CVE-2024-44246 — Out-of-bounds Read in Apple IOS AND Ipados

CWE-125 — Out-of-bounds Read7 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 68.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple IOS AND IpadosApple IpadosApple Macos+2 more
Timeline
PublishedDec 12

Description

The issue was addressed with improved routing of Safari-originated requests. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2. On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages8 packages

▶CVEListV5apple/safari< 18.2
▶NVDapple/safari< 18.2
▶CVEListV5apple/ipados< 17.7.3
▶NVDapple/ipados18.0 — 18.2+1
▶CVEListV5apple/ios_and_ipados< 18.2

🔴Vulnerability Details

2
GHSA
GHSA-c9mr-7r2v-xjc9: The issue was addressed with improved routing of Safari-originated requests↗2024-12-12
▶
CVEList
CVE-2024-44246: The issue was addressed with improved routing of Safari-originated requests↗2024-12-11
▶

📋Vendor Advisories

4
Apple
CVE-2024-44246: macOS Sequoia 15.2↗2024-12-11
▶
Apple
CVE-2024-44246: Safari18.2↗2024-12-11
▶
Apple
CVE-2024-44246: iPadOS17.7.3↗2024-12-11
▶
Apple
CVE-2024-44246: iOS18.2 and iPadOS18.2↗2024-12-11
▶
CVE-2024-44246 — Out-of-bounds Read in Apple | cvebase