Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2024-40774: A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6...
CVE-2024-40774 · published 2 years ago
Summary
A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. An app may be able to bypass Privacy preferences.
What to do
- Update apple iphone_os to version 17.6 or later.
- Update apple ipados to version 17.6 or later.
- Update apple watchos to version 10.6 or later.
- Update apple tvos to version 17.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apple | macos |
< 12.7.6 >= 13.0, < 13.6.8 >= 14.0, < 14.6 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| apple | iphone_os |
< 17.6 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| apple | ipados |
< 17.6 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| apple | watchos |
< 10.6 cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* |
| apple | tvos |
< 17.6 cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
Original advisory text
A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6...
A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. An app may be able to bypass Privacy preferences.
References
- https://support.apple.com/en-us/120909
- https://support.apple.com/en-us/120910
- https://support.apple.com/en-us/120911
- https://support.apple.com/en-us/120912
- https://support.apple.com/en-us/120914
- https://support.apple.com/en-us/120916
- http://seclists.org/fulldisclosure/2024/Jul/16 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/21 Mailing List Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/22 Mailing List Third Party Advisory
- https://support.apple.com/en-us/HT214117 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214118 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214119 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214120 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214122 Release Notes Vendor Advisory
- https://support.apple.com/en-us/HT214124 Release Notes Vendor Advisory
- https://support.apple.com/kb/HT214117
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214120
- https://support.apple.com/kb/HT214122
- https://support.apple.com/kb/HT214124
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Timeline
Published29 Jul 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-40774 · NVD
Track software like this
Free during beta