Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-40776
CVE-2024-40776:
Apple Safari vulnerability analysis and mitigation
Overview
CVE-2024-40776 is a use-after-free vulnerability affecting multiple Apple operating systems and applications, including iOS 16.7.9, iPadOS 16.7.9, Safari 17.6, iOS 17.6, iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, and macOS Sonoma 14.6. The vulnerability was discovered by Huang Xilin of Ant Group Light-Year Security Lab and was disclosed on July 29, 2024 (Apple Support).
Technical details
The vulnerability is a use-after-free issue in WebKit, Apple's browser engine. The issue occurs when processing maliciously crafted web content, which could lead to an unexpected process crash. The vulnerability was addressed with improved memory management and is tracked in WebKit Bugzilla under ID 273176. The CVSS v3.1 base score is 4.3 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, while CISA-ADP assessed it at 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).
Impact
When exploited, this vulnerability can lead to an unexpected process crash when processing maliciously crafted web content. The impact is primarily focused on availability, with no direct impact on confidentiality or integrity of the system (Apple Support, NVD).
Mitigation and workarounds
Apple has released security updates to address this vulnerability across multiple platforms. Users should update to iOS 16.7.9, iPadOS 16.7.9, Safari 17.6, iOS 17.6, iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, or macOS Sonoma 14.6 depending on their device. These updates include improved memory management to prevent the use-after-free issue (Apple Support).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management