 days 21 hours ago
A vulnerability, which was classified as critical, has been found in Apple visionOS. Affected by this issue is some unknown functionality of the component Video File Handler. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2024-44234. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-44234 | Apple iOS/iPadOS Video File memory corruption (Nessus ID 211697)

Vuldb Updates
2 days 21 hours ago
A vulnerability, which was classified as critical, was found in Apple iOS and iPadOS. This affects an unknown part of the component Video File Handler. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2024-44234. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-44233 | Apple visionOS Video File memory corruption (Nessus ID 211697)

Vuldb Updates
2 days 21 hours ago
A vulnerability was found in Apple visionOS. It has been classified as critical. This affects an unknown part of the component Video File Handler. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2024-44233. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2005-3265 | Skype up to 1.4.0.83 skype/callto URI memory corruption (VU#668193 / Nessus ID 21451)

Vuldb Updates
2 days 22 hours ago
A vulnerability classified as critical has been found in Skype. Affected is an unknown function of the component skype/callto URI Handler. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2005-3265. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2005-3267 | Skype up to 1.4.0.83 Client Communication numeric error (VU#905177 / Nessus ID 21451)

Vuldb Updates
2 days 22 hours ago
A vulnerability classified as critical was found in Skype. Affected by this vulnerability is an unknown functionality of the component Client Communication Handler. The manipulation leads to numeric error. This vulnerability is known as CVE-2005-3267. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.
vuldb.com

Managed ad