macOS · macOS update · September 16, 2024
Sequoia 15.0
Sequoia 15.0, released September 16, 2024, fixes 98 CVEs in Sequoia. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
98
3 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.0794
94th percentile
Priority of the 98 CVEs
Patch now 0
Urgent 3
High 25
Routine 70
Applies to
| Product | Version |
|---|---|
| Sequoia | 15.0 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2023-5841 | Model I/O: Processing a maliciously crafted image may lead to a denial-of-service | Processing a maliciously crafted image may lead to a denial-of-service | 9.1 | 0.0125 | None reported |
| Urgent | CVE-2024-44146 | copyfile: An app may be able to break out of its sandbox | An app may be able to break out of its sandbox | 10.0 | 0.0075 | None reported |
| Urgent | CVE-2024-44148 | Disk Images: An app may be able to break out of its sandbox | An app may be able to break out of its sandbox | 10.0 | 0.0067 | None reported |
| High | CVE-2024-39894 | OpenSSH: Multiple issues in OpenSSH | Multiple issues in OpenSSH | 7.5 | 0.0163 | None reported |
| High | CVE-2024-40856 | Wi-Fi: An attacker may be able to force a device to disconnect from a secure network | An attacker may be able to force a device to disconnect from a secure network | 7.5 | 0.0089 | None reported |
| High | CVE-2024-44165 | Kernel: Network traffic may leak outside a VPN tunnel | Network traffic may leak outside a VPN tunnel | 7.5 | 0.0078 | None reported |
| High | CVE-2024-40848 | AppleMobileFileIntegrity: An attacker may be able to read sensitive information | An attacker may be able to read sensitive information | 7.5 | 0.0071 | None reported |
| High | CVE-2024-44175 | Kernel: An app may be able to access sensitive user data | An app may be able to access sensitive user data | 7.5 | 0.0064 | None reported |
| High | CVE-2023-4504 | CUPS: Processing a maliciously crafted file may lead to unexpected app termination | Processing a maliciously crafted file may lead to unexpected app termination | 7.0 | 0.0064 | None reported |
| High | CVE-2024-54467 | WebKit: A malicious website may exfiltrate data cross-origin | A malicious website may exfiltrate data cross-origin | 8.8 | 0.0063 | None reported |
| High | CVE-2024-44167 | Notes: An app may be able to overwrite arbitrary files | An app may be able to overwrite arbitrary files | 8.1 | 0.0063 | None reported |
| High | CVE-2024-44152 | System Settings: An app may be able to access user-sensitive data | An app may be able to access user-sensitive data | 7.5 | 0.0058 | None reported |
| High | CVE-2024-44149 | Quick Look: An app may be able to access protected user data | An app may be able to access protected user data | 7.5 | 0.0055 | None reported |
| High | CVE-2024-27869 | Control Center: An app may be able to record the screen without an indicator | An app may be able to record the screen without an indicator | 7.5 | 0.0053 | None reported |
| High | CVE-2024-44189 | WindowServer: A logic issue existed where a process may be able to capture screen contents without user consent | A logic issue existed where a process may be able to capture screen contents without user consent | 7.5 | 0.0052 | None reported |
| High | CVE-2024-27795 | AppSandbox: A camera extension may be able to access the internet | A camera extension may be able to access the internet | 7.5 | 0.0050 | None reported |
| High | CVE-2024-27876 | Compression: Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files | Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files | 8.1 | 0.0049 | None reported |
| High | CVE-2024-40770 | Wi-Fi: A non-privileged user may be able to modify restricted network settings | A non-privileged user may be able to modify restricted network settings | 7.5 | 0.0049 | None reported |
| High | CVE-2024-44160 | Intel Graphics Driver: Processing a maliciously crafted texture may lead to unexpected app termination | Processing a maliciously crafted texture may lead to unexpected app termination | 7.8 | 0.0048 | None reported |
| High | CVE-2024-44227 | Wi-Fi: An app may be able to cause unexpected system termination or corrupt kernel memory | An app may be able to cause unexpected system termination or corrupt kernel memory | 7.5 | 0.0045 | None reported |
| High | CVE-2024-44192 | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0045 | None reported |
| High | CVE-2024-44208 | WindowServer: An app may be able to bypass certain Privacy preferences | An app may be able to bypass certain Privacy preferences | 7.5 | 0.0040 | None reported |
| High | CVE-2024-40841 | AppleVA: Processing a maliciously crafted video file may lead to unexpected app termination | Processing a maliciously crafted video file may lead to unexpected app termination | 7.8 | 0.0032 | None reported |
| High | CVE-2024-44122 | LaunchServices: An application may be able to break out of its sandbox | An application may be able to break out of its sandbox | 8.8 | 0.0026 | None reported |
| High | CVE-2024-44126 | ARKit: Processing a maliciously crafted file may lead to heap corruption | Processing a maliciously crafted file may lead to heap corruption | 7.8 | 0.0026 | None reported |
Showing 1 to 25 of 98
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.