CVE-2024-27833

Se solucionó un desbordamiento de enteros con una validación de entrada mejorada. Este problema se solucionó en tvOS 17.5, iOS 16.7.8 y iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 y iPadOS 17.5. El procesamiento de contenido web creado con fines malintencionados puede provocar la ejecución de código arbitrario.

A vulnerability was found in WebKit. This flaw allows a remote attacker to perform arbitrary code execution when processing web content. This flaw is caused by insufficient input validation, which attackers could exploit to execute malicious code on affected systems.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the B3 JIT compiler. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow that causes an incorrect optimization. An attacker can leverage this vulnerability to execute code in the context of the current process.

visionOS 1.2 addresses bypass, code execution, integer overflow, out of bounds access, out of bounds read, and out of bounds write vulnerabilities.