Actively exploited · Published Nov 19, 2024 · Assigned by apple
CVE-2024-44308
High 8.8 Exploited
In plain English
A high-severity security flaw in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 21, 2024). The chance it is exploited in the next 30 days is estimated at 9.9% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 12, 2024.
Official description
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | webkit2gtk | 2.46.4-1~deb12u1 | DSA-5823-1 |
| Debian:12 | webkit2gtk | 2.46.4-1~deb12u1 | DEBIAN-CVE-2024-44308 |
| Debian:13 | webkit2gtk | 2.46.4-1 | DEBIAN-CVE-2024-44308 |
| Debian:14 | webkit2gtk | 2.46.4-1 | DEBIAN-CVE-2024-44308 |
| Debian:12 | wpewebkit | no fix listed | DEBIAN-CVE-2024-44308 |
| Debian:13 | wpewebkit | 2.46.4-1 | DEBIAN-CVE-2024-44308 |
| Debian:14 | wpewebkit | 2.46.4-1 | DEBIAN-CVE-2024-44308 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2024-44308 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2024-44308 |
| Ubuntu:22.04:LTS | webkit2gtk | 2.46.4-0ubuntu0.22.04.1 | USN-7142-1 |
| Ubuntu:22.04:LTS | webkit2gtk | 2.46.4-0ubuntu0.22.04.1 | UBUNTU-CVE-2024-44308 |
| Ubuntu:24.04:LTS | webkit2gtk | 2.46.4-0ubuntu0.24.04.1 | USN-7142-1 |
| Ubuntu:24.04:LTS | webkit2gtk | 2.46.4-0ubuntu0.24.04.1 | UBUNTU-CVE-2024-44308 |
| Ubuntu:22.04:LTS | wpewebkit | no fix listed | UBUNTU-CVE-2024-44308 |
Affected products (as reported)
References
- https://support.apple.com/en-us/121752
- https://support.apple.com/en-us/121753
- https://support.apple.com/en-us/121754
- https://support.apple.com/en-us/121755
- https://support.apple.com/en-us/121756
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308 government-resource
- https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html
- http://seclists.org/fulldisclosure/2024/Nov/16