CISA adds Apple flaw CVE-2024-27834 to its Known Exploited Vulnerabilities catalogue
VULNERABILITYCVE-2024-27834redteam/daily · 2 sources
- Severity
- High
- Highest CVSS
- 5.5
- Exploited
- Yes
- Sources
- 2
What happened
CISA has added CVE-2024-27834 (CVSS 5.5) to its Known Exploited Vulnerabilities catalogue. It allows an attacker with arbitrary read and write access to bypass Pointer Authentication on Apple operating systems and Safari. Sekoia linked a zero-click exploit chain using this bypass to Russia-linked group APT29, which deployed information-stealing malware. Apple fixed the flaw in Safari 17.5, iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5.
For IT people · Written by AI from 2 sources · Wrong?
What to do
- Update iPhone and iPad to iOS or iPadOS 17.5, or 16.7.8 for devices that cannot run iOS 17.
- Update Macs to macOS Sonoma 14.5 and Safari to version 17.5.
- Update Apple Watch to watchOS 10.5 and Apple TV to tvOS 17.5.
- Federal agencies should remediate the flaw by the due date set by CISA.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 4 updates
- 14 May 2024CVE-2024-27834 published, CVSS 5.5NVD
- Wed 4 NovemberCVE-2024-27834 added to CISA’s exploited listCISA KEV
- Thu 5 NovemberHackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA SaysThe Hacker News
- U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalogSecurity Affairs
Who reported · 2 outlets
The Hacker NewsSecurity Affairs
Who and what is in it
Threat actors
Products