Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang `#!/bin/zsh` is being used. When the installer is executed it asks for the users password to be executed as root. However, it'll still be using the $HOME of the user and therefore loading the file `$HOME/.zshenv` when the `postinstall` script is executed. An attacker could add malicious code to `$HOME/.zshenv` and it will be executed when the app is installed. An attacker may leverage this vulnerability to escalate privilege on the system. This issue has been addressed in version 2.5.1 Rev 2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Max CVSS
7.3
EPSS Score
0.04%
Published
2024-03-14
Updated
2024-03-14
A use-after-free issue was addressed with improved memory management. This issue is fixed in GarageBand 10.4.11. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-12
Updated
2024-03-13
A logic issue was addressed with improved state management.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-15
Updated
2024-03-17
The issue was addressed with improved checks. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4. A malicious application may be able to access private information.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13

CVE-2024-23296

Known exploited
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.
Max CVSS
7.8
EPSS Score
0.11%
Published
2024-03-05
Updated
2024-03-19
CISA KEV Added
2024-03-06
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.4. Processing malicious input may lead to code execution.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-08
Updated
2024-03-13
This issue was addressed through improved state management. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An attacker with physical access may be able to use Siri to access sensitive user data.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
This issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An app may be able to access information about a user's contacts.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. A malicious app may be able to observe user data in log entries related to accessibility notifications.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access user-sensitive data.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
A lock screen issue was addressed with improved state management. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. A person with physical access to a device may be able to use Siri to access private calendar information.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to elevate privileges.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4. An app may be able to access user-sensitive data.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. Processing an image may lead to arbitrary code execution.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinks to protected regions of the disk.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-08
Updated
2024-03-13
A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-08
Updated
2024-03-13
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to access user-sensitive data.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
This issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.4. An app may be able to access sensitive user data.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-08
Updated
2024-03-13
An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. A maliciously crafted webpage may be able to fingerprint the user.
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-13
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-08
Updated
2024-03-13
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.5, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An app may be able to break out of its sandbox.
Max CVSS
N/A
EPSS Score
0.04%
Published
2024-03-08
Updated
2024-03-13
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard.
Max CVSS
5.9
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-14
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
Max CVSS
7.8
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-14
A race condition was addressed with additional validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to access protected user data.
Max CVSS
4.7
EPSS Score
0.06%
Published
2024-03-08
Updated
2024-03-14
An injection issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.
Max CVSS
7.8
EPSS Score
0.05%
Published
2024-03-08
Updated
2024-03-14
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!