macOS · macOS update · January 27, 2025
Ventura 13.7.3
Ventura 13.7.3, released January 27, 2025, fixes 36 CVEs in Ventura. None of them is reported as exploited. Patch Radar priority: Urgent. The product is no longer supported.
UrgentUnsupported product
CVEs closed
36
7 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0116
67th percentile
Priority of the 36 CVEs
Patch now 0
Urgent 7
High 6
Routine 23
Applies to
| Product | Version |
|---|---|
| Ventura | 13.7.3 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2025-24154 | WebContentFilter: An attacker may be able to cause unexpected system termination or corrupt kernel memory | An attacker may be able to cause unexpected system termination or corrupt kernel memory | 9.1 | 0.0116 | None reported |
| Urgent | CVE-2025-24102 | CoreRoutine: An app may be able to determine a user’s current location | An app may be able to determine a user’s current location | 9.8 | 0.0095 | None reported |
| Urgent | CVE-2025-24146 | Photos Storage: Deleting a conversation in Messages may expose user contact information in system logging | Deleting a conversation in Messages may expose user contact information in system logging | 9.8 | 0.0086 | None reported |
| Urgent | CVE-2025-24093 | Sandbox: An app may be able to access removable volumes without user consent | An app may be able to access removable volumes without user consent | 9.8 | 0.0081 | None reported |
| Urgent | CVE-2025-24103 | Security: An app may be able to access protected user data | An app may be able to access protected user data | 9.8 | 0.0065 | None reported |
| Urgent | CVE-2025-24130 | PackageKit: An app may be able to modify protected parts of the file system | An app may be able to modify protected parts of the file system | 9.8 | 0.0064 | None reported |
| Urgent | CVE-2025-24109 | AppleMobileFileIntegrity: An app may be able to access sensitive user data | An app may be able to access sensitive user data | 9.8 | 0.0050 | None reported |
| High | CVE-2025-24120 | WindowServer: An attacker may be able to cause unexpected app termination | An attacker may be able to cause unexpected app termination | 7.5 | 0.0096 | None reported |
| High | CVE-2025-24156 | Xsan: An app may be able to elevate privileges | An app may be able to elevate privileges | 8.8 | 0.0051 | None reported |
| High | CVE-2024-55549 | libxslt: Processing maliciously crafted web content may lead to an unexpected process crash | Processing maliciously crafted web content may lead to an unexpected process crash | 7.8 | 0.0036 | None reported |
| High | CVE-2025-24139 | sips: Parsing a maliciously crafted file may lead to an unexpected app termination | Parsing a maliciously crafted file may lead to an unexpected app termination | 7.8 | 0.0028 | None reported |
| High | CVE-2025-24174 | iCloud Photo Library: An app may be able to bypass Privacy preferences | An app may be able to bypass Privacy preferences | 7.7 | 0.0026 | None reported |
| High | CVE-2025-24176 | StorageKit: A local attacker may be able to elevate their privileges | A local attacker may be able to elevate their privileges | 7.1 | 0.0021 | None reported |
| Routine | CVE-2024-54497 | QuartzCore: Processing web content may lead to a denial-of-service | Processing web content may lead to a denial-of-service | 6.5 | 0.0102 | None reported |
| Routine | CVE-2025-24123 | CoreMedia: Parsing a file may lead to an unexpected app termination | Parsing a file may lead to an unexpected app termination | 6.5 | 0.0071 | None reported |
| Routine | CVE-2025-24106 | Audio: An app may be able to cause unexpected system termination | An app may be able to cause unexpected system termination | 6.5 | 0.0056 | None reported |
| Routine | CVE-2025-24149 | SceneKit: Parsing a file may lead to disclosure of user information | Parsing a file may lead to disclosure of user information | 5.5 | 0.0033 | None reported |
| Routine | CVE-2025-24127 | ARKit: Parsing a file may lead to an unexpected app termination | Parsing a file may lead to an unexpected app termination | 5.5 | 0.0030 | None reported |
| Routine | CVE-2025-24136 | Login Window: A malicious app may be able to create symlinks to protected regions of the disk | A malicious app may be able to create symlinks to protected regions of the disk | 4.4 | 0.0029 | None reported |
| Routine | CVE-2025-24086 | ImageIO: Processing an image may lead to a denial-of-service | Processing an image may lead to a denial-of-service | 5.5 | 0.0028 | None reported |
| Routine | CVE-2025-24115 | LaunchServices: An app may be able to read files outside of its sandbox | An app may be able to read files outside of its sandbox | 5.5 | 0.0026 | None reported |
| Routine | CVE-2025-24122 | AppleMobileFileIntegrity: An app may be able to modify protected parts of the file system | An app may be able to modify protected parts of the file system | 5.5 | 0.0025 | None reported |
| Routine | CVE-2025-24100 | AppleMobileFileIntegrity: An app may be able to access information about a user's contacts | An app may be able to access information about a user's contacts | 3.3 | 0.0025 | None reported |
| Routine | CVE-2025-24138 | Spotlight: A malicious application may be able to leak sensitive user information | A malicious application may be able to leak sensitive user information | 5.5 | 0.0025 | None reported |
| Routine | CVE-2025-24151 | SMB: An app may be able to cause unexpected system termination or corrupt kernel memory | An app may be able to cause unexpected system termination or corrupt kernel memory | 5.5 | 0.0023 | None reported |
Showing 1 to 25 of 36
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.