PT-2024-19794 · Apple · Garageband

Marc Schoenefeld · Published 2024-03-12 · Updated 2024-12-09 · CVE-2024-23300

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GarageBand versions prior to 10.4.11

Description A use-after-free issue was addressed with improved memory management. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. This issue affects macOS Sonoma and Ventura users.

Recommendations For GarageBand versions prior to 10.4.11, update to version 10.4.11 to resolve the issue. As a temporary workaround, consider avoiding the processing of maliciously crafted files until the update is applied.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2024-23300

Affected Products

Garageband

References · 12

• https://osv.dev/vulnerability/CVE-2024-23300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23300 · Security Note
• https://support.apple.com/en-us/HT214090 · Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Mar/27 · Note
• https://twitter.com/theJoshMeister/status/1767694685311733839 · Twitter Post
• https://support.apple.com/en-us/120885 · Note
• https://t.me/cvenotify/103542 · Telegram Post
• https://support.apple.com/kb/HT214090 · Note
• https://twitter.com/tweetiemimi/status/1767716847246336145 · Twitter Post
• https://twitter.com/CVEnew/status/1767655217741668607 · Twitter Post
• https://twitter.com/Forbes/status/1768248750986657870 · Twitter Post
• https://twitter.com/dailycve/status/1866145450643869815 · Twitter Post