Fixed:A malicious app with root privileges may be able to modify the contents of system files

About the security content of macOS Sequoia 15.1
Released October 28, 2024

Apache
Impact: Multiple issues existed in Apache
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2024-39573
CVE-2024-38477
CVE-2024-38476

App Support
Available for: macOS Sequoia
Impact: A malicious app may be able to run arbitrary shortcuts without user consent
Description: A path handling issue was addressed with improved logic.
CVE-2024-44255: an anonymous researcher

AppleMobileFileIntegrity
Available for: macOS Sequoia
Impact: A sandboxed process may be able to circumvent sandbox restrictions
Description: A logic issue was addressed with improved validation.
CVE-2024-44270: Mickey Jin (@patch1t)

AppleMobileFileIntegrity
Available for: macOS Sequoia
Impact: An app may be able to modify protected parts of the file system
Description: A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.
CVE-2024-44280: Mickey Jin (@patch1t)

Assets
Available for: macOS Sequoia
Impact: A malicious app with root privileges may be able to modify the contents of system files
Description: This issue was addressed by removing the vulnerable code.
CVE-2024-44260: Mickey Jin (@patch1t)

Contacts
Available for: macOS Sequoia
Impact: An app may be able to access information about a user's contacts
Description: A privacy issue was addressed with improved private data redaction for log entries.
CVE-2024-44298: Kirin (@Pwnrin) and 7feilee

CoreMedia Playback
Available for: macOS Sequoia
Impact: A malicious app may be able to access private information
Description: This issue was addressed with improved handling of symlinks.
CVE-2024-44273: pattern-f (@pattern_F_), Hikerell of Loadshine Lab

CoreServicesUIAgent
Available for: macOS Sequoia
Impact: An app may be able to modify protected parts of the file system
Description: This issue was addressed with additional entitlement checks.
CVE-2024-44295: an anonymous researcher

CoreText
Available for: macOS Sequoia
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: The issue was addressed with improved checks.
CVE-2024-44240: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative
CVE-2024-44302: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

CUPS
Available for: macOS Sequoia
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: An issue existed in the parsing of URLs. This issue was addressed with improved input validation.
CVE-2024-44213: Alexandre Bedard

Find My
Available for: macOS Sequoia
Impact: An app may be able to read sensitive location information
Description: A privacy issue was addressed with improved private data redaction for log entries.
CVE-2024-44289: Kirin (@Pwnrin)

Foundation
Available for: macOS Sequoia
Impact: Parsing a file may lead to disclosure of user information
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2024-44282: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

Game Controllers
Available for: macOS Sequoia
Impact: An attacker with physical access can input Game Controller events to apps running on a locked device
Description: The issue was addressed by restricting options offered on a locked device.
CVE-2024-44265: Ronny Stiftel

ImageIO
Available for: macOS Sequoia
Impact: Processing an image may result in disclosure of process memory
Description: This issue was addressed with improved checks.
CVE-2024-44215: Junsung Lee working with Trend Micro Zero Day Initiative

ImageIO
Available for: macOS Sequoia
Impact: Processing a maliciously crafted message may lead to a denial-of-service
Description: The issue was addressed with improved bounds checks.
CVE-2024-44297: Jex Amro

Installer
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: An access issue was addressed with additional sandbox restrictions.
CVE-2024-44216: Zhongquan Li (@Guluisacat)

Installer
Available for: macOS Sequoia
Impact: A malicious application may be able to modify protected parts of the file system
Description: The issue was addressed with improved checks.
CVE-2024-44287: Mickey Jin (@patch1t)

IOGPUFamily
Available for: macOS Sequoia
Impact: A malicious app may be able to cause a denial-of-service
Description: The issue was addressed with improved memory handling.
CVE-2024-44197: Wang Yu of Cyberserval

IOSurface
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: A use-after-free issue was addressed with improved memory management.
CVE-2024-44285: an anonymous researcher

Kernel
Available for: macOS Sequoia
Impact: An app may be able to leak sensitive kernel state
Description: An information disclosure issue was addressed with improved private data redaction for log entries.
CVE-2024-44239: Mateusz Krzywicki (@krzywix)

Login Window
Available for: macOS Sequoia
Impact: A person with physical access to a Mac may be able to bypass Login Window during a software update
Description: This issue was addressed through improved state management.
CVE-2024-44231: Toomas Römer

Login Window
Available for: macOS Sequoia
Impact: An attacker with physical access to a Mac may be able to view protected content from the Login Window
Description: This issue was addressed through improved state management.
CVE-2024-44223: Jaime Bertran

Maps
Available for: macOS Sequoia
Impact: An app may be able to read sensitive location information
Description: This issue was addressed with improved redaction of sensitive information.
CVE-2024-44222: Kirin (@Pwnrin)

Messages
Available for: macOS Sequoia
Impact: An app may be able to break out of its sandbox
Description: The issue was addressed with improved input sanitization.
CVE-2024-44256: Mickey Jin (@patch1t)

Notification Center
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved private data redaction for log entries.
CVE-2024-44292: Kirin (@Pwnrin)

Notification Center
Available for: macOS Sequoia
Impact: A user may be able to view sensitive user information
Description: A privacy issue was addressed with improved private data redaction for log entries.
CVE-2024-44293: Kirin (@Pwnrin) and 7feilee

PackageKit
Available for: macOS Sequoia
Impact: A malicious application may be able to modify protected parts of the file system
Description: The issue was addressed with improved checks.
CVE-2024-44247: Un3xploitable of CW Research Inc
CVE-2024-44267: Bohdan Stasiuk (@Bohdan_Stasiuk), Un3xploitable of CW Research Inc, Pedro Tôrres (@t0rr3sp3dr0)
CVE-2024-44301: Bohdan Stasiuk (@Bohdan_Stasiuk), Un3xploitable of CW Research Inc, Pedro Tôrres (@t0rr3sp3dr0)
CVE-2024-44275: Arsenii Kostromin (0x3c3e)

PackageKit
Available for: macOS Sequoia
Impact: An app may be able to bypass Privacy preferences
Description: A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges.
CVE-2024-44156: Arsenii Kostromin (0x3c3e)
CVE-2024-44159: Mickey Jin (@patch1t)

PackageKit
Available for: macOS Sequoia
Impact: An app may be able to modify protected parts of the file system
Description: The issue was addressed with improved checks.
CVE-2024-44253: Mickey Jin (@patch1t), Csaba Fitzl (@theevilbit) of Kandji

PackageKit
Available for: macOS Sequoia
Impact: An attacker with root privileges may be able to delete protected system files
Description: A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges.
CVE-2024-44294: Mickey Jin (@patch1t)

PackageKit
Available for: macOS Sequoia
Impact: An app may be able to modify protected parts of the file system
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-44196: Csaba Fitzl (@theevilbit) of Kandji

Photos
Available for: macOS Sequoia
Impact: An app may be able to access Contacts without user consent
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-40858: Csaba Fitzl (@theevilbit) of Kandji

Pro Res
Available for: macOS Sequoia
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2024-44277: an anonymous researcher and Yinyi Wu(@_3ndy1) from Dawn Security Lab of JD.com, Inc.

Quick Look
Available for: macOS Sequoia
Impact: An app may be able to read arbitrary files
Description: A logic issue was addressed with improved validation.
CVE-2024-44195: an anonymous researcher

Safari Downloads
Available for: macOS Sequoia
Impact: An attacker may be able to misuse a trust relationship to download malicious content
Description: This issue was addressed through improved state management.
CVE-2024-44259: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India)

Safari Private Browsing
Available for: macOS Sequoia
Impact: Private browsing may leak some browsing history
Description: An information leakage was addressed with additional validation.
CVE-2024-44229: Lucas Di Tomase

Sandbox
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed with improved validation of symlinks.
CVE-2024-44211: Gergely Kalman (@gergely_kalman) and Csaba Fitzl (@theevilbit)

SceneKit
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to heap corruption
Description: This issue was addressed with improved checks.
CVE-2024-44218: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative

Shortcuts
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved redaction of sensitive information.
CVE-2024-44254: Kirin (@Pwnrin)

Shortcuts
Available for: macOS Sequoia
Impact: A malicious app may use shortcuts to access restricted files
Description: A logic issue was addressed with improved checks.
CVE-2024-44269: an anonymous researcher

sips
Available for: macOS Sequoia
Impact: Processing a maliciously crafted file may lead to unexpected app termination
Description: An out-of-bounds access issue was addressed with improved bounds checking.
CVE-2024-44236: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative
CVE-2024-44237: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

sips
Available for: macOS Sequoia
Impact: Parsing a file may lead to disclosure of user information
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2024-44279: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative
CVE-2024-44281: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

sips
Available for: macOS Sequoia
Impact: Parsing a maliciously crafted file may lead to an unexpected app termination
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2024-44283: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative

sips
Available for: macOS Sequoia
Impact: Parsing a maliciously crafted file may lead to an unexpected app termination
Description: An out-of-bounds write issue was addressed with improved input validation.
CVE-2024-44284: Junsung Lee, dw0r! working with Trend Micro Zero Day Initiative

Siri
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved redaction of sensitive information.
CVE-2024-44194: Rodolphe Brunetti (@eisw0lf)

Siri
Available for: macOS Sequoia
Impact: A sandboxed app may be able to access sensitive user data in system logs
Description: An information disclosure issue was addressed with improved private data redaction for log entries.
CVE-2024-44278: Kirin (@Pwnrin)

SystemMigration
Available for: macOS Sequoia
Impact: A malicious app may be able to create symlinks to protected regions of the disk
Description: This issue was addressed with improved validation of symlinks.
CVE-2024-44264: Mickey Jin (@patch1t)

WebKit
Available for: macOS Sequoia
Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 278765
CVE-2024-44296: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India)

WebKit
Available for: macOS Sequoia
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: A memory corruption issue was addressed with improved input validation.
WebKit Bugzilla: 279780
CVE-2024-44244: an anonymous researcher, Q1IQ (@q1iqF) and P1umer (@p1umer)

WindowServer
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved redaction of sensitive information.
CVE-2024-44257: Bohdan Stasiuk (@Bohdan_Stasiuk)