by Kastro
Paper/Archive/CVE-2024-27810

CVE-2024-27810

Apple iOS and iPadOS — A path handling issue was addressed with improved validation.

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.5.535 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, watchOS 10.5. An app may be able to read sensitive location information.

Affected

ProductAffectedFixed inSource
iOS and iPadOS< 17.517.5CNA
macOS< 12.7.512.7.5CNA
macOS< 13.6.713.6.7CNA
macOS< 14.514.5CNA
tvOS< 17.517.5CNA
watchOS< 10.510.5CNA
watchos< 10.510.5CISA-ADP
ios< 17.517.5CISA-ADP
ipad_os< 17.517.5CISA-ADP
tvos< 17.517.5CISA-ADP
macos< 14.514.5CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.apple.com/en-us/120899refsupport.apple.com/en-us/120900refsupport.apple.com/en-us/120901refsupport.apple.com/en-us/120902refsupport.apple.com/en-us/120903refsupport.apple.com/en-us/120905refsupport.apple.com/en-us/HT214101refsupport.apple.com/en-us/HT214106refsupport.apple.com/en-us/HT214104refsupport.apple.com/en-us/HT214102refseclists.org/fulldisclosure/2024/May/17refsupport.apple.com/kb/HT214107refseclists.org/fulldisclosure/2024/May/10refsupport.apple.com/kb/HT214102refsupport.apple.com/kb/HT214104refsupport.apple.com/kb/HT214105refsupport.apple.com/kb/HT214106refseclists.org/fulldisclosure/2024/May/12refseclists.org/fulldisclosure/2024/May/16refsupport.apple.com/kb/HT214101