Vulnerability-Lookup

RHSA-2024:9553

Vulnerability from csaf_opensuse - Published: 2024-11-13 00:00 - Updated: 2026-09-20 11:45

Summary

security update for webkit2gtk3

Severity

Low

Notes

Title of the patch: security update for webkit2gtk3

Description of the patch: This security update provides a functional equivalent of RHSA-2024:9553. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2024:9553.

Patchnames: RHSA-2024:9553

CVE-2024-27856

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2024-40866

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2024-27856

Threats

Impact important

CVE-2024-44185

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2024-27856

Threats

Impact moderate

CVE-2024-44187

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2024-27856

Threats

Impact important

CVE-2024-44244

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2024-27856

Threats

Impact moderate

CVE-2024-44296

4.2 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2024-27856

Threats

Impact moderate

CVE-2024-54534

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2024-27856

Threats

Impact important

CVE-2025-43480

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products, the same list as for CVE-2024-27856

Threats

Impact moderate

References

28 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2024-27856/	self
https://www.suse.com/security/cve/CVE-2024-40866/	self
https://www.suse.com/security/cve/CVE-2024-44185/	self
https://www.suse.com/security/cve/CVE-2024-44187/	self
https://www.suse.com/security/cve/CVE-2024-44244/	self
https://www.suse.com/security/cve/CVE-2024-44296/	self
https://www.suse.com/security/cve/CVE-2024-54534/	self
https://www.suse.com/security/cve/CVE-2025-43480/	self
https://www.suse.com/security/cve/CVE-2024-27856	external
https://bugzilla.suse.com/1236946	external
https://www.suse.com/security/cve/CVE-2024-40866	external
https://bugzilla.suse.com/1231039	external
https://www.suse.com/security/cve/CVE-2024-44185	external
https://bugzilla.suse.com/1232747	external
https://www.suse.com/security/cve/CVE-2024-44187	external
https://bugzilla.suse.com/1231039	external
https://www.suse.com/security/cve/CVE-2024-44244	external
https://bugzilla.suse.com/1232747	external
https://www.suse.com/security/cve/CVE-2024-44296	external
https://bugzilla.suse.com/1232747	external
https://www.suse.com/security/cve/CVE-2024-54534	external
https://bugzilla.suse.com/1234851	external
https://www.suse.com/security/cve/CVE-2025-43480	external
https://bugzilla.suse.com/1254175	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for webkit2gtk3",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2024:9553.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2024:9553.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2024:9553",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_9553.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2024:9553",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-November/000595.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2024:9553",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-November/000595.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-27856 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-27856/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-40866 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-40866/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-44185 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-44185/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-44187 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-44187/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-44244 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-44244/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-44296 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-44296/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-54534 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-54534/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-43480 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-43480/"
      }
    ],
    "title": "security update for webkit2gtk3",
    "tracking": {
      "current_release_date": "2026-09-20T11:45:07Z",
      "generator": {
        "date": "2024-11-13T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2024:9553",
      "initial_release_date": "2024-11-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-11-13T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:45:07Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "webkit2gtk3-0:2.46.3-1.el9_5.i686",
                "product": {
                  "name": "webkit2gtk3-0:2.46.3-1.el9_5.i686",
                  "product_id": "webkit2gtk3-0:2.46.3-1.el9_5.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:webkitgtk:webkitgtk:2.46.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/webkit2gtk3@2.46.3-1.el9_5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
                "product": {
                  "name": "webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
                  "product_id": "webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:webkitgtk:webkitgtk:2.46.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/webkit2gtk3-devel@2.46.3-1.el9_5?arch=i686\u0026upstream=webkit2gtk3-0:2.46.3-1.el9_5.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
                "product": {
                  "name": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
                  "product_id": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/webkit2gtk3-jsc@2.46.3-1.el9_5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
                "product": {
                  "name": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
                  "product_id": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/webkit2gtk3-jsc-devel@2.46.3-1.el9_5?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
                "product": {
                  "name": "webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
                  "product_id": "webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:webkitgtk:webkitgtk:2.46.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/webkit2gtk3@2.46.3-1.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
                "product": {
                  "name": "webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
                  "product_id": "webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:webkitgtk:webkitgtk:2.46.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/webkit2gtk3-devel@2.46.3-1.el9_5?arch=x86_64\u0026upstream=webkit2gtk3-0:2.46.3-1.el9_5.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
                "product": {
                  "name": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
                  "product_id": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/webkit2gtk3-jsc@2.46.3-1.el9_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64",
                "product": {
                  "name": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64",
                  "product_id": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/webkit2gtk3-jsc-devel@2.46.3-1.el9_5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-0:2.46.3-1.el9_5.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686"
        },
        "product_reference": "webkit2gtk3-0:2.46.3-1.el9_5.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-0:2.46.3-1.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64"
        },
        "product_reference": "webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-devel-0:2.46.3-1.el9_5.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686"
        },
        "product_reference": "webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64"
        },
        "product_reference": "webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686"
        },
        "product_reference": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64"
        },
        "product_reference": "webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686"
        },
        "product_reference": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        },
        "product_reference": "webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-27856",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-27856"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-27856",
          "url": "https://www.suse.com/security/cve/CVE-2024-27856"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236946 for CVE-2024-27856",
          "url": "https://bugzilla.suse.com/1236946"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-27856"
    },
    {
      "cve": "CVE-2024-40866",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-40866"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-40866",
          "url": "https://www.suse.com/security/cve/CVE-2024-40866"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231039 for CVE-2024-40866",
          "url": "https://bugzilla.suse.com/1231039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-40866"
    },
    {
      "cve": "CVE-2024-44185",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-44185"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-44185",
          "url": "https://www.suse.com/security/cve/CVE-2024-44185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232747 for CVE-2024-44185",
          "url": "https://bugzilla.suse.com/1232747"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-44185"
    },
    {
      "cve": "CVE-2024-44187",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-44187"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A cross-origin issue existed with \"iframe\" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-44187",
          "url": "https://www.suse.com/security/cve/CVE-2024-44187"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231039 for CVE-2024-44187",
          "url": "https://bugzilla.suse.com/1231039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-44187"
    },
    {
      "cve": "CVE-2024-44244",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-44244"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may lead to an unexpected process crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-44244",
          "url": "https://www.suse.com/security/cve/CVE-2024-44244"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232747 for CVE-2024-44244",
          "url": "https://bugzilla.suse.com/1232747"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-44244"
    },
    {
      "cve": "CVE-2024-44296",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-44296"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The issue was addressed with improved checks. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-44296",
          "url": "https://www.suse.com/security/cve/CVE-2024-44296"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232747 for CVE-2024-44296",
          "url": "https://bugzilla.suse.com/1232747"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-44296"
    },
    {
      "cve": "CVE-2024-54534",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-54534"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-54534",
          "url": "https://www.suse.com/security/cve/CVE-2024-54534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234851 for CVE-2024-54534",
          "url": "https://bugzilla.suse.com/1234851"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-13T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-54534"
    },
    {
      "cve": "CVE-2025-43480",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-43480"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
          "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-43480",
          "url": "https://www.suse.com/security/cve/CVE-2025-43480"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1254175 for CVE-2025-43480",
          "url": "https://bugzilla.suse.com/1254175"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-devel-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-0:2.46.3-1.el9_5.x86_64",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.i686",
            "SUSE Liberty Linux 9:webkit2gtk3-jsc-devel-0:2.46.3-1.el9_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-11-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-43480"
    }
  ]
}

CVE-2024-27856 (GCVE-0-2024-27856)

Vulnerability from cvelistv5 – Published: 2025-01-15 19:35 – Updated: 2026-04-02 18:18

Summary

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-24 04:56 UTC

CWE

Processing a file may lead to unexpected app termination or arbitrary code execution
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

apple mitre root Scorecard

References

7 references

URL	Tags
https://support.apple.com/en-us/120896
https://support.apple.com/en-us/120898
https://support.apple.com/en-us/120901
https://support.apple.com/en-us/120902
https://support.apple.com/en-us/120903
https://support.apple.com/en-us/120905
https://support.apple.com/en-us/120906

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.5 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 16.7.8 (custom) Affected: 0 , < 17.5 (custom)
Apple	macOS	Affected: 0 , < 14.5 (custom)
Apple	tvOS	Affected: 0 , < 17.5 (custom)
Apple	visionOS	Affected: 0 , < 1.2 (custom)
Apple	watchOS	Affected: 0 , < 10.5 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-24T04:56:04.900942Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T19:09:06.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing a file may lead to unexpected app termination or arbitrary code execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:18:26.635Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120896"
        },
        {
          "url": "https://support.apple.com/en-us/120898"
        },
        {
          "url": "https://support.apple.com/en-us/120901"
        },
        {
          "url": "https://support.apple.com/en-us/120902"
        },
        {
          "url": "https://support.apple.com/en-us/120903"
        },
        {
          "url": "https://support.apple.com/en-us/120905"
        },
        {
          "url": "https://support.apple.com/en-us/120906"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-27856",
    "datePublished": "2025-01-15T19:35:57.075Z",
    "dateReserved": "2024-02-26T15:32:28.539Z",
    "dateUpdated": "2026-04-02T18:18:26.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-40866 (GCVE-0-2024-40866)

Vulnerability from cvelistv5 – Published: 2024-09-16 23:22 – Updated: 2026-04-02 18:12

Summary

The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-18 17:55 UTC

CWE

Visiting a malicious website may lead to address bar spoofing
CWE-noinfo Not enough information

Assigner

apple mitre root Scorecard

References

5 references

URL	Tags
https://support.apple.com/en-us/121238
https://support.apple.com/en-us/121241
https://lists.debian.org/debian-lts-announce/2024…
http://seclists.org/fulldisclosure/2024/Sep/37
http://seclists.org/fulldisclosure/2024/Sep/33

Impacted products

2 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 18 (custom)
Apple	macOS	Affected: 0 , < 15 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40866",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-18T17:55:34.103087Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T16:20:43.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:13:38.887Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/37"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/33"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Visiting a malicious website may lead to address bar spoofing",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:12:03.728Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121238"
        },
        {
          "url": "https://support.apple.com/en-us/121241"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-40866",
    "datePublished": "2024-09-16T23:22:28.243Z",
    "dateReserved": "2024-07-10T17:11:04.716Z",
    "dateUpdated": "2026-04-02T18:12:03.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44185 (GCVE-0-2024-44185)

Vulnerability from cvelistv5 – Published: 2024-10-24 16:40 – Updated: 2026-04-02 18:08

Summary

The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-24 18:14 UTC

CWE

Processing maliciously crafted web content may lead to an unexpected process crash
CWE-noinfo Not enough information

Assigner

apple mitre root Scorecard

References

7 references

URL	Tags
https://support.apple.com/en-us/120909
https://support.apple.com/en-us/120911
https://support.apple.com/en-us/120913
https://support.apple.com/en-us/120914
https://support.apple.com/en-us/120915
https://support.apple.com/en-us/120916
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 17.6 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 17.6 (custom)
Apple	macOS	Affected: 0 , < 14.6 (custom)
Apple	tvOS	Affected: 0 , < 17.6 (custom)
Apple	visionOS	Affected: 0 , < 1.3 (custom)
Apple	watchOS	Affected: 0 , < 10.6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-44185",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-24T18:14:04.742121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T21:46:06.727Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:07:43.946Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:08:42.965Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120909"
        },
        {
          "url": "https://support.apple.com/en-us/120911"
        },
        {
          "url": "https://support.apple.com/en-us/120913"
        },
        {
          "url": "https://support.apple.com/en-us/120914"
        },
        {
          "url": "https://support.apple.com/en-us/120915"
        },
        {
          "url": "https://support.apple.com/en-us/120916"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-44185",
    "datePublished": "2024-10-24T16:40:36.055Z",
    "dateReserved": "2024-08-20T21:42:05.928Z",
    "dateUpdated": "2026-04-02T18:08:42.965Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44187 (GCVE-0-2024-44187)

Vulnerability from cvelistv5 – Published: 2024-09-16 23:23 – Updated: 2026-04-02 18:24

Summary

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-17 13:44 UTC

CWE

A malicious website may exfiltrate data cross-origin
CWE-346 - Origin Validation Error

Assigner

apple mitre root Scorecard

References

11 references

URL	Tags
https://support.apple.com/en-us/121238
https://support.apple.com/en-us/121240
https://support.apple.com/en-us/121241
https://support.apple.com/en-us/121248
https://support.apple.com/en-us/121249
https://support.apple.com/en-us/121250
https://lists.debian.org/debian-lts-announce/2024…
http://seclists.org/fulldisclosure/2024/Sep/37
http://seclists.org/fulldisclosure/2024/Sep/36
http://seclists.org/fulldisclosure/2024/Sep/33
http://seclists.org/fulldisclosure/2024/Sep/32

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 18 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18 (custom)
Apple	macOS	Affected: 0 , < 15 (custom)
Apple	tvOS	Affected: 0 , < 18 (custom)
Apple	visionOS	Affected: 0 , < 2 (custom)
Apple	watchOS	Affected: 0 , < 11 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-44187",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-17T13:44:18.458972Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-14T15:25:26.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:15:32.974Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/37"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/36"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/33"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Sep/32"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-origin issue existed with \"iframe\" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A malicious website may exfiltrate data cross-origin",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:24:29.919Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121238"
        },
        {
          "url": "https://support.apple.com/en-us/121240"
        },
        {
          "url": "https://support.apple.com/en-us/121241"
        },
        {
          "url": "https://support.apple.com/en-us/121248"
        },
        {
          "url": "https://support.apple.com/en-us/121249"
        },
        {
          "url": "https://support.apple.com/en-us/121250"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-44187",
    "datePublished": "2024-09-16T23:23:16.230Z",
    "dateReserved": "2024-08-20T21:42:05.933Z",
    "dateUpdated": "2026-04-02T18:24:29.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44244 (GCVE-0-2024-44244)

Vulnerability from cvelistv5 – Published: 2024-10-28 21:08 – Updated: 2026-04-02 18:16

Summary

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may lead to an unexpected process crash.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-30 19:39 UTC

CWE

Processing maliciously crafted web content may lead to an unexpected process crash
CWE-787 - Out-of-bounds Write

Assigner

apple mitre root Scorecard

References

11 references

URL	Tags
https://support.apple.com/en-us/121563
https://support.apple.com/en-us/121564
https://support.apple.com/en-us/121565
https://support.apple.com/en-us/121566
https://support.apple.com/en-us/121569
https://support.apple.com/en-us/121571
https://lists.debian.org/debian-lts-announce/2024…
http://seclists.org/fulldisclosure/2024/Oct/19
http://seclists.org/fulldisclosure/2024/Oct/15
http://seclists.org/fulldisclosure/2024/Oct/11
http://seclists.org/fulldisclosure/2024/Oct/9

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 18.1 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.1 (custom)
Apple	macOS	Affected: 0 , < 15.1 (custom)
Apple	tvOS	Affected: 0 , < 18.1 (custom)
Apple	visionOS	Affected: 0 , < 2.1 (custom)
Apple	watchOS	Affected: 0 , < 11.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-44244",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T19:39:31.901741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-06T14:39:33.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:09:35.268Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/19"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/15"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/11"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may lead to an unexpected process crash."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to an unexpected process crash",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:16:55.139Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121563"
        },
        {
          "url": "https://support.apple.com/en-us/121564"
        },
        {
          "url": "https://support.apple.com/en-us/121565"
        },
        {
          "url": "https://support.apple.com/en-us/121566"
        },
        {
          "url": "https://support.apple.com/en-us/121569"
        },
        {
          "url": "https://support.apple.com/en-us/121571"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-44244",
    "datePublished": "2024-10-28T21:08:08.850Z",
    "dateReserved": "2024-08-20T21:45:40.785Z",
    "dateUpdated": "2026-04-02T18:16:55.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-44296 (GCVE-0-2024-44296)

Vulnerability from cvelistv5 – Published: 2024-10-28 21:07 – Updated: 2026-04-02 18:09

Summary

The issue was addressed with improved checks. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-30 14:21 UTC

CWE

Processing maliciously crafted web content may prevent Content Security Policy from being enforced
CWE-noinfo Not enough information

Assigner

apple mitre root Scorecard

References

12 references

URL	Tags
https://support.apple.com/en-us/121563
https://support.apple.com/en-us/121564
https://support.apple.com/en-us/121565
https://support.apple.com/en-us/121566
https://support.apple.com/en-us/121567
https://support.apple.com/en-us/121569
https://support.apple.com/en-us/121571
https://lists.debian.org/debian-lts-announce/2024…
http://seclists.org/fulldisclosure/2024/Oct/19
http://seclists.org/fulldisclosure/2024/Oct/16
http://seclists.org/fulldisclosure/2024/Oct/11
http://seclists.org/fulldisclosure/2024/Oct/9

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 18.1 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 17.7.1 (custom) Affected: 0 , < 18.1 (custom)
Apple	macOS	Affected: 0 , < 15.1 (custom)
Apple	tvOS	Affected: 0 , < 18.1 (custom)
Apple	visionOS	Affected: 0 , < 2.1 (custom)
Apple	watchOS	Affected: 0 , < 11.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-44296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T14:21:50.331169Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T14:28:44.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:13:04.385Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/19"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/16"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/11"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "18.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may prevent Content Security Policy from being enforced."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may prevent Content Security Policy from being enforced",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:09:19.823Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121563"
        },
        {
          "url": "https://support.apple.com/en-us/121564"
        },
        {
          "url": "https://support.apple.com/en-us/121565"
        },
        {
          "url": "https://support.apple.com/en-us/121566"
        },
        {
          "url": "https://support.apple.com/en-us/121567"
        },
        {
          "url": "https://support.apple.com/en-us/121569"
        },
        {
          "url": "https://support.apple.com/en-us/121571"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-44296",
    "datePublished": "2024-10-28T21:07:47.126Z",
    "dateReserved": "2024-08-20T21:45:40.798Z",
    "dateUpdated": "2026-04-02T18:09:19.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-54534 (GCVE-0-2024-54534)

Vulnerability from cvelistv5 – Published: 2024-12-11 22:58 – Updated: 2026-04-02 18:23

Summary

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-20 00:00 UTC

CWE

Processing maliciously crafted web content may lead to memory corruption
CWE-787 - Out-of-bounds Write

Assigner

apple mitre root Scorecard

References

13 references

URL	Tags
https://support.apple.com/en-us/121837
https://support.apple.com/en-us/121839
https://support.apple.com/en-us/121843
https://support.apple.com/en-us/121844
https://support.apple.com/en-us/121845
https://support.apple.com/en-us/121846
https://support.apple.com/en-us/122372
https://security.netapp.com/advisory/ntap-2025041…
http://seclists.org/fulldisclosure/2025/Apr/5
http://seclists.org/fulldisclosure/2024/Dec/13
http://seclists.org/fulldisclosure/2024/Dec/11
http://seclists.org/fulldisclosure/2024/Dec/7
http://seclists.org/fulldisclosure/2024/Dec/5

Impacted products

7 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 18.2 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 18.2 (custom)
Apple	iPadOS	Affected: 0 , < 17.7.6 (custom)
Apple	macOS	Affected: 0 , < 15.2 (custom)
Apple	tvOS	Affected: 0 , < 18.2 (custom)
Apple	visionOS	Affected: 0 , < 2.2 (custom)
Apple	watchOS	Affected: 0 , < 11.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-54534",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-20T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-21T04:56:02.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:32:22.994Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250418-0002/"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Apr/5"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/13"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/11"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/7"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Dec/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17.7.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "18.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "2.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "11.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to memory corruption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:23:13.588Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/121837"
        },
        {
          "url": "https://support.apple.com/en-us/121839"
        },
        {
          "url": "https://support.apple.com/en-us/121843"
        },
        {
          "url": "https://support.apple.com/en-us/121844"
        },
        {
          "url": "https://support.apple.com/en-us/121845"
        },
        {
          "url": "https://support.apple.com/en-us/121846"
        },
        {
          "url": "https://support.apple.com/en-us/122372"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2024-54534",
    "datePublished": "2024-12-11T22:58:39.974Z",
    "dateReserved": "2024-12-03T22:50:35.511Z",
    "dateUpdated": "2026-04-02T18:23:13.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-43480 (GCVE-0-2025-43480)

Vulnerability from cvelistv5 – Published: 2025-11-04 01:16 – Updated: 2026-08-05 14:29

Summary

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-04 15:32 UTC

CWE

A malicious website may exfiltrate data cross-origin
CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

apple mitre root Scorecard

References

6 references

URL	Tags
https://support.apple.com/en-us/125632
https://support.apple.com/en-us/125634
https://support.apple.com/en-us/125637
https://support.apple.com/en-us/125638
https://support.apple.com/en-us/125639
https://support.apple.com/en-us/125640

Impacted products

6 products

Vendor	Product	Version
Apple	Safari	Affected: 0 , < 26.1 (custom)
Apple	iOS and iPadOS	Affected: 0 , < 26.1 (custom)
Apple	macOS	Affected: 0 , < 26.1 (custom)
Apple	tvOS	Affected: 0 , < 26.1 (custom)
Apple	visionOS	Affected: 0 , < 26.1 (custom)
Apple	watchOS	Affected: 0 , < 26.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43480",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-04T15:32:41.895934Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-942",
                "description": "CWE-942 Permissive Cross-domain Policy with Untrusted Domains",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T14:29:08.765Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A malicious website may exfiltrate data cross-origin",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T18:16:54.266Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125632"
        },
        {
          "url": "https://support.apple.com/en-us/125634"
        },
        {
          "url": "https://support.apple.com/en-us/125637"
        },
        {
          "url": "https://support.apple.com/en-us/125638"
        },
        {
          "url": "https://support.apple.com/en-us/125639"
        },
        {
          "url": "https://support.apple.com/en-us/125640"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43480",
    "datePublished": "2025-11-04T01:16:35.173Z",
    "dateReserved": "2025-04-16T15:24:37.126Z",
    "dateUpdated": "2026-08-05T14:29:08.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:9553

CVE-2024-27856 (GCVE-0-2024-27856)

CVE-2024-40866 (GCVE-0-2024-40866)

CVE-2024-44185 (GCVE-0-2024-44185)

CVE-2024-44187 (GCVE-0-2024-44187)

CVE-2024-44244 (GCVE-0-2024-44244)

CVE-2024-44296 (GCVE-0-2024-44296)

CVE-2024-54534 (GCVE-0-2024-54534)

CVE-2025-43480 (GCVE-0-2025-43480)

Tags

Sightings

Nomenclature

Related by attack behaviour