Apple iOS/iPadOS Security Update Advisory (CVE-2024-23291 et al.)

Critical Vulnerability Information Accessibility CVE-2024-23291 - Impact: Malicious apps may observe users' accessibility notifications in log entries, leading to access to user data. - Description: Privacy issue fixed via improved private data redaction. AppleMobileFileIntegrity CVE-2024-23288 - Impact: Apps may gain elevated privileges. - Description: Vulnerable code removed. - Researchers: Wojciech Regula, Kirin (@Pwnrin) CoreBluetooth - LE CVE-2024-23250 - Impact: Apps may access Bluetooth-connected microphones without user consent. - Description: Access issue fixed via improved access restrictions. - Researchers: Guilherme Rambo file CVE-2022-48554 - Impact: Processing files may lead to denial of service or potential disclosure of memory contents. - Description: Issue fixed via improved checks. Image Processing CVE-2024-23270 - Impact: Apps may execute arbitrary code with kernel privileges. - Description: Issue fixed via improved memory handling. - Discovered by: An anonymous researcher ImagelO CVE-2024-23286 - Impact: Processing images may lead to arbitrary code execution. - Description: Buffer overflow issue fixed via improved memory handling. - Researchers: Multiple researchers Kernel (three times) CVE-2024-23235, CVE-2024-23265, CVE-2024-23225 - Impact: Apps may access sensitive user data; cause unexpected system termination or write kernel memory. - Description: Issues fixed via improved validation, locking, and state management. - Researchers: Xinru Chi, Mr.R libxpc and libxpc (five times) CVE-2024-23278, CVE-2024-0258, etc. - Impact: Apps may escape sandbox or execute arbitrary code. - Description: Issues fixed via improved checks and memory handling. MediaRemote CVE-2024-23297 - Impact: Malicious apps may access private information. - Description: Issue fixed via improved checks. Metal CVE-2024-23264 - Impact: Apps may read restricted memory. - Description: Validation issue fixed via improved input sanitization. RTKit CVE-2024-23296 - Impact: Attackers may bypass kernel memory protection. - Description: Memory corruption issue fixed via improved validation. Sandbox (two times) CVE-2024-23239, CVE-2024-23290 - Impact: Apps may leak sensitive user information or access sensitive user data. - Description: Issues fixed via improved state handling and restrictions. Siri, Spotlight, and UIKit CVE-2024-23293, CVE-2024-23241, CVE-2024-23246 - Impact: Attackers may access sensitive user data via Siri with physical access; apps may leak user information or break sandbox. - Description: Issues fixed via improved state management, memory handling, and security measures. WebKit (five times) CVE-2024-54658, CVE-2024-23226, etc. - Impact: Processing maliciously crafted web pages may lead to DoS attacks, arbitrary code execution, policy execution blocking, user fingerprinting, or state issues. - Description: Issues fixed via improved memory handling, interface handling, logic, and validation. - Researchers: Multiple researchers

Goal Reached Thanks to every supporter — we hit 100%!

Apple iOS/iPadOS Security Update Advisory (CVE-2024-23291 et al.)