-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-10-28-2024-3 macOS Sequoia 15.1 macOS Sequoia 15.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121564. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Apache Impact: Multiple issues existed in Apache Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2024-39573 CVE-2024-38477 CVE-2024-38476 App Support Available for: macOS Sequoia Impact: A malicious app may be able to run arbitrary shortcuts without user consent Description: A path handling issue was addressed with improved logic. CVE-2024-44255: an anonymous researcher AppleMobileFileIntegrity Available for: macOS Sequoia Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: A logic issue was addressed with improved validation. CVE-2024-44270: Mickey Jin (@patch1t) AppleMobileFileIntegrity Available for: macOS Sequoia Impact: An app may be able to modify protected parts of the file system Description: A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. CVE-2024-44280: Mickey Jin (@patch1t) Assets Available for: macOS Sequoia Impact: A malicious app with root privileges may be able to modify the contents of system files Description: This issue was addressed by removing the vulnerable code. CVE-2024-44260: Mickey Jin (@patch1t) Contacts Available for: macOS Sequoia Impact: An app may be able to access information about a user's contacts Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2024-44298: Kirin (@Pwnrin) and 7feilee CoreMedia Playback Available for: macOS Sequoia Impact: A malicious app may be able to access private information Description: This issue was addressed with improved handling of symlinks. CVE-2024-44273: pattern-f (@pattern_F_), Hikerell of Loadshine Lab CoreServicesUIAgent Available for: macOS Sequoia Impact: An app may be able to modify protected parts of the file system Description: This issue was addressed with additional entitlement checks. CVE-2024-44295: an anonymous researcher CoreText Available for: macOS Sequoia Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: The issue was addressed with improved checks. CVE-2024-44240: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CVE-2024-44302: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CUPS Available for: macOS Sequoia Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: An issue existed in the parsing of URLs. This issue was addressed with improved input validation. CVE-2024-44213: Alexandre Bedard Find My Available for: macOS Sequoia Impact: An app may be able to read sensitive location information Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2024-44289: Kirin (@Pwnrin) Foundation Available for: macOS Sequoia Impact: Parsing a file may lead to disclosure of user information Description: An out-of-bounds read was addressed with improved input validation. CVE-2024-44282: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative Game Controllers Available for: macOS Sequoia Impact: An attacker with physical access can input Game Controller events to apps running on a locked device Description: The issue was addressed by restricting options offered on a locked device. CVE-2024-44265: Ronny Stiftel ImageIO Available for: macOS Sequoia Impact: Processing an image may result in disclosure of process memory Description: This issue was addressed with improved checks. CVE-2024-44215: Junsung Lee working with Trend Micro Zero Day Initiative ImageIO Available for: macOS Sequoia Impact: Processing a maliciously crafted message may lead to a denial- of-service Description: The issue was addressed with improved bounds checks. CVE-2024-44297: Jex Amro Installer Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: An access issue was addressed with additional sandbox restrictions. CVE-2024-44216: Zhongquan Li (@Guluisacat) Installer Available for: macOS Sequoia Impact: A malicious application may be able to modify protected parts of the file system Description: The issue was addressed with improved checks. CVE-2024-44287: Mickey Jin (@patch1t) IOGPUFamily Available for: macOS Sequoia Impact: A malicious app may be able to cause a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2024-44197: Wang Yu of Cyberserval IOSurface Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2024-44285: an anonymous researcher Kernel Available for: macOS Sequoia Impact: An app may be able to leak sensitive kernel state Description: An information disclosure issue was addressed with improved private data redaction for log entries. CVE-2024-44239: Mateusz Krzywicki (@krzywix) Login Window Available for: macOS Sequoia Impact: A person with physical access to a Mac may be able to bypass Login Window during a software update Description: This issue was addressed through improved state management. CVE-2024-44231: Toomas Römer Login Window Available for: macOS Sequoia Impact: An attacker with physical access to a Mac may be able to view protected content from the Login Window Description: This issue was addressed through improved state management. CVE-2024-44223: Jaime Bertran Maps Available for: macOS Sequoia Impact: An app may be able to read sensitive location information Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-44222: Kirin (@Pwnrin) Messages Available for: macOS Sequoia Impact: An app may be able to break out of its sandbox Description: The issue was addressed with improved input sanitization. CVE-2024-44256: Mickey Jin (@patch1t) Notification Center Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2024-44292: Kirin (@Pwnrin) Notification Center Available for: macOS Sequoia Impact: A user may be able to view sensitive user information Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2024-44293: Kirin (@Pwnrin) and 7feilee PackageKit Available for: macOS Sequoia Impact: A malicious application may be able to modify protected parts of the file system Description: The issue was addressed with improved checks. CVE-2024-44247: Un3xploitable of CW Research Inc CVE-2024-44267: Bohdan Stasiuk (@Bohdan_Stasiuk), Un3xploitable of CW Research Inc, Pedro Tôrres (@t0rr3sp3dr0) CVE-2024-44301: Bohdan Stasiuk (@Bohdan_Stasiuk), Un3xploitable of CW Research Inc, Pedro Tôrres (@t0rr3sp3dr0) CVE-2024-44275: Arsenii Kostromin (0x3c3e) PackageKit Available for: macOS Sequoia Impact: An app may be able to bypass Privacy preferences Description: A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. CVE-2024-44156: Arsenii Kostromin (0x3c3e) CVE-2024-44159: Mickey Jin (@patch1t) PackageKit Available for: macOS Sequoia Impact: An app may be able to modify protected parts of the file system Description: The issue was addressed with improved checks. CVE-2024-44253: Mickey Jin (@patch1t), Csaba Fitzl (@theevilbit) of Kandji PackageKit Available for: macOS Sequoia Impact: An attacker with root privileges may be able to delete protected system files Description: A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. CVE-2024-44294: Mickey Jin (@patch1t) PackageKit Available for: macOS Sequoia Impact: An app may be able to modify protected parts of the file system Description: A permissions issue was addressed with additional restrictions. CVE-2024-44196: Csaba Fitzl (@theevilbit) of Kandji Photos Available for: macOS Sequoia Impact: An app may be able to access Contacts without user consent Description: A permissions issue was addressed with additional restrictions. CVE-2024-40858: Csaba Fitzl (@theevilbit) of Kandji Pro Res Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2024-44277: an anonymous researcher and Yinyi Wu(@_3ndy1) from Dawn Security Lab of JD.com, Inc. Quick Look Available for: macOS Sequoia Impact: An app may be able to read arbitrary files Description: A logic issue was addressed with improved validation. CVE-2024-44195: an anonymous researcher Safari Downloads Available for: macOS Sequoia Impact: An attacker may be able to misuse a trust relationship to download malicious content Description: This issue was addressed through improved state management. CVE-2024-44259: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India) Safari Private Browsing Available for: macOS Sequoia Impact: Private browsing may leak some browsing history Description: An information leakage was addressed with additional validation. CVE-2024-44229: Lucas Di Tomase Sandbox Available for: macOS Sequoia Impact: An app may be able to access user-sensitive data Description: This issue was addressed with improved validation of symlinks. CVE-2024-44211: Gergely Kalman (@gergely_kalman) and Csaba Fitzl (@theevilbit) SceneKit Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to heap corruption Description: This issue was addressed with improved checks. CVE-2024-44218: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Shortcuts Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-44254: Kirin (@Pwnrin) Shortcuts Available for: macOS Sequoia Impact: A malicious app may use shortcuts to access restricted files Description: A logic issue was addressed with improved checks. CVE-2024-44269: an anonymous researcher sips Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2024-44236: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CVE-2024-44237: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative sips Available for: macOS Sequoia Impact: Parsing a file may lead to disclosure of user information Description: An out-of-bounds read was addressed with improved input validation. CVE-2024-44279: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CVE-2024-44281: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative sips Available for: macOS Sequoia Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2024-44283: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative sips Available for: macOS Sequoia Impact: Parsing a maliciously crafted file may lead to an unexpected app termination Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2024-44284: Junsung Lee, dw0r! working with Trend Micro Zero Day Initiative Siri Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-44194: Rodolphe Brunetti (@eisw0lf) Siri Available for: macOS Sequoia Impact: A sandboxed app may be able to access sensitive user data in system logs Description: An information disclosure issue was addressed with improved private data redaction for log entries. CVE-2024-44278: Kirin (@Pwnrin) SystemMigration Available for: macOS Sequoia Impact: A malicious app may be able to create symlinks to protected regions of the disk Description: This issue was addressed with improved validation of symlinks. CVE-2024-44264: Mickey Jin (@patch1t) WebKit Available for: macOS Sequoia Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: The issue was addressed with improved checks. WebKit Bugzilla: 278765 CVE-2024-44296: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India) WebKit Available for: macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A memory corruption issue was addressed with improved input validation. WebKit Bugzilla: 279780 CVE-2024-44244: an anonymous researcher, Q1IQ (@q1iqF) and P1umer (@p1umer) WindowServer Available for: macOS Sequoia Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. CVE-2024-44257: Bohdan Stasiuk (@Bohdan_Stasiuk) Additional recognition Airport We would like to acknowledge Bohdan Stasiuk (@Bohdan_Stasiuk), K宝(@Pwnrin) for their assistance. Calculator We would like to acknowledge Kenneth Chew for their assistance. Calendar We would like to acknowledge K宝(@Pwnrin) for their assistance. ImageIO We would like to acknowledge Amir Bazine and Karsten König of CrowdStrike Counter Adversary Operations, an anonymous researcher for their assistance. Messages We would like to acknowledge Collin Potter, an anonymous researcher for their assistance. NetworkExtension We would like to acknowledge Patrick Wardle of DoubleYou & the Objective-See Foundation for their assistance. Notification Center We would like to acknowledge Kirin (@Pwnrin) and LFYSec for their assistance. Photos We would like to acknowledge James Robertson for their assistance. Safari Private Browsing We would like to acknowledge an anonymous researcher, r00tdaddy for their assistance. Safari Tabs We would like to acknowledge Jaydev Ahire for their assistance. Security We would like to acknowledge Bing Shi, Wenchao Li and Xiaolong Bai of Alibaba Group for their assistance. Siri We would like to acknowledge Bistrit Dahal for their assistance. macOS Sequoia 15.1 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmcf/5IACgkQX+5d1TXa IvpDBw/9FRph9Y6CcfUCPh6XQXhb25fsLE9L9qkW6gB2aF+/NUC55OGNlHKoxmCU WCY//cOs164iB+ETsGqX3I3U6vD/IqVwSfdpRpaNtdaEZnmFZPKLwJ4VzQufZV1a N8XxyVaxpPFh/8AmGdm0vqRv7x++brH8Z61Jt4AYdbg5Pph16zDBZxxLHUfTxY5a j7GBdCVUwzSF6oSJZl2Mj9SoTfwVHqz2Xyp1x7w9IJKQaUQPfPghhPj15yJH5qTD 3jiyRdy18TfzXSFMiOGaq/VbeQWIAEO6Vc7138n0T9vMwLsKx/ag3/wkia4LEWJ7 YIcKRpriM0bVYwgj14KDXItnWYCQn7DNH2ACqUto8bxC9NKxbhVIJJR4e8uz+UxL zQ7RfAMjbwG1H6JoJsYh81gPAuvgEMYAmXo/l5Kot8Gledzeal7yU6Jd6EQJegFg boMJw5a5Gv9cui71llWqqLk3naxWpFF+1Cpw81PutRD2WwRVh4y3e4SMeL7f9pva GOTigtDbuH6Trin/wCZIlJ/HHM0Y1fNzEXVLWLMziBpxhZNQMb02jYGYJOhzb10u DZcVV/7VfQPDbA2/866L7N0KJH+9uitpO1ybf6sgbpvYLdEsgDE923c1vWnGW8O9 HtipeZ1KlK5EKr9vx3WIOHqznNIc38jdpAZ4xqhU0NjfbSUMbWs= =csbI -----END PGP SIGNATURE-----