macOS 15.4

[Apple libarchive] An input validation issue was addressed

[Apple libxml2] Parsing a file may lead to an unexpected app termination

[Apple curl] An input validation issue was addressed

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wro…

[Apple libxml2] Parsing a file may lead to an unexpected app termination

[Apple Shortcuts] A shortcut may be able to access files that are normally inaccessible to the Shortcuts app

[Apple Logging] An app may be able to access sensitive user data

[Apple Shortcuts] A shortcut may be able to bypass sensitive Shortcuts app settings

[Apple AirDrop] An app may be able to read arbitrary file metadata

[Apple DiskArbitration] An app may be able to gain root privileges

[Apple Parental Controls] An app may be able to retrieve Safari bookmarks without an entitlement check

[Apple Software Update] An app may be able to gain elevated privileges

[Apple AppleMobileFileIntegrity] An app may be able to access user-sensitive data

[Apple iCloud Document Sharing] An attacker may be able to turn on sharing of an iCloud folder without authentication

[Apple DiskArbitration] A malicious app may be able to gain root privileges

[Apple CoreGraphics] Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memo…

[Apple Sandbox] An app may be able to access removable volumes without user consent

[Apple Safari] Visiting a malicious website may lead to user interface spoofing

[Apple LaunchServices] A malicious JAR file may bypass Gatekeeper checks

[Apple Xsan] An app may be able to cause unexpected system termination or corrupt kernel memory

[Apple CoreAudio] Parsing a file may lead to an unexpected app termination

[Apple PackageKit] An app may be able to modify protected parts of the file system

[Apple Safari] A download's origin may be incorrectly associated

[Apple Mail] "Block All Remote Content" may not apply for all mail previews

[Apple Power Services] An app may be able to break out of its sandbox

[Apple libxpc] An app may be able to break out of its sandbox

[Apple Authentication Services] A malicious website may be able to claim WebAuthn credentials from another website that…

[Apple Sandbox] An app may be able to access protected user data

[Apple CoreText] Processing a maliciously crafted font may result in the disclosure of process memory

[Apple CoreMedia] Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process…

[Apple RPAC] An app may be able to modify protected parts of the file system

[Apple Web Extensions] Visiting a website may leak sensitive data

[Apple libnetcore] Processing maliciously crafted web content may result in the disclosure of process memory

[Apple Libinfo] A user may be able to elevate privileges

[Apple Kernel] An attacker with user privileges may be able to read kernel memory

[Apple Siri] An attacker with physical access may be able to use Siri to access sensitive user data

[Apple Foundation] An app may be able to cause a denial-of-service

[Apple Accessibility] An app may be able to access sensitive user data

[Apple Kernel] An app may be able to modify protected parts of the file system

[Apple Kernel] An app may be able to access protected user data

[Apple Siri] An app may be able to access user-sensitive data

[Apple AirPlay] An attacker on the local network may be able to bypass authentication policy

[Apple Storage Management] An app may be able to enable iCloud storage features without user consent

[Apple WebKit] Processing maliciously crafted web content may lead to an unexpected process crash

[Apple ImageIO] Parsing an image may lead to disclosure of user information

[Apple CoreMedia] Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process…

[Apple Calendar] An app may be able to break out of its sandbox

[Apple Siri] An app may be able to access sensitive user data

[Apple CloudKit] A malicious app may be able to access private information

[Apple WebKit] Processing maliciously crafted web content may lead to an unexpected Safari crash

[Apple Siri] An app may be able to access sensitive user data

[Apple Summarization Services] An app may be able to access information about a user's contacts

[Apple SMB] An app may be able to execute arbitrary code with kernel privileges

[Apple Installer] A sandboxed app may be able to access sensitive user data

[Apple CoreAudio] Playing a malicious audio file may lead to an unexpected app termination

[Apple AppleMobileFileIntegrity] An app may be able to modify protected parts of the file system

[Apple NSDocument] A malicious app may be able to access arbitrary files

[Apple AppleMobileFileIntegrity] A malicious app may be able to read or write to protected files

[Apple AccountPolicy] A malicious app may be able to gain root privileges

[Apple Kerberos Helper] A remote attacker may be able to cause unexpected app termination or heap corruption

[Apple CoreMedia] An app may be able to access sensitive user data

[Apple BiometricKit] An app may be able to cause unexpected system termination

[Apple libxpc] An app may be able to gain elevated privileges

[Apple AppleMobileFileIntegrity] An app may be able to access protected user data

[Apple StorageKit] An app may be able to access user-sensitive data

[Apple WindowServer] An app may be able to trick a user into copying sensitive data to the pasteboard

[Apple System Settings] An app with root privileges may be able to access private information

[Apple Audio] Processing a maliciously crafted file may lead to arbitrary code execution

[Apple Audio] Processing a maliciously crafted font may result in the disclosure of process memory

[Apple Authentication Services] A malicious app may be able to access a user's saved passwords

[Apple OpenSSH] An app may be able to access user-sensitive data

[Apple WindowServer] An attacker may be able to cause unexpected app termination

[Apple Siri] An app may be able to enumerate devices that have signed into the user's Apple Account

[Apple Installer] An app may be able to check the existence of an arbitrary path on the file system

[Apple Security] A malicious app acting as a HTTPS proxy could get access to sensitive user data

[Apple AirPlay] An attacker on the local network may cause an unexpected app termination

[Apple AirPlay] An attacker on the local network may be able to corrupt process memory

[Apple StorageKit] An app may be able to access protected user data

[Apple Software Update] A user may be able to elevate privileges

[Apple Disk Images] An app may be able to break out of its sandbox

[Apple GPU Drivers] An app may be able to disclose kernel memory

[Apple IOGPUFamily] An app may be able to cause unexpected system termination or write kernel memory

[Apple smbx] An attacker in a privileged position may be able to perform a denial-of-service

[Apple PackageKit] An app may be able to modify protected parts of the file system

[Apple Notes] A sandboxed app may be able to access sensitive user data in system logs

[Apple StickerKit] An app may be able to observe unprotected user data

[Apple WebKit] Processing maliciously crafted web content may lead to an unexpected Safari crash

[Apple Xsan] An app may be able to cause unexpected system termination

[Apple Xsan] An app may be able to cause unexpected system termination

[Apple DiskArbitration] An app may be able to gain root privileges

[Apple SMB] An app may be able to cause unexpected system termination

[Apple AirPlay] An attacker on the local network may be able to leak sensitive user information

[Apple AirPlay] An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without p…

[Apple AppleMobileFileIntegrity] An app may be able to modify protected parts of the file system

[Apple GPU Drivers] An app may be able to cause unexpected system termination or corrupt kernel memory

[Apple App Store] A malicious app may be able to access private information

[Apple Crash Reporter] An app may be able to gain root privileges

[Apple System Settings] An app may be able to access protected user data

[Apple Voice Control] An app may be able to access contacts

[Apple Shortcuts] An app may be able to access user-sensitive data

[Apple FeedbackLogger] An app may be able to access sensitive user data

[Apple Software Update] An app may be able to modify protected parts of the file system

[Apple Focus] An app may be able to access sensitive user data

[Apple Photos Storage] Deleting a conversation in Messages may expose user contact information in system logging

[Apple WebKit] A malicious website may be able to track users in Safari private browsing mode

[Apple NetworkExtension] An app may be able to enumerate a user's installed apps

[Apple WebKit] Processing maliciously crafted web content may lead to an unexpected Safari crash

[Apple Calendar] An app may be able to break out of its sandbox

[Apple Authentication Services] Password autofill may fill in passwords after failing authentication

[Apple Shortcuts] A shortcut may be able to access files that are normally inaccessible to the Shortcuts app

[Apple Siri] A sandboxed app may be able to access sensitive user data in system logs

[Apple IOMobileFrameBuffer] An app may be able to corrupt coprocessor memory

[Apple Share Sheet] A malicious app may be able to dismiss the system notification on the Lock Screen that a recording …

[Apple Focus] An attacker with physical access to a locked device may be able to view sensitive user information

[Apple SMB] Mounting a maliciously crafted SMB network share may lead to system termination

[Apple AirPlay] An attacker on the local network may cause an unexpected app termination

[Apple PackageKit] A malicious app with root privileges may be able to modify the contents of system files

[Apple Foundation] An app may be able to access sensitive user data

[Apple StorageKit] An app may be able to gain root privileges

[Apple manpages] An app may be able to access sensitive user data

[Apple FaceTime] An app may be able to access sensitive user data

[Apple Sandbox] An input validation issue was addressed

[Apple CoreMedia Playback] A malicious app may be able to access private information

[Apple Dock] A malicious app may be able to access private information

[Apple DiskArbitration] An app may be able to gain root privileges

[Apple SystemMigration] A malicious app may be able to create symlinks to protected regions of the disk

[Apple SceneKit] An app may be able to read files outside of its sandbox

[Apple Automator] An app may be able to access protected user data

[Apple Foundation] An app may be able to access protected user data

[Apple dyld] Apps that appear to use App Sandbox may be able to launch without restrictions

[Apple Handoff] An app may be able to access sensitive user data

[Apple GPU Drivers] An app may be able to cause unexpected system termination or corrupt kernel memory

[Apple Safari] A website may be able to bypass Same Origin Policy

[Apple Safari] Visiting a malicious website may lead to address bar spoofing

[Apple Maps] An app may be able to read sensitive location information

[Apple Security] A remote user may be able to cause a denial-of-service

[Apple libxpc] An app may be able to delete files for which it does not have permission

[Apple Siri] An app may be able to access sensitive user data

[Apple Web Extensions] An app may gain unauthorized access to Local Network

[Apple Dock] An app may be able to modify protected parts of the file system

[Apple StorageKit] An app may be able to bypass Privacy preferences

[Apple Disk Images] An app may be able to break out of its sandbox

[Apple CoreServices] An app may be able to access sensitive user data

[Apple Safari] A website may be able to access sensor information without user consent

[Apple Shortcuts] A Shortcut may run with admin privileges without authentication

[Apple TCC] An app may be able to break out of its sandbox

[Apple AirPlay] An attacker on the local network may cause an unexpected app termination

[Apple zip] A path handling issue was addressed with improved validation

[Apple AirPlay] An attacker on the local network may be able to cause a denial-of-service

[Apple CoreUtils] An attacker on the local network may be able to cause a denial-of-service

[Apple libnetcore] An app may be able to read sensitive location information

[Apple StorageKit] An app may be able to access protected user data

[Apple IOMobileFrameBuffer] An app may be able to corrupt coprocessor memory

[Apple macOS Recovery] An attacker with physical access to a locked device may be able to view sensitive user informati…

[Apple Audio] An app may be able to bypass ASLR