Severity
High
Analysis Summary
CVE-2024-23226 CVSS:8.8
Apple visionOS could allow a remote attacker to execute arbitrary code on the system, caused by an issue in the WebKit component. By persuading a victim to open a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-23246 CVSS:8.8
Apple visionOS could allow a local attacker to bypass security restrictions, caused by an issue in the UIKit component. By using a specially crafted application, an attacker could exploit this vulnerability to break out of its sandbox.
CVE-2024-23220 CVSS:5.5
Apple visionOS could allow a local attacker to bypass security restrictions, caused by an issue in the Safari component. By using a specially crafted application, an attacker could exploit this vulnerability to fingerprint the user.
CVE-2024-23295 CVSS:5.5
Apple visionOS could allow a local attacker to bypass security restrictions, caused by a permissions issue in the Persona component. By using a specially crafted application, an attacker could exploit this vulnerability to use an unprotected Persona.
CVE-2024-23264 CVSS:6.5
Apple visionOS could allow a local attacker to obtain sensitive information, caused by a validation issue in the Metal component. By using a specially crafted application, an attacker could exploit this vulnerability to read restricted memory.
CVE-2024-23265 CVSS:7.1
Apple visionOS is vulnerable to a denial of service, caused by a memory corruption vulnerability in the Kernel component. By using a specially crafted application, a local attacker could exploit this vulnerability to write kernel memory or cause a denial of service.
CVE-2024-23235 CVSS:5.5
Apple visionOS could allow a local attacker to obtain sensitive information, caused by a race condition in the Kernel component. By using a specially crafted application, an attacker could exploit this vulnerability to access user-sensitive data.
CVE-2024-23286 CVSS:8.8
Apple visionOS is vulnerable to a buffer overflow, caused by improper bounds checking by the ImageIO component. By persuading a victim to open a specially crafted Web site, an attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system.
CVE-2024-23258 CVSS:8.8
Apple visionOS could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds read in the ImageIO component. By persuading a victim to open a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-23262 CVSS:6.5
Apple visionOS could allow a remote attacker to conduct spoofing attacks, caused by an error in the Accessibility component. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to spoof system notifications and UI.
CVE-2024-23257 CVSS:6.5
Apple visionOS could allow a remote attacker to obtain sensitive information, caused by an error in the ImageIO component. By persuading a victim to open a specially crafted Web site, an attacker could exploit this vulnerability to disclose process memory.
Impact
- Denial of Service
- Gain Access
- Code Execution
- Security Bypass
- Buffer Overflow
- Information Disclosure
Indicators Of Compromise
CVE
- CVE-2024-23226
- CVE-2024-23246
- CVE-2024-23220
- CVE-2024-23295
- CVE-2024-23264
- CVE-2024-23265
- CVE-2024-23235
- CVE-2024-23286
- CVE-2024-23258
- CVE-2024-23262
- CVE-2024-23257
Affected Vendors
Apple
Affected Products
- Apple iPadOS 16.7.5
- Apple iOS 16.7.5
- Apple macOS Monterey 12.7.3
- Apple visionOS 1.0
- Apple macOS Sonoma 14.3
- Apple macOS Ventura 13.6.4
Remediation
Refer to Apple Security Document for patch, upgrade or suggested workaround information.