CVE-2024-44144: Buffer Overflow
Published Sep 16, 2024
·Updated
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7.1, tvOS 18, visionOS 2, watchOS 11. Processing a maliciously crafted file may lead to unexpected app termination.
Other sources
Accessibility. The issue was addressed with improved authentication.
— Apple
Accessibility. This issue was addressed by restricting options offered on a locked device.
— Apple
Accessibility. This issue was addressed through improved state management.
— Apple
Accessibility. This issue was addressed with improved data protection.
— Apple
Accounts. A permissions issue was addressed with additional restrictions.
— Apple
Credit
Snoolie Keffaber@@0xilis, Csaba Fitzl@@theevilbit(Kandji), Denis Tokarev@@illusionofcha0s, Junsung Lee, dw0r(ZeroPointer Lab working with Trend Micro Zero Day Initiative), an anonymous researcher, Antonio Zekić, Andrew Lytvynov, Alexander Heinrich, SEEMOO, DistriNet, KU Leuven@@vanhoefm, TU Darmstadt@@Sn0wfreeze, Mathy Vanhoef, OSS-Fuzz(Google Project Zero), Ned Williamson(Google Project Zero), Olivier Levon, CVE-2023-5841, ajajfxhj, Max Thomas, 냥냥, Narendra Bhati(Cyber Security At Suma Soft Pvt), Manager(Cyber Security At Suma Soft Pvt), Pune (India), Tashita Software Security, Ron Masas, Narendra Bhati(Cyber Security at Suma Soft Pvt), Manager(Cyber Security at Suma Soft Pvt), Kirin@@Pwnrin, Jeff Johnson (underpassapp.com), Preet Dsouza (Fleming College, Computer Security & Investigations Program), Domien Schepers, K宝, LFY@@secsys, Smi1e, yulige, Cristian Dinca (icmd.tech), Rodolphe BRUNETTI@@eisw0lf, Holger Fuhrmannek, Pedro Tôrres@@t0rr3sp3dr0, Jake Derouin (jakederouin.com), Bistrit Dahal, Joshua Keller, Lukas, Kenneth Chew, Anamika Adhikari, Wojciech Regula(SecuRing), Om Kothawade(Zaprico Digital), Omar A. Alanis(the UNTHSC College of Pharmacy), Matej Moravec@@MacejkoMoravec, Chi Yuan Chang(ZUSO ART), taikosoup, Srijan Poudel, Ron Masas(BreakPoint), Bohdan Stasiuk@@Bohdan_Stasiuk, Justin Cohen, Tim Michaud@@TimGMichaud(Moveworks), Daniele Antonioli, @@08Tc3wBB(Jamf), Tuan D. Hoang, Chloe Surett, Abhay Kailasia@@abhay_kailasia(Lakshmi Narain College of Technology Bhopal India), CVE-2024-44129, Mickey Jin@@patch1t, Yiğit Can YILMAZ@@yilmazcanyigit, CVE-2024-44130, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Pwn2car(Trend Micro Zero Day Initiative), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Halle Winkler, Politepix@@hallewinkler, Anton Boegler, Rodolphe Brunetti@@eisw0lf, CVE-2023-4504, Kirin@@Pwnrin(Fudan University), LFY@@secsys(Fudan University), Meng Zhang (鲸落)(NorthSea), Brian McNulty(Computer Science), Cristian Dinca(Computer Science), Romania, Vaibhav Prajapati, CVE-2024-39894, Rifa'i Rejal Maynando, Zhongquan Li@@Guluisacat, Yiğit Can YILMAZ@@yilmazcanyigit(SecuRing), Kirin@@Pwnrin(NorthSea), Vivek Dhar, working as Assistant Sub-Inspector (RM) in Border Security Force (Frontier Headquarter BSF Kashmir), Pedro José Pereira Vieito@@pvieito, luckyu@@uuulucky(NorthSea), Om Kothawade(the UNTHSC College of Pharmacy), Arsenii Kostromin (0x3c3e), Jonathan Bar Or@@yo_yo_yo_jbo(Microsoft), CVE-2024-41957, Hafiizh(HakTrak), YoKo Kho@@yokoacc(HakTrak), Antonio Zekic@@antoniozekic, ant4g0nist, Charly Suchanek, CVE-2024-44134, Tim Clem, Gergely Kalman@@gergely_kalman, Koh M. Nakagawa@@tsunek0h, Ivan Fratric(Google Project Zero), pattern-f@@pattern_F_(Loadshine Lab), Hikerell(Loadshine Lab), Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Alexandre Bedard, Ronny Stiftel, Wang Yu(Cyberserval), Junsung Lee(Trend Micro Zero Day Initiative), Jex Amro, Mateusz Krzywicki@@krzywix, Noah Gregory (wts.dev), Mickey Jin@@patch1t(Kandji), Un3xploitable(CW Research Inc), Bohdan Stasiuk@@Bohdan_Stasiuk(CW Research Inc), Bing Shi(Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), (Indiana University Bloomington), Luyi Xing(Indiana University Bloomington), dw0r!(Trend Micro Zero Day Initiative), Rizki Maulana (rmrizki.my.id), Matthew Butler, Jake Derouin, Hichem Maloufi, Christian Mina, Ismail Amzdak, Nimrat Khalsa, James Gill @infosec.exchange)@@jjtech, Dragon Fruit Security (Davis Dai, ORAC Luoyun, Frank Du cooperative discovery), Braylon@@softwarescool
Affected Software
14 affected componentsFixes available
Apple macOS Sonoma<14.7.1
14.7.1
Apple visionOS<2
2
Apple tvOS<18
18
Apple macOS Sequoia<15
15
Apple WatchOS<11
11
Apple iOS<18
18
Apple iPadOS<18
18
Apple iOS<17.7.1
17.7.1
Apple iPadOS<17.7.1
17.7.1
Apple iPadOS<17.7.1
Apple iPhone OS<17.7.1
Apple macOS<14.7.1
Apple tvOS<18.0
Apple WatchOS<11.0
Event History
Sep 16, 2024
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Oct 28, 2024
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·09:08 PM
Data Sourced
via MITRE·09:08 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2024-44126
- CVE-2024-40825
- CVE-2024-27876
- CVE-2024-40855
- CVE-2024-54469
- CVE-2024-40850
- CVE-2024-27880
- CVE-2024-44176
- CVE-2024-44169
- CVE-2024-44165
- CVE-2024-44191
- CVE-2024-44198
- CVE-2024-44183
- CVE-2023-5841
- CVE-2024-44167
- CVE-2024-40790
- CVE-2024-44144
- CVE-2024-54467
- CVE-2024-44192
- CVE-2024-40857
- CVE-2024-44187
- CVE-2024-54560
- CVE-2024-40856
- CVE-2024-44171
- CVE-2024-44155
- CVE-2024-44170
- CVE-2024-40840
- CVE-2024-40830
- CVE-2024-40852
- CVE-2024-27874
- CVE-2024-27869
- CVE-2024-44124
- CVE-2024-44131
- CVE-2024-44122
- CVE-2024-40791
- CVE-2024-44147
- CVE-2024-44217
- CVE-2024-40826
- CVE-2024-44202
- CVE-2024-44127
- CVE-2024-40863
- CVE-2024-44123
- CVE-2024-44145
- CVE-2024-44179
- CVE-2024-40853
- CVE-2024-44139
- CVE-2024-44180
- CVE-2024-54558
- CVE-2024-44184
- CVE-2024-27879
- CVE-2024-44227
- CVE-2024-44129
- CVE-2024-44153
- CVE-2024-44188
- CVE-2024-40792
- CVE-2024-44130
- CVE-2024-44182
- CVE-2024-44154
- CVE-2024-40845
- CVE-2024-40846
- CVE-2024-44164
- CVE-2024-40837
- CVE-2024-40847
- CVE-2024-40848
- CVE-2024-44168
- CVE-2024-27860
- CVE-2024-27861
- CVE-2024-40841
- CVE-2024-27795
- CVE-2024-44135
- CVE-2024-44132
- CVE-2024-44128
- CVE-2024-44151
- CVE-2024-44172
- CVE-2024-27875
- CVE-2024-44146
- CVE-2024-27849
- CVE-2023-4504
- CVE-2024-44148
- CVE-2024-44177
- CVE-2024-54463
- CVE-2024-40831
- CVE-2024-40861
- CVE-2024-44160
- CVE-2024-44161
- CVE-2024-44175
- CVE-2024-54473
- CVE-2024-44181
- CVE-2024-27858
- CVE-2024-40838
- CVE-2024-44186
- CVE-2024-39894
- CVE-2024-44178
- CVE-2024-44149
- CVE-2024-40797
- CVE-2024-44125
- CVE-2024-44163
- CVE-2024-44203
- CVE-2024-44137
- CVE-2024-44174
- CVE-2024-40801
- CVE-2024-44158
- CVE-2024-40844
- CVE-2024-40860
- CVE-2024-44152
- CVE-2024-44166
- CVE-2024-44190
- CVE-2024-44133
- CVE-2024-40859
- CVE-2024-41957
- CVE-2024-40866
- CVE-2024-54546
- CVE-2024-40770
- CVE-2024-23237
- CVE-2024-44134
- CVE-2024-44189
- CVE-2024-44208
- CVE-2024-40842
- CVE-2024-40843
- CVE-2024-44255
- CVE-2024-44232
- CVE-2024-44233
- CVE-2024-44234
- CVE-2024-44270
- CVE-2024-44280
- CVE-2024-44260
- CVE-2024-44273
- CVE-2024-44295
- CVE-2024-44240
- CVE-2024-44302
- CVE-2024-44213
- CVE-2024-44289
- CVE-2024-44282
- CVE-2024-44265
- CVE-2024-40854
- CVE-2024-44215
- CVE-2024-44297
- CVE-2024-44216
- CVE-2024-44287
- CVE-2024-44197
- CVE-2024-44239
- CVE-2024-44222
- CVE-2024-44256
- CVE-2024-54471
- CVE-2024-44159
- CVE-2024-44156
- CVE-2024-44196
- CVE-2024-44253
- CVE-2024-44247
- CVE-2024-44267
- CVE-2024-44301
- CVE-2024-44275
- CVE-2024-44294
- CVE-2024-44218
- CVE-2024-54538
- CVE-2024-44254
- CVE-2024-44269
- CVE-2024-44236
- CVE-2024-44237
- CVE-2024-44284
- CVE-2024-44279
- CVE-2024-44281
- CVE-2024-44283
- CVE-2024-44278
- CVE-2024-44264
- CVE-2024-44257
- CVE-2024-44274
- CVE-2024-44258
- CVE-2024-44252
- CVE-2024-44259
- CVE-2024-54470
- CVE-2024-44261
- CVE-2024-44296
Frequently Asked Questions
1
What is the severity of CVE-2024-44144?
CVE-2024-44144 has been rated as a high severity vulnerability due to its potential to cause unexpected app termination.
2
How do I fix CVE-2024-44144?
To address CVE-2024-44144, update your devices to the latest versions available, specifically iOS 17.7.1, iPadOS 17.7.1, macOS Sequoia 15, macOS Sonoma 14.7.1, tvOS 18, watchOS 11, visionOS 2, iOS 18, and iPadOS 18.
3
What are the affected products for CVE-2024-44144?
CVE-2024-44144 affects multiple Apple products including iOS, iPadOS, macOS Sequoia, macOS Sonoma, tvOS, watchOS, and visionOS versions mentioned.
4
What types of attacks can exploit CVE-2024-44144?
CVE-2024-44144 can be exploited by processing a maliciously crafted file, which may lead to unexpected termination of the application.
5
Is there a specific version of macOS affected by CVE-2024-44144?
Yes, CVE-2024-44144 specifically affects macOS Sequoia up to version 15 and macOS Sonoma up to version 14.7.1.