macOS · macOS update · May 13, 2024
Sonoma 14.5
Sonoma 14.5, released May 13, 2024, fixes 51 CVEs in Sonoma. 2 of them are being exploited (CVE-2024-27834); 1 on CISA KEV. Patch Radar priority: Patch now.
Patch now1 on CISA KEV
CVEs closed
51
5 rated Critical
Exploited
2
CVE-2024-27834
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0205
81st percentile
Priority of the 51 CVEs
Patch now 2
Urgent 5
High 27
Routine 17
Applies to
| Product | Version |
|---|---|
| Sonoma | 14.5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2024-27834 | WebKit: An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication | An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication | 8.8 | 0.0150 | KEVExploited |
| Patch now | CVE-2024-40771 | AVEVideoEncoder: An app may be able to execute arbitrary code with kernel privileges | An app may be able to execute arbitrary code with kernel privileges | 8.4 | 0.0018 | Exploited |
| Urgent | CVE-2024-27810 | Maps: An app may be able to read sensitive location information | An app may be able to read sensitive location information | 9.8 | 0.0071 | None reported |
| Urgent | CVE-2024-27832 | Disk Images: An app may be able to elevate privileges | An app may be able to elevate privileges | 9.1 | 0.0059 | None reported |
| Urgent | CVE-2024-27811 | libiconv: An app may be able to elevate privileges | An app may be able to elevate privileges | 9.1 | 0.0056 | None reported |
| Urgent | CVE-2024-27844 | Safari: A website's permission dialog may persist after navigation away from the site | A website's permission dialog may persist after navigation away from the site | 9.1 | 0.0056 | None reported |
| Urgent | CVE-2024-27841 | AVEVideoEncoder: An app may be able to disclose kernel memory | An app may be able to disclose kernel memory | 9.8 | 0.0044 | None reported |
| High | CVE-2024-27857 | Metal: A remote attacker may be able to cause unexpected app termination or arbitrary code execution | A remote attacker may be able to cause unexpected app termination or arbitrary code execution | 7.1 | 0.0183 | None reported |
| High | CVE-2024-27822 | PackageKit: An app may be able to gain root privileges | An app may be able to gain root privileges | 7.4 | 0.0146 | None reported |
| High | CVE-2024-27804 | AppleAVD: An app may be able to cause unexpected system termination | An app may be able to cause unexpected system termination | 8.1 | 0.0131 | None reported |
| High | CVE-2024-27808 | WebKit: Processing web content may lead to arbitrary code execution | Processing web content may lead to arbitrary code execution | 8.8 | 0.0118 | None reported |
| High | CVE-2024-27820 | WebKit Web Inspector: Processing web content may lead to arbitrary code execution | Processing web content may lead to arbitrary code execution | 8.8 | 0.0102 | None reported |
| High | CVE-2024-27821 | Shortcuts: A shortcut may output sensitive user data without consent | A shortcut may output sensitive user data without consent | 7.5 | 0.0092 | None reported |
| High | CVE-2024-27851 | WebKit: Processing maliciously crafted web content may lead to arbitrary code execution | Processing maliciously crafted web content may lead to arbitrary code execution | 8.8 | 0.0082 | None reported |
| High | CVE-2024-27818 | Kernel: An attacker may be able to cause unexpected app termination or arbitrary code execution | An attacker may be able to cause unexpected app termination or arbitrary code execution | 7.8 | 0.0073 | None reported |
| High | CVE-2024-27855 | Shortcuts: A shortcut may be able to use sensitive data with certain actions without prompting the user | A shortcut may be able to use sensitive data with certain actions without prompting the user | 8.8 | 0.0072 | None reported |
| High | CVE-2024-27829 | AppleVA: Processing a file may lead to unexpected app termination or arbitrary code execution | Processing a file may lead to unexpected app termination or arbitrary code execution | 7.5 | 0.0063 | None reported |
| High | CVE-2024-27856 | WebKit: Processing a file may lead to unexpected app termination or arbitrary code execution | Processing a file may lead to unexpected app termination or arbitrary code execution | 8.8 | 0.0062 | None reported |
| High | CVE-2024-27800 | Messages: Processing a maliciously crafted message may lead to a denial-of-service | Processing a maliciously crafted message may lead to a denial-of-service | 7.1 | 0.0060 | None reported |
| High | CVE-2024-27802 | Metal: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution | Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution | 7.8 | 0.0042 | None reported |
| High | CVE-2024-27836 | ImageIO: Processing a maliciously crafted image may lead to arbitrary code execution | Processing a maliciously crafted image may lead to arbitrary code execution | 7.8 | 0.0038 | None reported |
| High | CVE-2024-27801 | Foundation: An app may be able to elevate privileges | An app may be able to elevate privileges | 8.4 | 0.0036 | None reported |
| High | CVE-2024-27842 | udf: An app may be able to execute arbitrary code with kernel privileges | An app may be able to execute arbitrary code with kernel privileges | 8.1 | 0.0033 | None reported |
| High | CVE-2024-27831 | CoreMedia: Processing a file may lead to unexpected app termination or arbitrary code execution | Processing a file may lead to unexpected app termination or arbitrary code execution | 7.5 | 0.0030 | None reported |
| High | CVE-2024-27826 | Apple Neural Engine: An app may be able to execute arbitrary code with kernel privileges | A local attacker may be able to cause unexpected system shutdown | 7.8 | 0.0026 | None reported |
Showing 1 to 25 of 51
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.