CVE-2023-6597

python: Path traversal on tempfile.TemporaryDirectory

An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Python Software Foundation Redhat

Products

Cpython Enterprise Linux Openshift and 5 more

CVE-2024-4076

Assertion failure when serving both stale cache data and authoritative zone content

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.27-S1.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Isc Redhat

Products

Bind Enterprise Linux Openshift and 4 more

CVE-2023-43758

microcode_ctl: Improper input validation in UEFI firmware

Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2025-31277

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Listed

Vendors

Apple Redhat Webkitgtk and 1 more

Products

Ios Ipados Iphone Os and 20 more

CVE-2025-24201

webkitgtk: out-of-bounds write vulnerability

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVSS 3.1 · 10 Critical EPSS 3.8% KEV · Listed

Vendors

Apple Debian Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-44309

webkitgtk: data isolation bypass vulnerability

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

CVSS 3.1 · 6.3 Medium EPSS 21.9% KEV · Listed

Vendors

Apple Debian Redhat

Products

Ipad Os Ipados Iphone Os and 10 more

CVE-2024-23222

webkitgtk: type confusion may lead to arbitrary code execution

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.

CVSS 3.1 · 8.8 High EPSS 10.6% KEV · Listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 9 more

CVE-2025-31223

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 11 more

CVE-2025-31215

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 9 more

CVE-2025-31206

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 9 more

CVE-2025-31205

webkitgtk: A malicious website may exfiltrate data cross-origin

The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A malicious website may exfiltrate data cross-origin.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2025-31204

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 9 more

CVE-2025-30427

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2025-24264

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 8 more

CVE-2025-24223

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 9 more

CVE-2025-24216

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2025-24209

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 9 more

CVE-2025-24162

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

This issue was addressed through improved state management. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-54551

webkitgtk: Processing web content may lead to a denial-of-service

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing web content may lead to a denial-of-service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-54543

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more