5.5Media KEV

CVE-2024-27834Apple Multiple Products Improper Authentication Vulnerability

Apple Safari; Apple iOS and iPadOS; Apple macOS; Apple tvOS Publicada: 2024-05-14 02:00 (hace 2 años)

Explotación conocida — Apple Multiple Products Improper Authentication Vulnerability

CISA confirmó el 04.11.2026 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 18.11.2026.

Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. https://support.apple.com/en-us/120896 ; https://support.apple.com/en-us/120898 ; https://support.apple.com/en-us/120901 ; https://support.apple.com/en-us/120902 ; https://support.apple.com/en-us/120903 ; https://support.apple.com/en-us/120905 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2024-27834

Descripción

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

Debilidad (CWE): CWE-287

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Apple	iOS and iPadOS	< 16.7.8, < 17.5
apple	ipados	< 16.7.8
apple	iphone os	< 16.7.8
Apple	macOS	< 14.5
Apple	Safari	< 17.5
Apple	tvOS	< 17.5
Apple	watchOS	< 10.5
fedoraproject	fedora	39
webkitgtk	webkitgtk	< 2.44.2
wpewebkit	wpe webkit	< 2.44.2

Referencias y parches

https://support.apple.com/en-us/120896 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/120898 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/120901 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/120902 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/120903 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/120905 Vendor AdvisoryRelease Notes
http://seclists.org/fulldisclosure/2024/May/10 Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/May/12 Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/May/16 Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/May/17 Mailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2024/May/9 Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/21/1 Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADCLQW54XN37VJ… Mailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WKIXADCW3O4R2O… Mailing ListThird Party Advisory
https://support.apple.com/en-us/HT214101 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/HT214102 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/HT214103 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/HT214104 Vendor AdvisoryRelease Notes
https://support.apple.com/en-us/HT214106 Vendor AdvisoryRelease Notes
https://support.apple.com/kb/HT214100 Vendor AdvisoryRelease Notes
https://support.apple.com/kb/HT214102 Vendor AdvisoryRelease Notes
https://support.apple.com/kb/HT214104 Vendor AdvisoryRelease Notes
https://support.apple.com/kb/HT214106 Vendor AdvisoryRelease Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27834 US Government Resource
https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits Third Party Advisory

Coincidencias CPE (NVD) (12)

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* < 17.5
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* < 16.7.8
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* ≥ 17.0 < 17.5
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* < 16.7.8
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* ≥ 17.0 < 17.5
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* < 14.5
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* < 17.5
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* < 10.5
cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:* < 2.44.2
cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:* < 2.44.2
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

Puntuación CVSS

5.5Media

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Local
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Ninguno
Integridad: Alto
Disponibilidad: Ninguno

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Todas las puntuaciones (3)

CISA-ADP	CVSS 3.1	5.5Media
nvd	CVSS 3.1	5.5Media
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.5Media

EPSS (probabilidad de explotación en 30 días)

1.50%

superior al 75 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: active
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2024-02-26
Publicada2024-05-14 02:00
Llegó a IP-DB2026-10-24 23:56
Añadida a KEV2026-11-04
Última actualización2026-11-05 15:56

Asignada por (CNA): apple
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Apple iOS / iPadOS

8.8Alta

CVE-2026-113970 hace 3 días

Apple HomeView Software; Apple iOS and iPadOS; Apple macOS; Apple visionOS

A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15…

3.5Baja

CVE-2026-113971 hace 3 días

Apple iOS and iPadOS

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to pair a device with an AirPlay receiver from the lock screen.

5.4Media

CVE-2026-113964 hace 3 días

Apple HomeView Software; Apple iOS and iPadOS; Apple macOS; Apple visionOS

A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macO…

5.4Media

CVE-2026-113965 hace 3 días

Apple HomeView Software; Apple iOS and iPadOS; Apple macOS; Apple visionOS

This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.…

5.4Media

CVE-2026-113968 hace 3 días

Apple HomeView Software; Apple iOS and iPadOS; Apple macOS; Apple visionOS

7.5Alta

CVE-2026-113969 hace 3 días

Apple HomeView Software; Apple iOS and iPadOS; Apple macOS; Apple visionOS