Detections
Analytics

macOS 15.x < 15.7.2 Multiple Vulnerabilities (125635)

high Nessus Plugin ID 272235

Language:

Synopsis

The remote host is missing a macOS update that fixes multiple vulnerabilities

Description

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.7.2. It is, therefore, affected by multiple vulnerabilities:

 - Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI- CAN-21876. (CVE-2025-6442)

 - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability. (CVE-2024-43398)

 - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability. (CVE-2024-49761)

 - A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A shortcut may be able to access files that are normally inaccessible to the Shortcuts app. (CVE-2025-30465)

 - A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to access sensitive user data. (CVE-2025-43292)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

Solution

Upgrade to macOS 15.7.2 or later.

See Also

https://support.apple.com/en-us/125635

Plugin Details

Severity: High

ID: 272235

File Name: macos_125635.nasl

Version: 1.2

Type: local

Agent: macosx

Published: 11/4/2025

Updated: 11/7/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2025-6442

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2024-49761

Vulnerability Information

CPE: cpe:/o:apple:mac_os_x:15.0, cpe:/o:apple:macos:15.0

Exploit Ease: No known exploits are available

Patch Publication Date: 11/3/2025

Vulnerability Publication Date: 8/22/2024

Reference Information

CVE: CVE-2024-43398, CVE-2024-49761, CVE-2025-30465, CVE-2025-43292, CVE-2025-43322, CVE-2025-43334, CVE-2025-43335, CVE-2025-43336, CVE-2025-43337, CVE-2025-43348, CVE-2025-43361, CVE-2025-43373, CVE-2025-43377, CVE-2025-43378, CVE-2025-43379, CVE-2025-43380, CVE-2025-43382, CVE-2025-43383, CVE-2025-43384, CVE-2025-43385, CVE-2025-43387, CVE-2025-43389, CVE-2025-43390, CVE-2025-43391, CVE-2025-43394, CVE-2025-43395, CVE-2025-43396, CVE-2025-43397, CVE-2025-43398, CVE-2025-43399, CVE-2025-43401, CVE-2025-43405, CVE-2025-43407, CVE-2025-43408, CVE-2025-43409, CVE-2025-43411, CVE-2025-43412, CVE-2025-43413, CVE-2025-43414, CVE-2025-43420, CVE-2025-43423, CVE-2025-43445, CVE-2025-43446, CVE-2025-43448, CVE-2025-43468, CVE-2025-43469, CVE-2025-43472, CVE-2025-43474, CVE-2025-43476, CVE-2025-43477, CVE-2025-43478, CVE-2025-43479, CVE-2025-43481, CVE-2025-43496, CVE-2025-43498, CVE-2025-43499, CVE-2025-6442

APPLE-SA: 125635

IAVA: 2025-A-0815