CVE-2024-44308

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 10,2%

Kerentanan pada debian linux, apple safari +4 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 21 November 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Rincian

Terbit di NVD

20 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

10,2% peluang dieksploitasi; lebih tinggi dari 95,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apple Multiple Products Code Execution Vulnerability

Masuk KEV

21 November 2024

Tenggat CISA

12 Desember 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.apple.com/en-us/121752 advisory vendor
• https://support.apple.com/en-us/121753 advisory vendor
• https://support.apple.com/en-us/121754 advisory vendor
• https://support.apple.com/en-us/121755 advisory vendor
• https://support.apple.com/en-us/121756 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308 pemerintah AS
• http://seclists.org/fulldisclosure/2024/Nov/16 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html mailing list