Today’s release of macOS Sequoia brings 70+ new security fixes

3 months ago 24

macOS Sequoia has officially launched with new features and improvements such as window tiling, iPhone Mirroring, the new Password app, and more. But under the hood, Apple delivered a staggering amount of patched bugs/vulnerabilities to Mac users. These are the 76 security patches that come with the first public release of macOS 15 Sequoia.

The release of macOS Sequoia includes a significant number of security fixes, which is not surprising for a major .0 release. However, this is the most extensive list of CVEs I’ve ever seen in a single update. It’s great to see so many researchers and developers working to report bugs and flaws to help make the release of Sequoia as airtight as possible.

Apple shared details of each on its Security Updates page. The CVEs range from kernel vulnerabilities to addressing access to sensitive data in apps like Siri, Maps, and Shortcuts. These fixes help prevent potential exploits like arbitrary code execution, privilege escalation, and memory leaks. Apple also implemented patches to protect against various attacks by improving memory handling, input validation, and sandbox restrictions.

Here’s the full list of 76 security fixes with macOS Sequoia:

Accounts

Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later)

Impact: An app may be able to leak sensitive user information

Description: The issue was addressed with improved checks.

CVE-2024-44129

Accounts

Impact: An app may be able to access user-sensitive data

Description: The issue was addressed with improved permissions logic.

CVE-2024-44153: Mickey Jin (@patch1t)

Accounts

Impact: An app may be able to access protected user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-44188: Bohdan Stasiuk (@Bohdan_Stasiuk)

APFS

Impact: A malicious app with root privileges may be able to modify the contents of system files

Description: The issue was addressed with improved checks.

CVE-2024-40825: Pedro Tôrres (@t0rr3sp3dr0)

APNs

Impact: An app with root privileges may be able to access private information

Description: This issue was addressed with improved data protection.

CVE-2024-44130

App Intents

Impact: An app may be able to access sensitive data logged when a shortcut fails to launch another app

Description: This issue was addressed with improved redaction of sensitive information.

CVE-2024-44182: Kirin (@Pwnrin)

AppleGraphicsControl

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2024-44154: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative

AppleGraphicsControl

Impact: Processing a maliciously crafted video file may lead to unexpected app termination

Description: The issue was addressed with improved memory handling.

CVE-2024-40845: Pwn2car working with Trend Micro Zero Day Initiative

CVE-2024-40846: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative

AppleMobileFileIntegrity

Impact: An app may be able to bypass Privacy preferences

Description: This issue was addressed with improved checks.

CVE-2024-44164: Mickey Jin (@patch1t)

AppleMobileFileIntegrity

Impact: An app may be able to access protected user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-40837: Kirin (@Pwnrin)

AppleMobileFileIntegrity

Impact: An app may be able to access sensitive user data

Description: The issue was addressed with additional code-signing restrictions.

CVE-2024-40847: Mickey Jin (@patch1t)

AppleMobileFileIntegrity

Impact: An attacker may be able to read sensitive information

Description: A downgrade issue was addressed with additional code-signing restrictions.

CVE-2024-40848: Mickey Jin (@patch1t)

AppleMobileFileIntegrity

Impact: An app may be able to modify protected parts of the file system

Description: A library injection issue was addressed with additional restrictions.

CVE-2024-44168: Claudio Bozzato and Francesco Benvenuto of Cisco Talos

AppleVA

Impact: An application may be able to read restricted memory

Description: The issue was addressed with improved memory handling.

CVE-2024-27860: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative

CVE-2024-27861: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative

AppleVA

Impact: Processing a maliciously crafted video file may lead to unexpected app termination

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2024-40841: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative

AppSandbox

Impact: A camera extension may be able to access the internet

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-27795: Halle Winkler, Politepix @hallewinkler

AppSandbox

Impact: An app may be able to access protected files within an App Sandbox container

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-44135: Mickey Jin (@patch1t)

ArchiveService

Impact: An app may be able to break out of its sandbox

Description: This issue was addressed with improved handling of symlinks.

CVE-2024-44132: Mickey Jin (@patch1t)

Automator

Impact: An Automator Quick Action workflow may be able to bypass Gatekeeper

Description: This issue was addressed by adding an additional prompt for user consent.

CVE-2024-44128: Anton Boegler

bless

Impact: An app may be able to modify protected parts of the file system

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-44151: Mickey Jin (@patch1t)

Compression

Impact: Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files

Description: A race condition was addressed with improved locking.

CVE-2024-27876: Snoolie Keffaber (@0xilis)

Control Center

Impact: An app may be able to record the screen without an indicator

Description: The issue was addressed with improved checks.

CVE-2024-27869: an anonymous researcher

Control Center

Impact: Privacy Indicators for microphone or camera access may be attributed incorrectly

Description: A logic issue was addressed with improved state management.

CVE-2024-27875: Yiğit Can YILMAZ (@yilmazcanyigit)

copyfile

Impact: An app may be able to break out of its sandbox

Description: A logic issue was addressed with improved file handling.

CVE-2024-44146: an anonymous researcher

CUPS

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.

CVE-2023-4504

Disk Images

Impact: An app may be able to break out of its sandbox

Description: This issue was addressed with improved validation of file attributes.

CVE-2024-44148: an anonymous researcher

Dock

Impact: An app may be able to access user-sensitive data

Description: A privacy issue was addressed by removing sensitive data.

CVE-2024-44177: an anonymous researcher

FileProvider

Impact: An app may be able to access sensitive user data

Description: This issue was addressed with improved validation of symlinks.

CVE-2024-44131: @08Tc3wBB of Jamf

Game Center

Impact: An app may be able to access user-sensitive data

Description: A file access issue was addressed with improved input validation.

CVE-2024-40850: Denis Tokarev (@illusionofcha0s)

Image Capture

Impact: An app may be able to access a user’s Photos Library

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-40831: Mickey Jin (@patch1t)

ImageIO

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: An out-of-bounds read issue was addressed with improved input validation.

CVE-2024-27880: Junsung Lee

ImageIO

Impact: Processing an image may lead to a denial-of-service

Description: An out-of-bounds access issue was addressed with improved bounds checking.

CVE-2024-44176: dw0r of ZeroPointer Lab working with Trend Micro Zero Day Initiative, an anonymous researcher

Installer

Impact: An app may be able to gain root privileges

Description: The issue was addressed with improved checks.

CVE-2024-40861: Mickey Jin (@patch1t)

Intel Graphics Driver

Impact: Processing a maliciously crafted texture may lead to unexpected app termination

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2024-44160: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative

Intel Graphics Driver

Impact: Processing a maliciously crafted texture may lead to unexpected app termination

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2024-44161: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative

IOSurfaceAccelerator

Impact: An app may be able to cause unexpected system termination

Description: The issue was addressed with improved memory handling.

CVE-2024-44169: Antonio Zekić

Kernel

Impact: Network traffic may leak outside a VPN tunnel

Description: A logic issue was addressed with improved checks.

CVE-2024-44165: Andrew Lytvynov

Kernel

Impact: An app may gain unauthorized access to Bluetooth

Description: This issue was addressed through improved state management.

CVE-2024-44191: Alexander Heinrich, SEEMOO, DistriNet, KU Leuven (@vanhoefm), TU Darmstadt (@Sn0wfreeze) and Mathy Vanhoef

libxml2

Impact: Processing maliciously crafted web content may lead to an unexpected process crash

Description: An integer overflow was addressed through improved input validation.

CVE-2024-44198: OSS-Fuzz, Ned Williamson of Google Project Zero

Mail Accounts

Impact: An app may be able to access information about a user’s contacts

Description: A privacy issue was addressed with improved private data redaction for log entries.

CVE-2024-40791: Rodolphe BRUNETTI (@eisw0lf)

Maps

Impact: An app may be able to read sensitive location information

Description: An issue was addressed with improved handling of temporary files.

CVE-2024-44181: Kirin(@Pwnrin) and LFY(@secsys) from Fudan University

mDNSResponder

Impact: An app may be able to cause a denial-of-service

Description: A logic error was addressed with improved error handling.

CVE-2024-44183: Olivier Levon

Model I/O

Impact: Processing a maliciously crafted image may lead to a denial-of-service

Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.

CVE-2023-5841

Music

Impact: An app may be able to access protected user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-27858: Meng Zhang (鲸落) of NorthSea, Csaba Fitzl (@theevilbit) of Offensive Security

Notes

Impact: An app may be able to overwrite arbitrary files

Description: This issue was addressed by removing the vulnerable code.

CVE-2024-44167: ajajfxhj

Notification Center

Impact: A malicious app may be able to access notifications from the user’s device

Description: A privacy issue was addressed by moving sensitive data to a protected location.

CVE-2024-40838: Brian McNulty, Cristian Dinca of “Tudor Vianu” National High School of Computer Science, Romania, Vaibhav Prajapati

NSColor

Impact: An app may be able to access protected user data

Description: An access issue was addressed with additional sandbox restrictions.

CVE-2024-44186: an anonymous researcher

OpenSSH

Impact: Multiple issues in OpenSSH

Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.

CVE-2024-39894

PackageKit

Impact: An app may be able to modify protected parts of the file system

Description: This issue was addressed with improved validation of symlinks.

CVE-2024-44178: Mickey Jin (@patch1t)

Printing

Impact: An unencrypted document may be written to a temporary file when using print preview

Description: A privacy issue was addressed with improved handling of files.

CVE-2024-40826: an anonymous researcher

Quick Look

Impact: An app may be able to access protected user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-44149: Wojciech Regula of SecuRing (wojciechregula.blog), Csaba Fitzl (@theevilbit) of OffSec

Safari

Impact: Visiting a malicious website may lead to user interface spoofing

Description: This issue was addressed through improved state management.

CVE-2024-40797: Rifa’i Rejal Maynando

Sandbox

Impact: A malicious application may be able to leak sensitive user information

Description: The issue was addressed with improved checks.

CVE-2024-44125: Zhongquan Li (@Guluisacat)

Sandbox

Impact: A malicious application may be able to access private information

Description: The issue was addressed with improved checks.

CVE-2024-44163: Zhongquan Li (@Guluisacat)

Security Initialization

Impact: An app may be able to access protected user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-40801: Zhongquan Li (@Guluisacat), Pedro José Pereira Vieito (@pvieito), an anonymous researcher

Shortcuts

Impact: An app may be able to access protected user data

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-40837: Kirin (@Pwnrin)

Shortcuts

Impact: A shortcut may output sensitive user data without consent

Description: This issue was addressed with improved redaction of sensitive information.

CVE-2024-44158: Kirin (@Pwnrin)

Shortcuts

Impact: An app may be able to observe data displayed to the user by Shortcuts

Description: A privacy issue was addressed with improved handling of temporary files.

CVE-2024-40844: Kirin (@Pwnrin) and luckyu (@uuulucky) of NorthSea

Siri

Impact: An app may be able to access user-sensitive data

Description: A privacy issue was addressed by moving sensitive data to a more secure location.

CVE-2024-44170: K宝, LFY (@secsys), Smi1e, yulige, Cristian Dinca (icmd.tech), Rodolphe BRUNETTI (@eisw0lf)

sudo

Impact: An app may be able to modify protected parts of the file system

Description: A logic issue was addressed with improved checks.

CVE-2024-40860: Arsenii Kostromin (0x3c3e)

System Settings

Impact: An app may be able to access user-sensitive data

Description: A privacy issue was addressed with improved private data redaction for log entries.

CVE-2024-44152: Kirin (@Pwnrin)

CVE-2024-44166: Kirin (@Pwnrin) and LFY (@secsys) from Fudan University

System Settings

Impact: An app may be able to read arbitrary files

Description: A path handling issue was addressed with improved validation.

CVE-2024-44190: Rodolphe BRUNETTI (@eisw0lf)

TCC

Impact: On MDM managed devices, an app may be able to bypass certain Privacy preferences

Description: This issue was addressed by removing the vulnerable code.

CVE-2024-44133: Jonathan Bar Or (@yo_yo_yo_jbo) of Microsoft

Transparency

Impact: An app may be able to access user-sensitive data

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-44184: Bohdan Stasiuk (@Bohdan_Stasiuk)

TV App

Impact: An app may be able to access user-sensitive data

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-40859: Csaba Fitzl (@theevilbit) of Offensive Security

Vim

Impact: Processing a maliciously crafted file may lead to unexpected app termination

Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.

CVE-2024-41957

WebKit

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: This issue was addressed through improved state management.

WebKit Bugzilla: 268724

CVE-2024-40857: Ron Masas

WebKit

Impact: Visiting a malicious website may lead to address bar spoofing

Description: The issue was addressed with improved UI.

WebKit Bugzilla: 279451

CVE-2024-40866: Hafiizh and YoKo Kho (@yokoacc) of HakTrak

WebKit

Impact: A malicious website may exfiltrate data cross-origin

Description: A cross-origin issue existed with “iframe” elements. This was addressed with improved tracking of security origins.

WebKit Bugzilla: 279452

CVE-2024-44187: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India)

Wi-Fi

Impact: A non-privileged user may be able to modify restricted network settings

Description: A permissions issue was addressed with additional restrictions.

CVE-2024-40770: Yiğit Can YILMAZ (@yilmazcanyigit)

Wi-Fi

Impact: An app may be able to cause a denial-of-service

Description: The issue was addressed with improved memory handling.

CVE-2024-23237: Charly Suchanek

Wi-Fi

Impact: An app may be able to read sensitive location information

Description: This issue was addressed with improved redaction of sensitive information.

CVE-2024-44134

Wi-Fi

Impact: An attacker may be able to force a device to disconnect from a secure network

Description: An integrity issue was addressed with Beacon Protection.

CVE-2024-40856: Domien Schepers

WindowServer

Impact: A logic issue existed where a process may be able to capture screen contents without user consent

Description: The issue was addressed with improved checks.

CVE-2024-44189: Tim Clem

XProtect

Impact: An app may be able to access user-sensitive data

Description: An issue was addressed with improved validation of environment variables.

CVE-2024-40842: Gergely Kalman (@gergely_kalman)

XProtect

Impact: An app may be able to modify protected parts of the file system

Description: The issue was addressed with improved checks.

CVE-2024-40843: Koh M. Nakagawa (@tsunek0h)

Additional recognition

Admin Framework

We would like to acknowledge Csaba Fitzl (@theevilbit) of Offensive Security for their assistance.

Airport

We would like to acknowledge David Dudok de Wit, Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.

APFS

We would like to acknowledge Georgi Valkov of httpstorm.com for their assistance.

App Store

We would like to acknowledge Csaba Fitzl (@theevilbit) of Offensive Security for their assistance.

AppKit

We would like to acknowledge @08Tc3wBB of Jamf for their assistance.

Apple Neural Engine

We would like to acknowledge Jiaxun Zhu (@svnswords) and Minghao Lin (@Y1nKoc) for their assistance.

Automator

We would like to acknowledge Koh M. Nakagawa (@tsunek0h) for their assistance.

Core Bluetooth

We would like to acknowledge Nicholas C. of Onymos Inc. (onymos.com) for their assistance.

Core Services

We would like to acknowledge Cristian Dinca of “Tudor Vianu” National High School of Computer Science, Romania, Kirin (@Pwnrin) and 7feilee, Snoolie Keffaber (@0xilis), Tal Lossos, Zhongquan Li (@Guluisacat) for their assistance.

Disk Utility

We would like to acknowledge Csaba Fitzl (@theevilbit) of Kandji for their assistance.

FileProvider

We would like to acknowledge Kirin (@Pwnrin) for their assistance.

Foundation

We would like to acknowledge Ostorlab for their assistance.

Kernel

We would like to acknowledge Braxton Anderson, Fakhri Zulkifli (@d0lph1n98) of PixiePoint Security for their assistance.

libxpc

We would like to acknowledge Rasmus Sten, F-Secure (Mastodon: @[email protected]) for their assistance.

LLVM

We would like to acknowledge Victor Duta of Universiteit Amsterdam, Fabio Pagani of University of California, Santa Barbara, Cristiano Giuffrida of Universiteit Amsterdam, Marius Muench, and Fabian Freyer for their assistance.

Maps

We would like to acknowledge Kirin (@Pwnrin) for their assistance.

Music

We would like to acknowledge Khiem Tran of databaselog.com/khiemtran, K宝 and LFY@secsys from Fudan University, Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.

Notifications

We would like to acknowledge an anonymous researcher for their assistance.

PackageKit

We would like to acknowledge Csaba Fitzl (@theevilbit) of OffSec, Mickey Jin (@patch1t), Zhongquan Li (@Guluisacat) for their assistance.

Passwords

We would like to acknowledge Richard Hyunho Im (@r1cheeta) for their assistance.

Photos

We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi Narain College of Technology Bhopal India, Harsh Tyagi, Leandro Chaves for their assistance.

Podcasts

We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.

Quick Look

We would like to acknowledge Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (xlab.tencent.com) for their assistance.

Safari

We would like to acknowledge Hafiizh and YoKo Kho (@yokoacc) of HakTrak, Junsung Lee, Shaheen Fazim for their assistance.

Sandbox

We would like to acknowledge Cristian Dinca of “Tudor Vianu” National High School of Computer Science, Romania, Kirin (@Pwnrin) of NorthSea, Wojciech Regula of SecuRing (wojciechregula.blog), Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.

Screen Capture

We would like to acknowledge Joshua Jewett (@JoshJewett33), Yiğit Can YILMAZ (@yilmazcanyigit), an anonymous researcher for their assistance.

Shortcuts

We would like to acknowledge Cristian Dinca of “Tudor Vianu” National High School of Computer Science, Romania, Jacob Braun, an anonymous researcher for their assistance.