CVE-2024-54658

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to a denial-of-service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Apple	Safari	< 17.4
Apple	iOS and iPadOS	< 17.4
Apple	macOS	< 14.4
Apple	tvOS	< 17.4
Apple	visionOS	< 1.1
Apple	watchOS	< 10.4

References

https://support.apple.com/en-us/120881Vendor Advisory
https://support.apple.com/en-us/120882Vendor Advisory
https://support.apple.com/en-us/120883Vendor Advisory
https://support.apple.com/en-us/120893Vendor Advisory
https://support.apple.com/en-us/120894Vendor Advisory
https://support.apple.com/en-us/120895Vendor Advisory

Timeline

Published: Feb 10, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-54668.8Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote co CVE-2024-546608.7A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. Attacke CVE-2024-546619.8readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.CVE-2024-546629.1Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.CVE-2024-546637.5An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerab CVE-2024-54678.8Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report.CVE-2024-546746.1app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-gal CVE-2024-546756.1app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.CVE-2024-546769.8Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering inst CVE-2024-546775.3Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. Thi CVE-2024-546788.2A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All v CVE-2024-546796.5CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.