{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-27851", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2024-02-26T15:32:28.532Z", "datePublished": "2024-06-10T20:56:47.478Z", "dateUpdated": "2024-08-02T00:41:55.657Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Processing maliciously crafted web content may lead to arbitrary code execution"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "17.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "14.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "1.2", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "10.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "Safari", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "17.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "tvOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "17.5", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved bounds checks. This issue is fixed in tvOS 17.5, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Processing maliciously crafted web content may lead to arbitrary code execution."}], "references": [{"url": "https://support.apple.com/en-us/HT214101"}, {"url": "https://support.apple.com/en-us/HT214106"}, {"url": "https://support.apple.com/en-us/HT214108"}, {"url": "https://support.apple.com/en-us/HT214104"}, {"url": "https://support.apple.com/en-us/HT214103"}, {"url": "https://support.apple.com/en-us/HT214102"}, {"url": "http://seclists.org/fulldisclosure/2024/Jun/5"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2024-06-10T20:56:47.478Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "affected": [{"vendor": "apple", "product": "iphone_os", "cpes": ["cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "17.5", "versionType": "custom"}]}, {"vendor": "apple", "product": "mac_os", "cpes": ["cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "14.5", "versionType": "custom"}]}, {"vendor": "apple", "product": "visionos", "cpes": ["cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.2", "versionType": "custom"}]}, {"vendor": "apple", "product": "watchos", "cpes": ["cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "10.5", "versionType": "custom"}]}, {"vendor": "apple", "product": "safari", "cpes": ["cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "17.5", "versionType": "custom"}]}, {"vendor": "apple", "product": "tvos", "cpes": ["cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "17.5", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-14T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-27851"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-15T03:55:31.726Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:41:55.657Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.apple.com/en-us/HT214101", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214106", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214108", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214104", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214103", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214102", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Jun/5", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.apple.com/en-us/HT214101", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214106", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214108", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214104", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214103", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214102", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Jun/5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:41:55.657Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-12T14:03:47.520461Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*"], "vendor": "apple", "product": "iphone_os", "versions": [{"status": "affected", "version": "0", "lessThan": "17.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:*"], "vendor": "apple", "product": "mac_os", "versions": [{"status": "affected", "version": "0", "lessThan": "14.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*"], "vendor": "apple", "product": "visionos", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*"], "vendor": "apple", "product": "watchos", "versions": [{"status": "affected", "version": "0", "lessThan": "10.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*"], "vendor": "apple", "product": "safari", "versions": [{"status": "affected", "version": "0", "lessThan": "17.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*"], "vendor": "apple", "product": "tvos", "versions": [{"status": "affected", "version": "0", "lessThan": "17.5", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T18:50:06.735Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "14.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "1.2", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "10.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "Safari", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "tvOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17.5", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/HT214101"}, {"url": "https://support.apple.com/en-us/HT214106"}, {"url": "https://support.apple.com/en-us/HT214108"}, {"url": "https://support.apple.com/en-us/HT214104"}, {"url": "https://support.apple.com/en-us/HT214103"}, {"url": "https://support.apple.com/en-us/HT214102"}, {"url": "http://seclists.org/fulldisclosure/2024/Jun/5"}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved bounds checks. This issue is fixed in tvOS 17.5, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Processing maliciously crafted web content may lead to arbitrary code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Processing maliciously crafted web content may lead to arbitrary code execution"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2024-06-10T20:56:47.478Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27851", "state": "PUBLISHED", "dateUpdated": "2024-08-02T00:41:55.657Z", "dateReserved": "2024-02-26T15:32:28.532Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2024-06-10T20:56:47.478Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "D80D1AA1-D37A-4ABD-87A0-2C3B12EDA955", "versionEndExcluding": "17.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7F2E11C-4A7D-4E71-BFAA-396B0549F649", "versionEndExcluding": "17.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9C4B45E-AF58-4D7C-B73A-618B06AED56E", "versionEndExcluding": "17.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "6AB18623-7D06-4946-99FC-808A4A913ED9", "versionEndExcluding": "14.5", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "matchCriteriaId": "003383BF-F06C-4300-908D-D1C8498C6BCD", "versionEndExcluding": "17.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "matchCriteriaId": "20FA533E-AA15-4561-AAF1-F8C3F5283C88", "versionEndExcluding": "1.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC4B1E01-BE73-48F8-9BD5-32F7C57EB45A", "versionEndExcluding": "10.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved bounds checks. This issue is fixed in tvOS 17.5, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Processing maliciously crafted web content may lead to arbitrary code execution."}, {"lang": "es", "value": "El problema se solucion\u00f3 con comprobaciones de los l\u00edmites mejoradas. Este problema se solucion\u00f3 en tvOS 17.5, visionOS 1.2, Safari 17.5, iOS 17.5 y iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. El procesamiento de contenido web creado con fines malintencionados puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2024-27851", "lastModified": "2024-07-03T16:13:40.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-06-10T21:15:51.680", "references": [{"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2024/Jun/5"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214101"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214102"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214103"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214104"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214106"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214108"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-119"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9636", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "webkit2gtk3-0:2.46.3-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9680", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "webkit2gtk3-0:2.46.3-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9679", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "webkit2gtk3-0:2.46.3-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9679", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "webkit2gtk3-0:2.46.3-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9679", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "webkit2gtk3-0:2.46.3-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9653", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "webkit2gtk3-0:2.46.3-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9653", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "webkit2gtk3-0:2.46.3-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9653", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "webkit2gtk3-0:2.46.3-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9646", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "webkit2gtk3-0:2.46.3-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:8180", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "webkit2gtk3-0:2.46.1-2.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-10-16T00:00:00Z"}, {"advisory": "RHSA-2024:8496", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "webkit2gtk3-0:2.46.1-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-10-28T00:00:00Z"}, {"advisory": "RHSA-2024:8492", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "webkit2gtk3-0:2.46.1-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-10-28T00:00:00Z"}], "bugzilla": {"description": "webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution", "id": "2314704", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314704"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-119", "details": ["The issue was addressed with improved bounds checks. This issue is fixed in tvOS 17.5, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. Processing maliciously crafted web content may lead to arbitrary code execution.", "A vulnerability was found in WebKit. This flaw allows a remote attacker to perform arbitrary code execution when processing web content. This flaw is caused by insufficient bounds checks, which could be exploited by attackers to execute malicious code on affected systems."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-27851", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "webkitgtk4", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2024-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27851\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27851\nhttps://webkitgtk.org/security/WSA-2024-0005.html"], "statement": "This WebKit vulnerability marked as important because it enables remote attackers to execute malicious code on users' systems just by visiting compromised websites, posing significant risks like data theft and system compromise.", "threat_severity": "Important"}