Apple多款产品权限提升漏洞(CVE-2025-43200)

详细信息

漏洞类型

其他

漏洞描述

多个Apple产品可能允许远程攻击者获得系统提升的权限，这是由Messages组件中的逻辑问题引起的。通过处理通过iCloud链接共享的特制照片或视频，攻击者可以利用此漏洞获得系统权限。 Apple watchOS、macOS Ventura 、iOS、iPadOS、visionOS、macOS Sequoia、macOS Sonoma可能允许远程攻击者获得系统提升的权限，这是由Messages组件中的逻辑问题引起的。通过处理通过iCloud链接共享的特制照片或视频，攻击者可以利用此漏洞获得系统权限。此问题可能已被针对特定目标个人的极其复杂的攻击所利用。

修复建议

此问题已在watchOS 11.3.1、macOS Ventura 13.7.4、iOS 15.8.4和iPadOS 15.8.4、iOS 16.7.11和iPadOS 16.7.11、iPadOS 17.7.5、visionOS 2.3.1、macOS Sequoia 15.3.1、iOS 18.3.1和iPadOS 18.3.1、macOS Sonoma 14.7.4中修复。请参阅Apple security document以获取补丁、升级或建议的解决方法信息。参考链接： https://support.apple.com/en-us/122901 https://support.apple.com/en-us/122902 https://support.apple.com/en-us/122903 https://support.apple.com/en-us/122904 https://support.apple.com/en-us/122900 https://support.apple.com/en-us/122173 https://support.apple.com/en-us/122174 https://support.apple.com/en-us/122346 https://support.apple.com/en-us/122345

参考链接

• https://support.apple.com/en-us/122173

  CVE · Vendor Advisory

• https://support.apple.com/en-us/122174

  CVE · Vendor Advisory

• https://support.apple.com/en-us/122345

  CVE · Vendor Advisory

• https://support.apple.com/en-us/122346

  CVE · Vendor Advisory

• https://support.apple.com/en-us/122900

  CVE · Vendor Advisory

• https://support.apple.com/en-us/122901

  CVE · Vendor Advisory

• https://support.apple.com/en-us/122902

  CVE · Vendor Advisory

• https://support.apple.com/en-us/122903

  CVE · Vendor Advisory

• https://support.apple.com/en-us/122904

  CVE · Vendor Advisory

• https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

  NVD · Press/Media Coverage

• https://access.redhat.com/security/cve/cve-2025-43200

  CNNVD

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43200

  NVD · US Government Resource