macOS · macOS update · September 16, 2024
Ventura 13.7
Ventura 13.7, released September 16, 2024, fixes 30 CVEs in Ventura. None of them is reported as exploited. Patch Radar priority: High. The product is no longer supported.
HighUnsupported product
CVEs closed
30
None rated Critical
Exploited
0
None reported
Highest CVSS
8.1
Base score, 0 to 10
Highest EPSS
0.0794
94th percentile
Priority of the 30 CVEs
Patch now 0
Urgent 0
High 8
Routine 22
Applies to
| Product | Version |
|---|---|
| Ventura | 13.7 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2024-44165 | Kernel: Network traffic may leak outside a VPN tunnel | Network traffic may leak outside a VPN tunnel | 7.5 | 0.0078 | None reported |
| High | CVE-2024-40848 | AppleMobileFileIntegrity: An attacker may be able to read sensitive information | An attacker may be able to read sensitive information | 7.5 | 0.0071 | None reported |
| High | CVE-2024-44167 | Notes: An app may be able to overwrite arbitrary files | An app may be able to overwrite arbitrary files | 8.1 | 0.0063 | None reported |
| High | CVE-2024-27876 | Compression: Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files | Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files | 8.1 | 0.0060 | None reported |
| High | CVE-2024-44160 | Intel Graphics Driver: Processing a maliciously crafted texture may lead to unexpected app termination | Processing a maliciously crafted texture may lead to unexpected app termination | 7.8 | 0.0048 | None reported |
| High | CVE-2024-27886 | AppKit: An unprivileged app may be able to log keystrokes in other apps including those using secure input mode | An unprivileged app may be able to log keystrokes in other apps including those using secure input mode | 7.5 | 0.0048 | None reported |
| High | CVE-2024-40814 | AppleMobileFileIntegrity: An app may be able to bypass Privacy preferences | An app may be able to bypass Privacy preferences | 7.1 | 0.0024 | None reported |
| High | CVE-2024-44164 | AppleMobileFileIntegrity: An app may be able to bypass Privacy preferences | An app may be able to bypass Privacy preferences | 7.1 | 0.0023 | None reported |
| Routine | CVE-2024-44176 | ImageIO: Processing an image may lead to a denial-of-service | Processing an image may lead to a denial-of-service | 5.5 | 0.0794 | None reported |
| Routine | CVE-2024-44151 | bless: An app may be able to modify protected parts of the file system | An app may be able to modify protected parts of the file system | 6.5 | 0.0049 | None reported |
| Routine | CVE-2024-40797 | Safari: Visiting a malicious website may lead to user interface spoofing | Visiting a malicious website may lead to user interface spoofing | 6.1 | 0.0049 | None reported |
| Routine | CVE-2024-40850 | Game Center: An app may be able to access user-sensitive data | An app may be able to access user-sensitive data | 5.5 | 0.0027 | None reported |
| Routine | CVE-2024-44161 | Intel Graphics Driver: Processing a maliciously crafted texture may lead to unexpected app termination | Processing a maliciously crafted texture may lead to unexpected app termination | 5.5 | 0.0026 | None reported |
| Routine | CVE-2024-44183 | mDNSResponder: An app may be able to cause a denial-of-service | An app may be able to cause a denial-of-service | 5.5 | 0.0026 | None reported |
| Routine | CVE-2024-44178 | PackageKit: An app may be able to modify protected parts of the file system | An app may be able to modify protected parts of the file system | 5.5 | 0.0025 | None reported |
| Routine | CVE-2024-44168 | AppleMobileFileIntegrity: An app may be able to modify protected parts of the file system | An app may be able to modify protected parts of the file system | 5.5 | 0.0025 | None reported |
| Routine | CVE-2024-44190 | System Settings: An app may be able to read arbitrary files | An app may be able to read arbitrary files | 5.5 | 0.0025 | None reported |
| Routine | CVE-2024-40791 | Mail Accounts: An app may be able to access information about a user's contacts | An app may be able to access information about a user's contacts | 3.3 | 0.0024 | None reported |
| Routine | CVE-2024-44158 | Shortcuts: A shortcut may output sensitive user data without consent | A shortcut may output sensitive user data without consent | 5.5 | 0.0024 | None reported |
| Routine | CVE-2024-44163 | Sandbox: A malicious application may be able to access private information | A malicious application may be able to access private information | 5.5 | 0.0023 | None reported |
| Routine | CVE-2024-44128 | Automator: An Automator Quick Action workflow may be able to bypass Gatekeeper | An Automator Quick Action workflow may be able to bypass Gatekeeper | 5.5 | 0.0023 | None reported |
| Routine | CVE-2024-54469 | FileProvider: A local user may be able to leak sensitive user information | A local user may be able to leak sensitive user information | 5.5 | 0.0023 | None reported |
| Routine | CVE-2024-40844 | Shortcuts: An app may be able to observe data displayed to the user by Shortcuts | An app may be able to observe data displayed to the user by Shortcuts | 5.5 | 0.0023 | None reported |
| Routine | CVE-2024-40847 | AppleMobileFileIntegrity: An app may be able to access sensitive user data | An app may be able to access sensitive user data | 5.5 | 0.0023 | None reported |
| Routine | CVE-2024-44129 | Accounts: An app may be able to leak sensitive user information | An app may be able to leak sensitive user information | 5.5 | 0.0023 | None reported |
Showing 1 to 25 of 30
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.