Action not permitted
Modal body text goes here.
Modal Title
Modal Body
Vulnerability from csaf_ncscnl
Published
2025-05-13 09:19
Modified
2025-05-13 09:19
Summary
Kwetsbaarheden verholpen in Apple macOS
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Apple heeft kwetsbaarheden verholpen in macOS (Specifiek voor Ventura 13.7.6, Sequoia 15.5 en Sonoma 14.7.6).
Interpretaties
De kwetsbaarheden omvatten verschillende problemen, zoals geheugenbeschadiging door het verwerken van kwaadwillig gemaakte webinhoud, ongeautoriseerde toegang tot gevoelige gebruikersdata, en onverwachte systeemterminaties. Deze kwetsbaarheden kunnen worden misbruikt door kwaadwillenden om zich verhoogde rechten toe te kennen en zo toegang te krijgen tot gevoelige informatie of om de stabiliteit van het systeem in gevaar te brengen.
Oplossingen
Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-390
Detection of Error Condition Without Action
CWE-310
CWE-310
CWE-415
Double Free
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
CWE-265
CWE-265
CWE-404
Improper Resource Shutdown or Release
CWE-275
CWE-275
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-416
Use After Free
CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-674
Uncontrolled Recursion
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-121
Stack-based Buffer Overflow
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Apple heeft kwetsbaarheden verholpen in macOS (Specifiek voor Ventura 13.7.6, Sequoia 15.5 en Sonoma 14.7.6).", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden omvatten verschillende problemen, zoals geheugenbeschadiging door het verwerken van kwaadwillig gemaakte webinhoud, ongeautoriseerde toegang tot gevoelige gebruikersdata, en onverwachte systeemterminaties. Deze kwetsbaarheden kunnen worden misbruikt door kwaadwillenden om zich verhoogde rechten toe te kennen en zo toegang te krijgen tot gevoelige informatie of om de stabiliteit van het systeem in gevaar te brengen.", "title": "Interpretaties" }, { "category": "description", "text": "Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Detection of Error Condition Without Action", "title": "CWE-390" }, { "category": "general", "text": "CWE-310", "title": "CWE-310" }, { "category": "general", "text": "Double Free", "title": "CWE-415" }, { "category": "general", "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)", "title": "CWE-843" }, { "category": "general", "text": "CWE-265", "title": "CWE-265" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "CWE-275", "title": "CWE-275" }, { "category": "general", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" } ], "publisher": { "category": "coordinator", "contact_details": "[email protected]", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference - cveprojectv5; nvd", "url": "https://support.apple.com/en-us/122718" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd", "url": "https://support.apple.com/en-us/122717" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd", "url": "https://support.apple.com/en-us/122716" } ], "title": "Kwetsbaarheden verholpen in Apple macOS", "tracking": { "current_release_date": "2025-05-13T09:19:37.094950Z", "generator": { "date": "2025-02-25T15:15:00Z", "engine": { "name": "V.A.", "version": "1.0" } }, "id": "NCSC-2025-0151", "initial_release_date": "2025-05-13T09:19:37.094950Z", "revision_history": [ { "date": "2025-05-13T09:19:37.094950Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/\u003e=13.0|\u003c13.7.5", "product": { "name": "vers:unknown/\u003e=13.0|\u003c13.7.5", "product_id": "CSAFPID-2620946", "product_identification_helper": { "cpe": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/\u003e=14.0|\u003c14.7.5", "product": { "name": "vers:unknown/\u003e=14.0|\u003c14.7.5", "product_id": "CSAFPID-2620935", "product_identification_helper": { "cpe": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "macOS" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/\u003e=15.0|\u003c15.4", "product": { "name": "vers:unknown/\u003e=15.0|\u003c15.4", "product_id": "CSAFPID-2592049" } } ], "category": "product_name", "name": "macOS" } ], "category": "product_family", "name": "Apple" } ], "category": "vendor", "name": "Apple" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-8176", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "general", "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2024-8176", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-8176.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] } ], "title": "CVE-2024-8176" }, { "cve": "CVE-2025-24142", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-24142", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24142.json" } ], "title": "CVE-2025-24142" }, { "cve": "CVE-2025-24144", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-24144", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24144.json" } ], "title": "CVE-2025-24144" }, { "cve": "CVE-2025-24155", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-24155", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24155.json" } ], "title": "CVE-2025-24155" }, { "cve": "CVE-2025-24213", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "notes": [ { "category": "other", "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)", "title": "CWE-843" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-24213", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24213.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] } ], "title": "CVE-2025-24213" }, { "cve": "CVE-2025-24222", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-24222", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24222.json" } ], "title": "CVE-2025-24222" }, { "cve": "CVE-2025-24223", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-24223", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24223.json" } ], "title": "CVE-2025-24223" }, { "cve": "CVE-2025-24258", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-24258", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24258.json" } ], "title": "CVE-2025-24258" }, { "cve": "CVE-2025-24274", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-24274", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24274.json" } ], "title": "CVE-2025-24274" }, { "cve": "CVE-2025-26465", "cwe": { "id": "CWE-310", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-310", "title": "CWE-310" }, { "category": "other", "text": "Detection of Error Condition Without Action", "title": "CWE-390" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-26465", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26465.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] } ], "title": "CVE-2025-26465" }, { "cve": "CVE-2025-26466", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-26466", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-26466.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] } ], "title": "CVE-2025-26466" }, { "cve": "CVE-2025-30440", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-30440", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30440.json" } ], "title": "CVE-2025-30440" }, { "cve": "CVE-2025-30442", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-30442", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30442.json" } ], "title": "CVE-2025-30442" }, { "cve": "CVE-2025-30443", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-30443", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30443.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] } ], "title": "CVE-2025-30443" }, { "cve": "CVE-2025-30448", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-30448", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30448.json" } ], "title": "CVE-2025-30448" }, { "cve": "CVE-2025-30453", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-30453", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-30453.json" } ], "title": "CVE-2025-30453" }, { "cve": "CVE-2025-31196", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31196", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31196.json" } ], "title": "CVE-2025-31196" }, { "cve": "CVE-2025-31204", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31204", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31204.json" } ], "title": "CVE-2025-31204" }, { "cve": "CVE-2025-31205", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31205", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31205.json" } ], "title": "CVE-2025-31205" }, { "cve": "CVE-2025-31206", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31206", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31206.json" } ], "title": "CVE-2025-31206" }, { "cve": "CVE-2025-31208", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31208", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31208.json" } ], "title": "CVE-2025-31208" }, { "cve": "CVE-2025-31209", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31209", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31209.json" } ], "title": "CVE-2025-31209" }, { "cve": "CVE-2025-31212", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31212", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31212.json" } ], "title": "CVE-2025-31212" }, { "cve": "CVE-2025-31213", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31213", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31213.json" } ], "title": "CVE-2025-31213" }, { "cve": "CVE-2025-31215", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31215", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31215.json" } ], "title": "CVE-2025-31215" }, { "cve": "CVE-2025-31217", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31217", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31217.json" } ], "title": "CVE-2025-31217" }, { "cve": "CVE-2025-31218", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31218", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31218.json" } ], "title": "CVE-2025-31218" }, { "cve": "CVE-2025-31219", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31219", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31219.json" } ], "title": "CVE-2025-31219" }, { "cve": "CVE-2025-31220", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31220", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31220.json" } ], "title": "CVE-2025-31220" }, { "cve": "CVE-2025-31221", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31221", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31221.json" } ], "title": "CVE-2025-31221" }, { "cve": "CVE-2025-31222", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31222", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31222.json" } ], "title": "CVE-2025-31222" }, { "cve": "CVE-2025-31223", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31223", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31223.json" } ], "title": "CVE-2025-31223" }, { "cve": "CVE-2025-31224", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31224", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31224.json" } ], "title": "CVE-2025-31224" }, { "cve": "CVE-2025-31226", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31226", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31226.json" } ], "title": "CVE-2025-31226" }, { "cve": "CVE-2025-31232", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31232", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31232.json" } ], "title": "CVE-2025-31232" }, { "cve": "CVE-2025-31233", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "other", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31233", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31233.json" } ], "title": "CVE-2025-31233" }, { "cve": "CVE-2025-31234", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31234", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31234.json" } ], "title": "CVE-2025-31234" }, { "cve": "CVE-2025-31235", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "other", "text": "Double Free", "title": "CWE-415" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31235", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31235.json" } ], "title": "CVE-2025-31235" }, { "cve": "CVE-2025-31236", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31236", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31236.json" } ], "title": "CVE-2025-31236" }, { "cve": "CVE-2025-31237", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31237", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31237.json" } ], "title": "CVE-2025-31237" }, { "cve": "CVE-2025-31238", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31238", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31238.json" } ], "title": "CVE-2025-31238" }, { "cve": "CVE-2025-31239", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31239", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31239.json" } ], "title": "CVE-2025-31239" }, { "cve": "CVE-2025-31240", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31240", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31240.json" } ], "title": "CVE-2025-31240" }, { "cve": "CVE-2025-31241", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "other", "text": "Double Free", "title": "CWE-415" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31241", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31241.json" } ], "title": "CVE-2025-31241" }, { "cve": "CVE-2025-31242", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31242", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31242.json" } ], "title": "CVE-2025-31242" }, { "cve": "CVE-2025-31244", "cwe": { "id": "CWE-265", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-265", "title": "CWE-265" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31244", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31244.json" } ], "title": "CVE-2025-31244" }, { "cve": "CVE-2025-31245", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31245", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31245.json" } ], "title": "CVE-2025-31245" }, { "cve": "CVE-2025-31246", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "other", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31246", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31246.json" } ], "title": "CVE-2025-31246" }, { "cve": "CVE-2025-31247", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31247", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31247.json" } ], "title": "CVE-2025-31247" }, { "cve": "CVE-2025-31249", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31249", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31249.json" } ], "title": "CVE-2025-31249" }, { "cve": "CVE-2025-31250", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31250", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31250.json" } ], "title": "CVE-2025-31250" }, { "cve": "CVE-2025-31251", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31251", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31251.json" } ], "title": "CVE-2025-31251" }, { "cve": "CVE-2025-31256", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31256", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31256.json" } ], "title": "CVE-2025-31256" }, { "cve": "CVE-2025-31257", "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31257", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31257.json" } ], "title": "CVE-2025-31257" }, { "cve": "CVE-2025-31258", "cwe": { "id": "CWE-265", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-265", "title": "CWE-265" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31258", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31258.json" } ], "title": "CVE-2025-31258" }, { "cve": "CVE-2025-31259", "notes": [ { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31259", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31259.json" } ], "title": "CVE-2025-31259" }, { "cve": "CVE-2025-31260", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "general", "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "title": "CVSSV4" } ], "product_status": { "known_affected": [ "CSAFPID-2620946", "CSAFPID-2620935", "CSAFPID-2592049" ] }, "references": [ { "category": "self", "summary": "CVE-2025-31260", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-31260.json" } ], "title": "CVE-2025-31260" } ] }
CVE-2025-31237 (GCVE-0-2025-31237)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 20:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. Mounting a maliciously crafted AFP network share may lead to system termination.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31237", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:08:16.356369Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T20:09:24.552Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. Mounting a maliciously crafted AFP network share may lead to system termination." } ], "problemTypes": [ { "descriptions": [ { "description": "Mounting a maliciously crafted AFP network share may lead to system termination", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:55.680Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31237", "datePublished": "2025-05-12T21:42:55.680Z", "dateReserved": "2025-03-27T16:13:58.324Z", "dateUpdated": "2025-05-13T20:09:24.552Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31220 (GCVE-0-2025-31220)
Vulnerability from cvelistv5
Published
2025-05-12 21:43
Modified
2025-05-13 15:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. A malicious app may be able to read sensitive location information.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31220", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T15:27:35.984368Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T15:27:40.079Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. A malicious app may be able to read sensitive location information." } ], "problemTypes": [ { "descriptions": [ { "description": "A malicious app may be able to read sensitive location information", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:43:05.277Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31220", "datePublished": "2025-05-12T21:43:05.277Z", "dateReserved": "2025-03-27T16:13:58.319Z", "dateUpdated": "2025-05-13T15:27:40.079Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31217 (GCVE-0-2025-31217)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 15:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved input validation. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References
Impacted products
Vendor | Product | Version | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
|||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31217", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:14:03.835532Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T15:08:43.218Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved input validation. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to an unexpected Safari crash", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:58.039Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31217", "datePublished": "2025-05-12T21:42:58.039Z", "dateReserved": "2025-03-27T16:13:58.317Z", "dateUpdated": "2025-05-14T15:08:43.218Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31246 (GCVE-0-2025-31246)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 03:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6. Connecting to a malicious AFP server may corrupt kernel memory.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31246", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T03:58:22.717Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6. Connecting to a malicious AFP server may corrupt kernel memory." } ], "problemTypes": [ { "descriptions": [ { "description": "Connecting to a malicious AFP server may corrupt kernel memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:43.536Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31246", "datePublished": "2025-05-12T21:42:43.536Z", "dateReserved": "2025-03-27T16:13:58.326Z", "dateUpdated": "2025-05-14T03:58:22.717Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31240 (GCVE-0-2025-31240)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 20:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. Mounting a maliciously crafted AFP network share may lead to system termination.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31240", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:12:52.784733Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T20:13:37.227Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. Mounting a maliciously crafted AFP network share may lead to system termination." } ], "problemTypes": [ { "descriptions": [ { "description": "Mounting a maliciously crafted AFP network share may lead to system termination", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:57.249Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31240", "datePublished": "2025-05-12T21:42:57.249Z", "dateReserved": "2025-03-27T16:13:58.325Z", "dateUpdated": "2025-05-13T20:13:37.227Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-26466 (GCVE-0-2025-26466)
Vulnerability from cvelistv5
Published
2025-02-28 21:25
Modified
2025-05-27 15:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
References
Impacted products
Vendor | Product | Version | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ |
Version: 9.5p1 < |
|||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2025-03-05T03:48:43.236Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "url": "https://security.netapp.com/advisory/ntap-20250228-0002/" }, { "url": "https://www.openwall.com/lists/oss-security/2025/02/18/1" }, { "url": "https://www.openwall.com/lists/oss-security/2025/02/18/4" }, { "url": "https://bugzilla.suse.com/show_bug.cgi?id=1237041" }, { "url": "https://security-tracker.debian.org/tracker/CVE-2025-26466" }, { "url": "https://ubuntu.com/security/CVE-2025-26466" } ], "title": "CVE Program Container", "x_generator": { "engine": "ADPogram 0.0.1" } }, { "metrics": [ { "other": { "content": { "id": "CVE-2025-26466", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-03-04T19:51:35.555196Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-03-04T19:51:39.308Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "exploit" ], "url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "collectionURL": "https://www.openssh.com/", "defaultStatus": "unaffected", "packageName": "OpenSSH", "repo": "https://anongit.mindrot.org/openssh.git", "versions": [ { "lessThanOrEqual": "9.9p1", "status": "affected", "version": "9.5p1", "versionType": "custom" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:10" ], "defaultStatus": "unaffected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unaffected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unaffected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "unaffected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "unaffected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift:4" ], "defaultStatus": "unaffected", "packageName": "rhcos", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat" } ], "datePublic": "2025-02-18T00:00:00.000Z", "descriptions": [ { "lang": "en", "value": "A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-27T15:35:04.240Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2025-26466" }, { "name": "RHBZ#2345043", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345043" }, { "url": "https://seclists.org/oss-sec/2025/q1/144" }, { "url": "https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt" } ], "timeline": [ { "lang": "en", "time": "2025-02-11T19:51:30.375000+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2025-02-18T00:00:00+00:00", "value": "Made public." } ], "title": "Openssh: denial-of-service in openssh", "workarounds": [ { "lang": "en", "value": "This issue can be mitigated by setting the following three different options in the sshd configuration file located at: /etc/ssh/sshd_config\n\nMaxStartups: Set to a reasonable value, this option controls the maximum number of concurrent unauthenticated connections the SSH server accepts;\n\nPerSourcePenalties: Set its suboptions to a reasonable value, this option is used to help sshd to detect and drop connections that are potentially malicious for the SSH server;\n\nLoginGraceTime: Set to a resonable value, this option controls how much time the SSH server will wait the client to authenticate before dropping its connection;\n\nAll the three option above needs to be set to implement a full mitigation for this vulnerability." } ], "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2025-26466", "datePublished": "2025-02-28T21:25:28.861Z", "dateReserved": "2025-02-10T18:31:47.979Z", "dateUpdated": "2025-05-27T15:35:04.240Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31245 (GCVE-0-2025-31245)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 15:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. An app may be able to cause unexpected system termination.
References
Impacted products
Vendor | Product | Version | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
|||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31245", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T19:50:43.466114Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T15:12:57.701Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. An app may be able to cause unexpected system termination." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to cause unexpected system termination", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:37.847Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31245", "datePublished": "2025-05-12T21:42:37.847Z", "dateReserved": "2025-03-27T16:13:58.326Z", "dateUpdated": "2025-05-14T15:12:57.701Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31247 (GCVE-0-2025-31247)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An attacker may gain access to protected parts of the file system.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31247", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T19:57:04.844577Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T19:57:47.873Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An attacker may gain access to protected parts of the file system." } ], "problemTypes": [ { "descriptions": [ { "description": "An attacker may gain access to protected parts of the file system", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:53.294Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31247", "datePublished": "2025-05-12T21:42:53.294Z", "dateReserved": "2025-03-27T16:13:58.327Z", "dateUpdated": "2025-05-13T19:57:47.873Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31256 (GCVE-0-2025-31256)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 15:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may unexpectedly reveal a user’s deleted notes.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31256", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:17:02.712127Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T15:07:52.507Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may unexpectedly reveal a user\u2019s deleted notes." } ], "problemTypes": [ { "descriptions": [ { "description": "Hot corner may unexpectedly reveal a user\u2019s deleted notes", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:59.586Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31256", "datePublished": "2025-05-12T21:42:59.586Z", "dateReserved": "2025-03-27T16:13:58.336Z", "dateUpdated": "2025-05-14T15:07:52.507Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31226 (GCVE-0-2025-31226)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 14:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A logic issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5. Processing a maliciously crafted image may lead to a denial-of-service.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31226", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T14:19:17.923851Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T14:20:02.678Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A logic issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5. Processing a maliciously crafted image may lead to a denial-of-service." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing a maliciously crafted image may lead to a denial-of-service", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:49.304Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31226", "datePublished": "2025-05-12T21:42:49.304Z", "dateReserved": "2025-03-27T16:13:58.321Z", "dateUpdated": "2025-05-14T14:20:02.678Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31259 (GCVE-0-2025-31259)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 04:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.5. An app may be able to gain elevated privileges.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31259", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T04:01:08.599Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.5. An app may be able to gain elevated privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to gain elevated privileges", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:27.483Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31259", "datePublished": "2025-05-12T21:42:27.483Z", "dateReserved": "2025-03-27T16:13:58.337Z", "dateUpdated": "2025-05-14T04:01:08.599Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31215 (GCVE-0-2025-31215)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-15 13:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References
Impacted products
Vendor | Product | Version | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
|||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31215", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-15T13:19:08.839012Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-15T13:19:54.212Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected process crash." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to an unexpected process crash", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:19.514Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31215", "datePublished": "2025-05-12T21:42:19.514Z", "dateReserved": "2025-03-27T16:13:58.317Z", "dateUpdated": "2025-05-15T13:19:54.212Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31238 (GCVE-0-2025-31238)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 14:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31238", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T04:01:06.785333Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T14:50:44.545Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to memory corruption", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:22.605Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31238", "datePublished": "2025-05-12T21:42:22.605Z", "dateReserved": "2025-03-27T16:13:58.324Z", "dateUpdated": "2025-05-14T14:50:44.545Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31221 (GCVE-0-2025-31221)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 15:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. A remote attacker may be able to leak memory.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31221", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:01:21.848724Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T15:10:16.947Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. A remote attacker may be able to leak memory." } ], "problemTypes": [ { "descriptions": [ { "description": "A remote attacker may be able to leak memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:54.091Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31221", "datePublished": "2025-05-12T21:42:54.091Z", "dateReserved": "2025-03-27T16:13:58.319Z", "dateUpdated": "2025-05-14T15:10:16.947Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31258 (GCVE-0-2025-31258)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 04:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31258", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T04:00:59.907Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to break out of its sandbox", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:14.699Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31258", "datePublished": "2025-05-12T21:42:14.699Z", "dateReserved": "2025-03-27T16:13:58.337Z", "dateUpdated": "2025-05-14T04:00:59.907Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31223 (GCVE-0-2025-31223)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 04:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31223", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T04:01:02.555Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to memory corruption", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:17.904Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31223", "datePublished": "2025-05-12T21:42:17.904Z", "dateReserved": "2025-03-27T16:13:58.320Z", "dateUpdated": "2025-05-14T04:01:02.555Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31209 (GCVE-0-2025-31209)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 18:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Parsing a file may lead to disclosure of user information.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31209", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T18:31:02.868813Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T18:44:44.493Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Parsing a file may lead to disclosure of user information." } ], "problemTypes": [ { "descriptions": [ { "description": "Parsing a file may lead to disclosure of user information", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:31.448Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31209", "datePublished": "2025-05-12T21:42:31.448Z", "dateReserved": "2025-03-27T16:13:58.316Z", "dateUpdated": "2025-05-13T18:44:44.493Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31219 (GCVE-0-2025-31219)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 17:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. An attacker may be able to cause unexpected system termination or corrupt kernel memory.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31219", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T17:39:44.010039Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T17:43:13.567Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. An attacker may be able to cause unexpected system termination or corrupt kernel memory." } ], "problemTypes": [ { "descriptions": [ { "description": "An attacker may be able to cause unexpected system termination or corrupt kernel memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:15.542Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31219", "datePublished": "2025-05-12T21:42:15.542Z", "dateReserved": "2025-03-27T16:13:58.317Z", "dateUpdated": "2025-05-13T17:43:13.567Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31244 (GCVE-0-2025-31244)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 04:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31244", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T04:01:10.043Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to break out of its sandbox", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:30.676Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31244", "datePublished": "2025-05-12T21:42:30.676Z", "dateReserved": "2025-03-27T16:13:58.326Z", "dateUpdated": "2025-05-14T04:01:10.043Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31232 (GCVE-0-2025-31232)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 19:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. A sandboxed app may be able to access sensitive user data.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31232", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T19:12:09.390038Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T19:13:57.072Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. A sandboxed app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "A sandboxed app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:34.632Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31232", "datePublished": "2025-05-12T21:42:34.632Z", "dateReserved": "2025-03-27T16:13:58.323Z", "dateUpdated": "2025-05-13T19:13:57.072Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2024-8176 (GCVE-0-2024-8176)
Vulnerability from cvelistv5
Published
2025-03-14 08:19
Modified
2025-06-02 14:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ |
Version: 0 ≤ |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-8176", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-03-14T13:13:22.690073Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-03-14T13:14:00.908Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2025-05-09T13:10:25.026Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "url": "http://www.openwall.com/lists/oss-security/2025/03/15/1" }, { "url": "https://blog.hartwork.org/posts/expat-2-7-0-released/" }, { "url": "https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52" }, { "url": "https://bugzilla.suse.com/show_bug.cgi?id=1239618" }, { "url": "https://ubuntu.com/security/CVE-2024-8176" }, { "url": "https://security-tracker.debian.org/tracker/CVE-2024-8176" }, { "url": "https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53" }, { "url": "https://security.netapp.com/advisory/ntap-20250328-0009/" }, { "url": "https://www.kb.cert.org/vuls/id/760160" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "collectionURL": "https://github.com/libexpat/libexpat/", "defaultStatus": "unaffected", "packageName": "libexpat", "versions": [ { "lessThan": "2.7.0", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:10.0" ], "defaultStatus": "affected", "packageName": "expat", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.7.1-1.el10_0", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "expat", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.2.5-17.el8_10", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-11.el8_10", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_aus:8.2::baseos" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-5.el8_2.2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_e4s:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_tus:8.4::baseos" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-5.el8_4.2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_e4s:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_tus:8.4::baseos" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-5.el8_4.2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_e4s:8.4::baseos", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_tus:8.4::baseos" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-5.el8_4.2", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_tus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_aus:8.6::baseos" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-6.el8_6.1", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_tus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_aus:8.6::baseos" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-6.el8_6.1", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_tus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_aus:8.6::baseos" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-6.el8_6.1", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_eus:8.8::baseos", "cpe:/a:redhat:rhel_eus:8.8::crb" ], "defaultStatus": "affected", "packageName": "xmlrpc-c", "product": "Red Hat Enterprise Linux 8.8 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:1.51.0-8.el8_8.1", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "expat", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.5.0-3.el9_5.3", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "expat", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.5.0-5.el9_6", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "expat", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.5.0-3.el9_5.3", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "expat", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:2.5.0-5.el9_6", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:devworkspace:0.33::el9" ], "defaultStatus": "affected", "packageName": "registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9", "product": "DevWorkspace Operator 0.33", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "sha256:b41c498da32fde3fa636594ef93d2206ca1a3bc306e401eaae035dc18d30654a", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:discovery:1.14::el9" ], "defaultStatus": "affected", "packageName": "registry.redhat.io/discovery/discovery-server-rhel9", "product": "Red Hat Discovery 1.14", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:discovery:1.14::el9" ], "defaultStatus": "affected", "packageName": "registry.redhat.io/discovery/discovery-ui-rhel9", "product": "Red Hat Discovery 1.14", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unknown", "packageName": "compat-expat1", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unknown", "packageName": "expat", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "expat", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "firefox", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "affected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "unaffected", "packageName": "lua-expat", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "affected", "packageName": "mingw-expat", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "affected", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "affected", "packageName": "firefox", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "affected", "packageName": "firefox:flatpak/firefox", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "affected", "packageName": "thunderbird", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ], "defaultStatus": "affected", "packageName": "thunderbird:flatpak/thunderbird", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": [ "cpe:/a:redhat:jboss_core_services:1" ], "defaultStatus": "affected", "packageName": "expat", "product": "Red Hat JBoss Core Services", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift:4" ], "defaultStatus": "affected", "packageName": "rhcos", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat" } ], "credits": [ { "lang": "en", "value": "This issue was discovered by Jann Horn (Google Project Zero), Sandipan Roy (Red Hat), Sebastian Pipping (libexpat), and Tomas Korbar (Red Hat)." } ], "datePublic": "2025-03-13T13:51:54.957Z", "descriptions": [ { "lang": "en", "value": "A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-674", "description": "Uncontrolled Recursion", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-06-02T14:19:36.364Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2025:3531", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:3531" }, { "name": "RHSA-2025:3734", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:3734" }, { "name": "RHSA-2025:3913", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:3913" }, { "name": "RHSA-2025:4048", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:4048" }, { "name": "RHSA-2025:4446", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:4446" }, { "name": "RHSA-2025:4447", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:4447" }, { "name": "RHSA-2025:4448", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:4448" }, { "name": "RHSA-2025:4449", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:4449" }, { "name": "RHSA-2025:7444", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:7444" }, { "name": "RHSA-2025:7512", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:7512" }, { "name": "RHSA-2025:8385", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:8385" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2024-8176" }, { "name": "RHBZ#2310137", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310137" }, { "url": "https://github.com/libexpat/libexpat/issues/893" } ], "timeline": [ { "lang": "en", "time": "2024-06-12T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2025-03-13T13:51:54.957000+00:00", "value": "Made public." } ], "title": "Libexpat: expat: improper restriction of xml entity expansion depth in libexpat", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability." } ], "x_redhatCweChain": "CWE-674: Uncontrolled Recursion" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2024-8176", "datePublished": "2025-03-14T08:19:48.962Z", "dateReserved": "2024-08-26T12:36:40.985Z", "dateUpdated": "2025-06-02T14:19:36.364Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-30448 (GCVE-0-2025-30448)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sonoma 14.7.6, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, visionOS 2.5, macOS Ventura 13.7.6, macOS Sequoia 15.4. An attacker may be able to turn on sharing of an iCloud folder without authentication.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-30448", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T16:29:01.467979Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T16:30:02.707Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.4", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sonoma 14.7.6, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, visionOS 2.5, macOS Ventura 13.7.6, macOS Sequoia 15.4. An attacker may be able to turn on sharing of an iCloud folder without authentication." } ], "problemTypes": [ { "descriptions": [ { "description": "An attacker may be able to turn on sharing of an iCloud folder without authentication", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:26.699Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122718" }, { "url": "https://support.apple.com/en-us/122373" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-30448", "datePublished": "2025-05-12T21:42:26.699Z", "dateReserved": "2025-03-22T00:04:43.719Z", "dateUpdated": "2025-05-14T16:30:02.707Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-24142 (GCVE-0-2025-24142)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 16:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to access sensitive user data.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-24142", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T16:18:39.450392Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T16:20:04.188Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:29.107Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-24142", "datePublished": "2025-05-12T21:42:29.107Z", "dateReserved": "2025-01-17T00:00:44.975Z", "dateUpdated": "2025-05-14T16:20:04.188Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-26465 (GCVE-0-2025-26465)
Vulnerability from cvelistv5
Published
2025-02-18 18:27
Modified
2025-06-02 14:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
References
▼ | URL | Tags |
---|---|---|
https://access.redhat.com/errata/RHSA-2025:3837 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2025:6993 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/errata/RHSA-2025:8385 | vendor-advisory, x_refsource_REDHAT | |
https://access.redhat.com/security/cve/CVE-2025-26465 | vdb-entry, x_refsource_REDHAT | |
https://bugzilla.redhat.com/show_bug.cgi?id=2344780 | issue-tracking, x_refsource_REDHAT | |
https://seclists.org/oss-sec/2025/q1/144 |
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ |
Version: 6.8p1 < |
||||||||||||||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2025-03-03T17:48:15.682Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00020.html" }, { "url": "https://www.openwall.com/lists/oss-security/2025/02/18/1" }, { "url": "https://www.openwall.com/lists/oss-security/2025/02/18/4" }, { "url": "https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/" }, { "url": "https://bugzilla.suse.com/show_bug.cgi?id=1237040" }, { "url": "https://security-tracker.debian.org/tracker/CVE-2025-26465" }, { "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig" }, { "url": "https://ubuntu.com/security/CVE-2025-26465" }, { "url": "https://www.openssh.com/releasenotes.html#9.9p2" }, { "url": "https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466" }, { "url": "https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-February/000161.html" }, { "url": "https://security.netapp.com/advisory/ntap-20250228-0003/" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-26465-detect-vulnerable-openssh" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-26465-mitigate-vulnerable-openssh" } ], "title": "CVE Program Container", "x_generator": { "engine": "ADPogram 0.0.1" } }, { "metrics": [ { "other": { "content": { "id": "CVE-2025-26465", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-02-19T15:02:09.369445Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-02-19T15:02:45.555Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "exploit" ], "url": "https://seclists.org/oss-sec/2025/q1/144" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "collectionURL": "https://www.openssh.com/", "defaultStatus": "unaffected", "packageName": "OpenSSH", "repo": "https://anongit.mindrot.org/openssh.git", "versions": [ { "lessThanOrEqual": "9.9p1", "status": "affected", "version": "6.8p1", "versionType": "custom" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:8.7p1-45.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream" ], "defaultStatus": "affected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:8.7p1-45.el9", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:rhel_eus:9.4::baseos", "cpe:/a:redhat:rhel_eus:9.4::appstream" ], "defaultStatus": "affected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:8.7p1-38.el9_4.5", "versionType": "rpm" } ] }, { "collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": [ "cpe:/a:redhat:discovery:1.14::el9" ], "defaultStatus": "affected", "packageName": "registry.redhat.io/discovery/discovery-server-rhel9", "product": "Red Hat Discovery 1.14", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:10" ], "defaultStatus": "unaffected", "packageName": "openssh", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "unknown", "packageName": "openssh", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "unknown", "packageName": "openssh", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ], "defaultStatus": "unknown", "packageName": "openssh", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift:4" ], "defaultStatus": "affected", "packageName": "rhcos", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat" } ], "datePublic": "2025-02-17T00:00:00.000Z", "descriptions": [ { "lang": "en", "value": "A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client\u0027s memory resource first, turning the attack complexity high." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Moderate" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-390", "description": "Detection of Error Condition Without Action", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-06-02T14:24:09.238Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2025:3837", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:3837" }, { "name": "RHSA-2025:6993", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:6993" }, { "name": "RHSA-2025:8385", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2025:8385" }, { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2025-26465" }, { "name": "RHBZ#2344780", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344780" }, { "url": "https://seclists.org/oss-sec/2025/q1/144" } ], "timeline": [ { "lang": "en", "time": "2025-02-10T21:56:03.853000+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2025-02-17T00:00:00+00:00", "value": "Made public." } ], "title": "Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability." } ], "x_redhatCweChain": "CWE-390: Detection of Error Condition Without Action" } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2025-26465", "datePublished": "2025-02-18T18:27:16.843Z", "dateReserved": "2025-02-10T18:31:47.978Z", "dateUpdated": "2025-06-02T14:24:09.238Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-30442 (GCVE-0-2025-30442)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 04:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.4, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. An app may be able to gain elevated privileges.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-30442", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T04:01:12.801Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.4", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.4, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. An app may be able to gain elevated privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to gain elevated privileges", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:41.066Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" }, { "url": "https://support.apple.com/en-us/122373" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-30442", "datePublished": "2025-05-12T21:42:41.066Z", "dateReserved": "2025-03-22T00:04:43.718Z", "dateUpdated": "2025-05-14T04:01:12.801Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31208 (GCVE-0-2025-31208)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 19:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Parsing a file may lead to an unexpected app termination.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31208", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T19:31:13.824525Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T19:36:24.438Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Parsing a file may lead to an unexpected app termination." } ], "problemTypes": [ { "descriptions": [ { "description": "Parsing a file may lead to an unexpected app termination", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:36.245Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31208", "datePublished": "2025-05-12T21:42:36.245Z", "dateReserved": "2025-03-27T16:13:58.316Z", "dateUpdated": "2025-05-13T19:36:24.438Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31239 (GCVE-0-2025-31239)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 13:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Parsing a file may lead to an unexpected app termination.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31239", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T13:14:35.419282Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T13:14:43.136Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Parsing a file may lead to an unexpected app termination." } ], "problemTypes": [ { "descriptions": [ { "description": "Parsing a file may lead to an unexpected app termination", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:21.804Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31239", "datePublished": "2025-05-12T21:42:21.804Z", "dateReserved": "2025-03-27T16:13:58.325Z", "dateUpdated": "2025-05-13T13:14:43.136Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31242 (GCVE-0-2025-31242)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 13:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to access sensitive user data.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31242", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T13:05:07.565230Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T13:34:56.454Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:21.043Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31242", "datePublished": "2025-05-12T21:42:21.043Z", "dateReserved": "2025-03-27T16:13:58.325Z", "dateUpdated": "2025-05-14T13:34:56.454Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-24274 (GCVE-0-2025-24274)
Vulnerability from cvelistv5
Published
2025-05-12 21:43
Modified
2025-05-13 21:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An input validation issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. A malicious app may be able to gain root privileges.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-24274", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T14:34:02.747281Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T21:00:59.615Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An input validation issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. A malicious app may be able to gain root privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "A malicious app may be able to gain root privileges", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:43:02.055Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-24274", "datePublished": "2025-05-12T21:43:02.055Z", "dateReserved": "2025-01-17T00:00:45.017Z", "dateUpdated": "2025-05-13T21:00:59.615Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31205 (GCVE-0-2025-31205)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 15:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31205", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T15:33:25.751520Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T15:34:09.750Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin." } ], "problemTypes": [ { "descriptions": [ { "description": "A malicious website may exfiltrate data cross-origin", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:28.329Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31205", "datePublished": "2025-05-12T21:42:28.329Z", "dateReserved": "2025-03-27T16:13:58.315Z", "dateUpdated": "2025-05-13T15:34:09.750Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31212 (GCVE-0-2025-31212)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 15:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
This issue was addressed through improved state management. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5. An app may be able to access sensitive user data.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31212", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T19:52:25.278668Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T15:12:30.846Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:38.635Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31212", "datePublished": "2025-05-12T21:42:38.635Z", "dateReserved": "2025-03-27T16:13:58.316Z", "dateUpdated": "2025-05-14T15:12:30.846Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31206 (GCVE-0-2025-31206)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 20:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References
Impacted products
Vendor | Product | Version | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
|||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31206", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:02:58.901261Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T20:05:40.702Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to an unexpected Safari crash", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:51.688Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31206", "datePublished": "2025-05-12T21:42:51.688Z", "dateReserved": "2025-03-27T16:13:58.316Z", "dateUpdated": "2025-05-13T20:05:40.702Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31249 (GCVE-0-2025-31249)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 19:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31249", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T19:20:20.993033Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T19:24:45.716Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:35.469Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31249", "datePublished": "2025-05-12T21:42:35.469Z", "dateReserved": "2025-03-27T16:13:58.328Z", "dateUpdated": "2025-05-13T19:24:45.716Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-30453 (GCVE-0-2025-30453)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 04:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.4, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. A malicious app may be able to gain root privileges.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-30453", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-280", "description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T04:01:04.195Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.4", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.4, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. A malicious app may be able to gain root privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "A malicious app may be able to gain root privileges", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:20.267Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" }, { "url": "https://support.apple.com/en-us/122373" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-30453", "datePublished": "2025-05-12T21:42:20.267Z", "dateReserved": "2025-03-22T00:04:43.720Z", "dateUpdated": "2025-05-14T04:01:04.195Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-30443 (GCVE-0-2025-30443)
Vulnerability from cvelistv5
Published
2025-03-31 22:22
Modified
2025-04-01 14:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-30443", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-04-01T14:32:12.159713Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-04-01T14:32:43.168Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.4", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access user-sensitive data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-03-31T22:22:55.491Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122373" }, { "url": "https://support.apple.com/en-us/122374" }, { "url": "https://support.apple.com/en-us/122375" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-30443", "datePublished": "2025-03-31T22:22:55.491Z", "dateReserved": "2025-03-22T00:04:43.718Z", "dateUpdated": "2025-04-01T14:32:43.168Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31204 (GCVE-0-2025-31204)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 20:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31204", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:16:09.153438Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T20:16:54.099Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to memory corruption", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:40.287Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31204", "datePublished": "2025-05-12T21:42:40.287Z", "dateReserved": "2025-03-27T16:13:58.315Z", "dateUpdated": "2025-05-13T20:16:54.099Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31213 (GCVE-0-2025-31213)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 17:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to access associated usernames and websites in a user's iCloud Keychain.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31213", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T17:43:47.906339Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T17:45:13.801Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to access associated usernames and websites in a user\u0027s iCloud Keychain." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access associated usernames and websites in a user\u0027s iCloud Keychain", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:29.916Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31213", "datePublished": "2025-05-12T21:42:29.916Z", "dateReserved": "2025-03-27T16:13:58.316Z", "dateUpdated": "2025-05-13T17:45:13.801Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31233 (GCVE-0-2025-31233)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved input sanitization. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31233", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T18:52:20.606493Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T18:55:58.998Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved input sanitization. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:32.246Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31233", "datePublished": "2025-05-12T21:42:32.246Z", "dateReserved": "2025-03-27T16:13:58.323Z", "dateUpdated": "2025-05-13T18:55:58.998Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-30440 (GCVE-0-2025-30440)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 14:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to bypass ASLR.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-30440", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T14:13:43.737258Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T14:16:49.342Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to bypass ASLR." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to bypass ASLR", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:50.894Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-30440", "datePublished": "2025-05-12T21:42:50.894Z", "dateReserved": "2025-03-22T00:04:43.717Z", "dateUpdated": "2025-05-14T14:16:49.342Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31236 (GCVE-0-2025-31236)
Vulnerability from cvelistv5
Published
2025-05-12 21:43
Modified
2025-05-14 15:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31236", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:18:22.367702Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T15:07:24.351Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:43:03.702Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31236", "datePublished": "2025-05-12T21:43:03.702Z", "dateReserved": "2025-03-27T16:13:58.324Z", "dateUpdated": "2025-05-14T15:07:24.351Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31196 (GCVE-0-2025-31196)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31196", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:07:11.309670Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T20:07:39.111Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:46.070Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31196", "datePublished": "2025-05-12T21:42:46.070Z", "dateReserved": "2025-03-27T16:13:58.313Z", "dateUpdated": "2025-05-13T20:07:39.111Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31218 (GCVE-0-2025-31218)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 19:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to observe the hostnames of new network connections.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31218", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T19:46:32.051455Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T19:46:57.375Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to observe the hostnames of new network connections." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to observe the hostnames of new network connections", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:25.925Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31218", "datePublished": "2025-05-12T21:42:25.925Z", "dateReserved": "2025-03-27T16:13:58.317Z", "dateUpdated": "2025-05-14T19:46:57.375Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31241 (GCVE-0-2025-31241)
Vulnerability from cvelistv5
Published
2025-05-12 21:43
Modified
2025-05-13 15:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A double free issue was addressed with improved memory management. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. A remote attacker may cause an unexpected app termination.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31241", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T15:30:28.730438Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-415", "description": "CWE-415 Double Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T15:30:49.929Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A double free issue was addressed with improved memory management. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. A remote attacker may cause an unexpected app termination." } ], "problemTypes": [ { "descriptions": [ { "description": "A remote attacker may cause an unexpected app termination", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:43:01.167Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31241", "datePublished": "2025-05-12T21:43:01.167Z", "dateReserved": "2025-03-27T16:13:58.325Z", "dateUpdated": "2025-05-13T15:30:49.929Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31251 (GCVE-0-2025-31251)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 14:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved input sanitization. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31251", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T14:17:34.923707Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T14:18:46.477Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved input sanitization. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:50.091Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31251", "datePublished": "2025-05-12T21:42:50.091Z", "dateReserved": "2025-03-27T16:13:58.335Z", "dateUpdated": "2025-05-14T14:18:46.477Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31260 (GCVE-0-2025-31260)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 15:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31260", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:06:53.819418Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T15:10:34.418Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:54.868Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31260", "datePublished": "2025-05-12T21:42:54.868Z", "dateReserved": "2025-03-27T16:13:58.337Z", "dateUpdated": "2025-05-14T15:10:34.418Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-24155 (GCVE-0-2025-24155)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 13:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. An app may be able to disclose kernel memory.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-24155", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T13:16:00.265396Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T13:30:10.702Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. An app may be able to disclose kernel memory." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to disclose kernel memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:39.451Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122068" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-24155", "datePublished": "2025-05-12T21:42:39.451Z", "dateReserved": "2025-01-17T00:00:44.985Z", "dateUpdated": "2025-05-14T13:30:10.702Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31234 (GCVE-0-2025-31234)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-15 13:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved input sanitization. This issue is fixed in visionOS 2.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5. An attacker may be able to cause unexpected system termination or corrupt kernel memory.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31234", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-15T13:39:25.935996Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-15T13:39:35.860Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved input sanitization. This issue is fixed in visionOS 2.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5. An attacker may be able to cause unexpected system termination or corrupt kernel memory." } ], "problemTypes": [ { "descriptions": [ { "description": "An attacker may be able to cause unexpected system termination or corrupt kernel memory", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:25.134Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31234", "datePublished": "2025-05-12T21:42:25.134Z", "dateReserved": "2025-03-27T16:13:58.323Z", "dateUpdated": "2025-05-15T13:39:35.860Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-24222 (GCVE-0-2025-24222)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 15:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-24222", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T20:10:04.620426Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T15:09:22.472Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5. Processing maliciously crafted web content may lead to an unexpected process crash." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to an unexpected process crash", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:56.449Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-24222", "datePublished": "2025-05-12T21:42:56.449Z", "dateReserved": "2025-01-17T00:00:45.004Z", "dateUpdated": "2025-05-14T15:09:22.472Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-24144 (GCVE-0-2025-24144)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-15 13:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6, visionOS 2.3, iPadOS 17.7.7, watchOS 11.3, macOS Ventura 13.7.6, iOS 18.3 and iPadOS 18.3, tvOS 18.3. An app may be able to leak sensitive kernel state.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | visionOS |
Version: unspecified < 2.3 |
||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-24144", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-15T13:18:15.650186Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-15T13:18:37.840Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.3", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6, visionOS 2.3, iPadOS 17.7.7, watchOS 11.3, macOS Ventura 13.7.6, iOS 18.3 and iPadOS 18.3, tvOS 18.3. An app may be able to leak sensitive kernel state." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to leak sensitive kernel state", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:18.713Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122073" }, { "url": "https://support.apple.com/en-us/122072" }, { "url": "https://support.apple.com/en-us/122068" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" }, { "url": "https://support.apple.com/en-us/122071" }, { "url": "https://support.apple.com/en-us/122066" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-24144", "datePublished": "2025-05-12T21:42:18.713Z", "dateReserved": "2025-01-17T00:00:44.975Z", "dateUpdated": "2025-05-15T13:18:37.840Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31250 (GCVE-0-2025-31250)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 13:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
References
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31250", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-14T13:17:18.723565Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T13:22:45.316Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to access sensitive user data", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:45.248Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31250", "datePublished": "2025-05-12T21:42:45.248Z", "dateReserved": "2025-03-27T16:13:58.335Z", "dateUpdated": "2025-05-14T13:22:45.316Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-24258 (GCVE-0-2025-24258)
Vulnerability from cvelistv5
Published
2025-05-12 21:43
Modified
2025-05-13 15:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. An app may be able to gain root privileges.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-24258", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T15:28:02.749248Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T15:28:48.161Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.4", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Ventura 13.7.6, macOS Sonoma 14.7.6. An app may be able to gain root privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to gain root privileges", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:43:04.481Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" }, { "url": "https://support.apple.com/en-us/122373" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-24258", "datePublished": "2025-05-12T21:43:04.481Z", "dateReserved": "2025-01-17T00:00:45.015Z", "dateUpdated": "2025-05-13T15:28:48.161Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31222 (GCVE-0-2025-31222)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 04:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A correctness issue was addressed with improved checks. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. A user may be able to elevate privileges.
References
Impacted products
Vendor | Product | Version | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
|||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31222", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T04:01:07.096Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A correctness issue was addressed with improved checks. This issue is fixed in watchOS 11.5, macOS Sonoma 14.7.6, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, macOS Ventura 13.7.6. A user may be able to elevate privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "A user may be able to elevate privileges", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:24.325Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31222", "datePublished": "2025-05-12T21:42:24.325Z", "dateReserved": "2025-03-27T16:13:58.319Z", "dateUpdated": "2025-05-14T04:01:07.096Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-24213 (GCVE-0-2025-24213)
Vulnerability from cvelistv5
Published
2025-03-31 22:23
Modified
2025-05-13 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
This issue was addressed with improved handling of floats. This issue is fixed in tvOS 18.5, Safari 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, watchOS 11.5, visionOS 2.5. A type confusion issue could lead to memory corruption.
References
Impacted products
Vendor | Product | Version | ||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Apple | tvOS |
Version: unspecified < 18.5 |
|||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-24213", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-04-02T03:55:29.888734Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-04-03T17:46:55.488Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed with improved handling of floats. This issue is fixed in tvOS 18.5, Safari 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, watchOS 11.5, visionOS 2.5. A type confusion issue could lead to memory corruption." } ], "problemTypes": [ { "descriptions": [ { "description": "A type confusion issue could lead to memory corruption", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T16:29:10.048Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122719" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122721" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-24213", "datePublished": "2025-03-31T22:23:48.296Z", "dateReserved": "2025-01-17T00:00:45.002Z", "dateUpdated": "2025-05-13T16:29:10.048Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31235 (GCVE-0-2025-31235)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-13 13:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A double free issue was addressed with improved memory management. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to cause unexpected system termination.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31235", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T13:16:27.418167Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-415", "description": "CWE-415 Double Free", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T13:19:21.777Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "17.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A double free issue was addressed with improved memory management. This issue is fixed in iPadOS 17.7.7, macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to cause unexpected system termination." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to cause unexpected system termination", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:17.107Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122405" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31235", "datePublished": "2025-05-12T21:42:17.107Z", "dateReserved": "2025-03-27T16:13:58.323Z", "dateUpdated": "2025-05-13T13:19:21.777Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31257 (GCVE-0-2025-31257)
Vulnerability from cvelistv5
Published
2025-05-12 21:43
Modified
2025-05-13 15:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
This issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31257", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T15:31:38.297730Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T15:32:24.197Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "This issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to an unexpected Safari crash", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:43:00.387Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31257", "datePublished": "2025-05-12T21:43:00.387Z", "dateReserved": "2025-03-27T16:13:58.337Z", "dateUpdated": "2025-05-13T15:32:24.197Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-24223 (GCVE-0-2025-24223)
Vulnerability from cvelistv5
Published
2025-05-12 21:43
Modified
2025-05-13 14:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-24223", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T14:41:21.794473Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-13T14:41:25.598Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "tvOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "visionOS", "vendor": "Apple", "versions": [ { "lessThan": "2.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "watchOS", "vendor": "Apple", "versions": [ { "lessThan": "11.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "Safari", "vendor": "Apple", "versions": [ { "lessThan": "18.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption." } ], "problemTypes": [ { "descriptions": [ { "description": "Processing maliciously crafted web content may lead to memory corruption", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:43:02.866Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122720" }, { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122404" }, { "url": "https://support.apple.com/en-us/122721" }, { "url": "https://support.apple.com/en-us/122722" }, { "url": "https://support.apple.com/en-us/122719" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-24223", "datePublished": "2025-05-12T21:43:02.866Z", "dateReserved": "2025-01-17T00:00:45.004Z", "dateUpdated": "2025-05-13T14:41:25.598Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-31224 (GCVE-0-2025-31224)
Vulnerability from cvelistv5
Published
2025-05-12 21:42
Modified
2025-05-14 04:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to bypass certain Privacy preferences.
References
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2025-31224", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-05-13T00:00:00+00:00", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-14T04:01:11.407Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "15.5", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "14.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] }, { "product": "macOS", "vendor": "Apple", "versions": [ { "lessThan": "13.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to bypass certain Privacy preferences." } ], "problemTypes": [ { "descriptions": [ { "description": "An app may be able to bypass certain Privacy preferences", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2025-05-12T21:42:33.877Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/122716" }, { "url": "https://support.apple.com/en-us/122717" }, { "url": "https://support.apple.com/en-us/122718" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2025-31224", "datePublished": "2025-05-12T21:42:33.877Z", "dateReserved": "2025-03-27T16:13:58.321Z", "dateUpdated": "2025-05-14T04:01:11.407Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…