CVE-2024-27833
published 2024-06-10CVE-2024-27833: An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5…
PriorityP351high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.82%
53.0th percentile
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_16.7.8_and_ipados | — | — |
| apple | ios_17.5_and_ipados | — | — |
| apple | ios_and_ipados | < 16.7.8 | 16.7.8 |
| apple | ios_and_ipados | < 17.5 | 17.5 |
| apple | ipados | < 16.7.8 | 16.7.8 |
| apple | ipados | >= 17.0 < 17.5 | 17.5 |
| apple | iphone_os | < 16.7.8 | 16.7.8 |
| apple | iphone_os | >= 17.0 < 17.5 | 17.5 |
| apple | safari | < 17.5 | 17.5 |
| apple | safari | — | — |
| apple | tvos | < 17.5 | 17.5 |
| apple | tvos | — | — |
| apple | visionos | < 1.2 | 1.2 |
| apple | visionos | — | — |
| debian | webkit2gtk | < webkit2gtk 2.44.2-1~deb12u1 (bookworm) | webkit2gtk 2.44.2-1~deb12u1 (bookworm) |
| debian | wpewebkit | < webkit2gtk 2.44.2-1~deb12u1 (bookworm) | webkit2gtk 2.44.2-1~deb12u1 (bookworm) |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
vendor_redhat·2024-09-25·CVSS 8.8
CVE-2024-27833 [HIGH] CWE-119 webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution.
A vulnerability was found in WebKit. This flaw allows a remote attacker to perform arbitrary code execution when processing web content. This flaw is caused by insufficient input validation, which attackers could exploit to execute malicious code on affected systems.
Statement: This WebKit vulnerability marked as important because it enables remote attackers to execute malicious code on users' systems just by visiting compromised websites
Apple
CVE-2024-27833: visionOS 1.2
vendor_apple·2024-06-10·CVSS 8.8
CVE-2024-27833 [HIGH] CVE-2024-27833: visionOS 1.2
Apple Security Update: About the security content of visionOS 1.2
Product: visionOS
Version: 1.2
CVE: CVE-2024-27833
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Apple
CVE-2024-27833: Safari 17.5
vendor_apple·2024-05-13·CVSS 8.8
CVE-2024-27833 [HIGH] CVE-2024-27833: Safari 17.5
Apple Security Update: About the security content of Safari 17.5
Product: Safari
Version: 17.5
CVE: CVE-2024-27833
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Apple
CVE-2024-27833: tvOS 17.5
vendor_apple·2024-05-13·CVSS 8.8
CVE-2024-27833 [HIGH] CVE-2024-27833: tvOS 17.5
Apple Security Update: About the security content of tvOS 17.5
Product: tvOS
Version: 17.5
CVE: CVE-2024-27833
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Apple
CVE-2024-27833: iOS 17.5 and iPadOS 17.5
vendor_apple·2024-05-13·CVSS 8.8
CVE-2024-27833 [HIGH] CVE-2024-27833: iOS 17.5 and iPadOS 17.5
Apple Security Update: About the security content of iOS 17.5 and iPadOS 17.5
Product: iOS 17.5 and iPadOS
Version: 17.5
CVE: CVE-2024-27833
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Apple
CVE-2024-27833: iOS 16.7.8 and iPadOS 16.7.8
vendor_apple·2024-05-13·CVSS 8.8
CVE-2024-27833 [HIGH] CVE-2024-27833: iOS 16.7.8 and iPadOS 16.7.8
Apple Security Update: About the security content of iOS 16.7.8 and iPadOS 16.7.8
Product: iOS 16.7.8 and iPadOS
Version: 16.7.8
CVE: CVE-2024-27833
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: An integer overflow was addressed with improved input validation.
Debian
CVE-2024-27833: webkit2gtk - An integer overflow was addressed with improved input validation. This issue is ...
vendor_debian·2024·CVSS 8.8
CVE-2024-27833 [HIGH] CVE-2024-27833: webkit2gtk - An integer overflow was addressed with improved input validation. This issue is ...
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Scope: local
bookworm: resolved (fixed in 2.44.2-1~deb12u1)
bullseye: resolved (fixed in 2.44.2-1~deb11u1)
forky: resolved (fixed in 2.44.2-1)
sid: resolved (fixed in 2.44.2-1)
trixie: resolved (fixed in 2.44.2-1)
OSV
CVE-2024-27833: An integer overflow was addressed with improved input validation
osv·2024-06-10·CVSS 8.8
CVE-2024-27833 [HIGH] CVE-2024-27833: An integer overflow was addressed with improved input validation
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5. Processing maliciously crafted web content may lead to arbitrary code execution.
GHSA
GHSA-984g-34ww-rvq9: An integer overflow was addressed with improved input validation
ghsa_unreviewed·2024-06-10
CVE-2024-27833 [HIGH] CWE-190 GHSA-984g-34ww-rvq9: An integer overflow was addressed with improved input validation
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5. Processing maliciously crafted web content may lead to arbitrary code execution.
OSV
CVE-2024-27833: An integer overflow was addressed with improved input validation
osv·2024-06-10·CVSS 8.8
CVE-2024-27833 [HIGH] CVE-2024-27833: An integer overflow was addressed with improved input validation
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://support.apple.com/en-us/120896https://support.apple.com/en-us/120898https://support.apple.com/en-us/120901https://support.apple.com/en-us/120905https://support.apple.com/en-us/120906http://seclists.org/fulldisclosure/2024/Jun/5https://support.apple.com/en-us/HT214100https://support.apple.com/en-us/HT214101https://support.apple.com/en-us/HT214102https://support.apple.com/en-us/HT214103https://support.apple.com/en-us/HT214108https://support.apple.com/kb/HT214100https://support.apple.com/kb/HT214102https://support.apple.com/kb/HT214103https://support.apple.com/kb/HT214108
2024-06-10
Published