CVE-2024-27873

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8, macOS Monterey 12.7.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Processing a maliciously crafted video file may lead to unexpected app termination.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://seclists.org/fulldisclosure/2024/Jul/16	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/17	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/18	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/19	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/20	Mailing List Third Party Advisory
https://support.apple.com/en-us/HT214116	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT214117	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT214118	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT214119	Release Notes Vendor Advisory
https://support.apple.com/en-us/HT214120	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

History

12 Aug 2024, 14:49

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2024/Jul/16 -~~	() http://seclists.org/fulldisclosure/2024/Jul/16 - Mailing List, Third Party Advisory
References	~~() http://seclists.org/fulldisclosure/2024/Jul/17 -~~	() http://seclists.org/fulldisclosure/2024/Jul/17 - Mailing List, Third Party Advisory
References	~~() http://seclists.org/fulldisclosure/2024/Jul/18 -~~	() http://seclists.org/fulldisclosure/2024/Jul/18 - Mailing List, Third Party Advisory
References	~~() http://seclists.org/fulldisclosure/2024/Jul/19 -~~	() http://seclists.org/fulldisclosure/2024/Jul/19 - Mailing List, Third Party Advisory
References	~~() http://seclists.org/fulldisclosure/2024/Jul/20 -~~	() http://seclists.org/fulldisclosure/2024/Jul/20 - Mailing List, Third Party Advisory
References	~~() https://support.apple.com/en-us/HT214116 -~~	() https://support.apple.com/en-us/HT214116 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/HT214117 -~~	() https://support.apple.com/en-us/HT214117 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/HT214118 -~~	() https://support.apple.com/en-us/HT214118 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/HT214119 -~~	() https://support.apple.com/en-us/HT214119 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/HT214120 -~~	() https://support.apple.com/en-us/HT214120 - Release Notes, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CPE		cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:ipados::::::::
First Time		Apple Apple macos Apple ipados Apple iphone Os
CWE		CWE-787

30 Jul 2024, 13:32

Type	Values Removed	Values Added
Summary		(es) Se solucionó un problema de escritura fuera de los límites con una validación de entrada mejorada. Este problema se solucionó en iOS 16.7.9 y iPadOS 16.7.9, macOS Ventura 13.6.8, macOS Monterey 12.7.6, iOS 17.6 y iPadOS 17.6, macOS Sonoma 14.6. Procesar un archivo de vídeo creado con fines malintencionados puede provocar la finalización inesperada de la aplicación.

30 Jul 2024, 02:15

Type	Values Removed	Values Added
References		() http://seclists.org/fulldisclosure/2024/Jul/18 - () http://seclists.org/fulldisclosure/2024/Jul/19 -

30 Jul 2024, 01:15

Type	Values Removed	Values Added
References		() http://seclists.org/fulldisclosure/2024/Jul/16 - () http://seclists.org/fulldisclosure/2024/Jul/17 - () http://seclists.org/fulldisclosure/2024/Jul/20 -

29 Jul 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-29 23:15

Updated : 2024-08-12 14:49

NVD link : CVE-2024-27873

Mitre link : CVE-2024-27873

CVE.ORG link : CVE-2024-27873

JSON object : View

Products Affected

apple

ipados
iphone_os
macos

CWE

CWE-787

Out-of-bounds Write

5.5 /10