CVE-2025-24085

Опубликовано: 27 янв. 2025

Источник: nvd

CVSS3: 10

EPSS Средний

Описание

A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.

Ссылки

https://support.apple.com/en-us/122066
Release Notes
Vendor Advisory
https://support.apple.com/en-us/122068
Release Notes
Vendor Advisory
https://support.apple.com/en-us/122071
Release Notes
Vendor Advisory
https://support.apple.com/en-us/122072
Release Notes
Vendor Advisory
https://support.apple.com/en-us/122073
Release Notes
Vendor Advisory
http://seclists.org/fulldisclosure/2025/Apr/10
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Apr/5
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Apr/9
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Jan/12
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Jan/13
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Jan/15
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Jan/19
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Jun/19
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Oct/1
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Oct/23
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Oct/30
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2025/Oct/31
Mailing List
Third Party Advisory
https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201
Third Party Advisory
https://github.com/cisagov/vulnrichment/issues/194
Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24085
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия до 17.7.6 (исключая)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Версия от 18.0 (включая) до 18.3 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 18.3 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия до 13.7.5 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 14.0 (включая) до 14.7.5 (исключая)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Версия от 15.0 (включая) до 15.3 (исключая)

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

Версия до 18.3 (исключая)

cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*

Версия до 2.3 (исключая)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Версия до 11.3 (исключая)

EPSS

Процентиль: 96%

0.28136

Средний

10 Critical

CVSS3

Дефекты

CWE-416

Связанные уязвимости

GHSA-7h23-57pg-3hwc

CVSS3: 7.8

github

около 1 года назад

BDU:2025-00858

CVSS3: 8.6

fstec

около 1 года назад

Уязвимость компонента CoreMedia операционных систем visionOS, iOS, iPadOS, macOS, watchOS, tvOS, позволяющая нарушителю повысить свои привилегии

EPSS

Процентиль: 96%

0.28136

Средний

10 Critical

CVSS3

Дефекты

CWE-416