site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-29-2024-1 Safari 17.6 Safari 17.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT214121. Apple maintains a Security Releases page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Safari Available for: macOS Monterey and macOS Ventura Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: The issue was addressed with improved UI handling. CVE-2024-40817: Yadhu Krishna M and Narendra Bhati, Manager of Cyber Security At Suma Soft Pvt. Ltd, Pune (India) WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 273176 CVE-2024-40776: Huang Xilin of Ant Group Light-Year Security Lab WebKit Bugzilla: 268770 CVE-2024-40782: Maksymilian Motyl WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: An out-of-bounds read was addressed with improved bounds checking. WebKit Bugzilla: 275431 CVE-2024-40779: Huang Xilin of Ant Group Light-Year Security Lab WebKit Bugzilla: 275273 CVE-2024-40780: Huang Xilin of Ant Group Light-Year Security Lab WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: This issue was addressed with improved checks. WebKit Bugzilla: 273805 CVE-2024-40785: Johan Carlsson (joaxcar) WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2024-40789: Seunghyun Lee (@0x10n) of KAIST Hacking Lab working with Trend Micro Zero Day Initiative WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. WebKit Bugzilla: 274165 CVE-2024-4558 WebKit Available for: macOS Monterey and macOS Ventura Impact: Private Browsing tabs may be accessed without authentication Description: This issue was addressed through improved state management. WebKit Bugzilla: 275272 CVE-2024-40794: Matthew Butler Additional recognition WebKit We would like to acknowledge an anonymous researcher for their assistance. Safari 17.6 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmaoHvUACgkQX+5d1TXa Ivqp7g//W0X1OTp1Vy3a1AlxeI62Kc4NwkPOVolrJHbKx+NRWkoh8MGi+nC63x22 aMekxuerqrptlmdX9wIYnrLbwbZC2nC4U1TJtzeVnsj3K8qDzc6WHEGol8hLR8F7 fK8YdfwDHT1VZedVKOarSB9PvXcomnAp63AS3qUwctnwglQZ+mrR18xAoFpIhdLT uaUWJCq3bY4aD7fmU42ji1uLSPfcjLcfvWjavB5kcLEGHDFMUx3WJNtIR+/iBqjm /0o2DzFW91N+IYwRC0m7Cus2gsFgzKWRkDUEeOV/UDsXiNfRVlCBl55hPAT+yg/y iUvarlPYrGR8hPlFJpuy6mFHaiR/EWquxWMVasZwIchBxq69eM79ezu3quE6Eztz nkSvi9uJuqMv6PWp2YrG3yXzgvnUyxITKftK5CnJnDKjhucqUT9zWr58or22NzO8 Qswy0eILPCHwzRYWkhvA3guQh/DaUeaBycFrQlgJRcfdTgLXXsBp6LTX+H9h7G2F IN1fP6o9AR7kSkrNZAXi1ek3UoZBWtoCiQCD2ITjAAaam5UueI8ZmHPpyIjTOyeI +QGBa7rNZ5vbOU4ojQGWC93iCxrNuFgcB2wshr9Uz8YujY0vJAoKSJruY71tODaL WDvvLa4GQ+um3pXAewqay83rn1e3X9GClc89Q9LScdGVugdzEB0= =+Uon -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com