Apple Security Advisory 09-16-2024-6

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

APPLE-SA-09-16-2024-6 Safari 18

Safari 18 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/121241.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

WebKit
Available for: macOS Ventura and macOS Sonoma
Impact: Visiting a malicious website may lead to address bar spoofing
Description: The issue was addressed with improved UI.
WebKit Bugzilla: 279451
CVE-2024-40866: Hafiizh and YoKo Kho (@yokoacc) of HakTrak

WebKit
Available for: macOS Ventura and macOS Sonoma
Impact: A malicious website may exfiltrate data cross-origin
Description: A cross-origin issue existed with “iframe” elements. This
was addressed with improved tracking of security origins.
WebKit Bugzilla: 279452
CVE-2024-44187: Narendra Bhati, Manager of Cyber Security at Suma Soft
Pvt. Ltd, Pune (India)

WebKit
Available for: macOS Ventura and macOS Sonoma
Impact: Processing maliciously crafted web content may lead to universal
cross site scripting
Description: This issue was addressed through improved state management.
WebKit Bugzilla: 268724
CVE-2024-40857: Ron Masas

Additional recognition

Safari
We would like to acknowledge Hafiizh and YoKo Kho (@yokoacc) of HakTrak
for their assistance.

Safari 18 may be obtained from the Mac App Store.

All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.

This message is signed with Apple’s Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmboyScACgkQX+5d1TXa
Ivr5URAAqi3Km6vP17ccXkXlrcDJXrYE+HSdkDkqlpT0hNsfLCcpfbZME8R02efV
lzb8JZ7DdtWI4U0WKjvJvmIhm0Ik2S1stYCNaxAtEBJ6YUYIJE5lJS4J/D3J1QTd
5ygCi+zEzPnRjQx2BZ1Ju3VQdpDen50vTBY/cdqrujtbZ5s4wY2K2qV5SaPv7/zY
6KChB6ivmuEN/iEN5e/ppTr3lAC1Hw1GFsD6xqnxK+USyydYGryQHvCzoidYjoaB
7MkfwASZ/+RmdeCK+6pcN4NP8MRszViGas0GtZe+y7O/Pu6gc6PRrpD2s2LJKUta
id0ofA1EtL+IRav/wXvJbvTBQc2vWhOrFWL4rP/9znCW2wtO8neayKewWYal1ClZ
Jn75AOig5pfk6/aTtFFVXn/869PlolaVWe/jQuTVHvXX+N1nuDCriTRpVsz/XMdb
3kWqsgMMxKjJnFQoprKpJcAA+vc28L5WLBxhXgGkcb8DML70YNg96CsH3w+qUrJL
w9+AiGrgBECU3MhQOENtE8AmTmYMDCxjnEI8pYcsu5mKmLHkBnjRhYArLP+Se+3d
PLHvbAaZf/cmO7Vm4A2uu1bhqf+E3UJLIlkIGMcwp+vQBiSAT70hri8J6fcaCvLq
Hw7rhBt/najjjENdErB9REmqAjkJY3vP2K4pjE/1PNXmHd5tQu4=
=q+/h
—–END PGP SIGNATURE—–