CVE-2024-54534

webkit: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-54502

webkit: Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS 17.1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-54479

WebKitGTK: Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-54467

webkitgtk: A malicious website may exfiltrate data cross-origin

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 9 more

CVE-2024-44244

webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-44192

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved checks. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Iphone Os Macos Safari and 10 more

CVE-2024-44185

webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash

The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-40789

webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-40782

webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ios Ipad Os Ipados and 15 more

CVE-2024-40780

webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-40779

webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-40776

webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-27856

webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 10 more

CVE-2024-27851

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Mac Os and 11 more

CVE-2024-27833

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipad Os Ipados Iphone Os and 9 more

CVE-2024-27808

webkitgtk: Processing web content may lead to arbitrary code execution

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Apple Redhat

Products

Ipad Os Ipados Iphone Os and 11 more

CVE-2025-24208

webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Safari and 6 more

CVE-2023-43010

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.2 and iPadOS 17.2, macOS Sonoma 14.2, Safari 17.2, iOS 16.7.15 and iPadOS 16.7.15, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Redhat

Products

Ios And Ipados Ipados Iphone Os and 8 more

CVE-2024-47607

GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header

GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.

CVSS 4.0 · 8.6 High EPSS 1.2% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux Rhel Aus and 4 more

CVE-2024-47615

GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer

GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet within vorbis_parse.c. The integer size is read from the input file without proper validation. As a result, size can exceed the fixed size of the pad->vorbis_mode_sizes array (which size is 256). When this happens, the for loop overwrites the entire pad structure with 0s and 1s, affecting adjacent memory as well. This OOB-write can overwrite up to 380 bytes of memory beyond the boundaries of the pad->vorbis_mode_sizes array. This vulnerability is fixed in 1.24.10.

CVSS 4.0 · 8.6 High EPSS 1.1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux Rhel Aus and 4 more