PT-2023-6795 · Apple+6 · Safari+7

Publicado 2023-08-05 · Atualizado 2024-04-26 · CVE-2023-40451

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Safari versions prior to 17

Description This issue is related to improved iframe sandbox enforcement. An attacker with JavaScript execution may be able to execute arbitrary code. The vulnerability is also associated with the WPE WebKit and WebKitGTK modules, which may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 17, update to Safari 17 to resolve the issue. As a temporary workaround, consider restricting JavaScript execution until a patch is available. Restrict access to sensitive data and implement additional security measures to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALSA-2023:6535

ALSA-2023:7055

BDU:2023-07660

CESA-2023_7055

CVE-2023-40451

DSA-5468-1

MGASA-2024-0148

OPENSUSE-SU-2023_4294-1

OPENSUSE-SU-2024_0004-1

RHSA-2023:6535

RHSA-2023:7055

RHSA-2023_6535

RHSA-2023_7055

RHSA-2025:10364

SUSE-SU-2023:4209-1

SUSE-SU-2023:4211-1

SUSE-SU-2023:4294-1

SUSE-SU-2023:4339-1

SUSE-SU-2023:4978-1

SUSE-SU-2024:0002-1

SUSE-SU-2024:0004-1

Produtos afetados

Almalinux

Astra Linux

Centos

Debian

Apple Macos

Red Hat

Safari

Suse

Referências · 124

• 🔥 https://github.com/po6ix/POC-for-CVE-2023-41993 · Exploit
• 🔥 https://github.com/hrtowii/cve-2023-41993-test · Exploit
• 🔥 https://github.com/0x06060606/CVE-2023-41993 · Exploit
• https://bugzilla.redhat.com/2241405 · Nota
• https://webkitgtk.org/2023/09/15/webkitgtk2.42.0-released.html · Nota
• https://webkitgtk.org/2023/11/10/webkitgtk2.42.2-released.html · Nota
• https://ubuntu.com/security/CVE-2023-40451 · Aviso do Fabricante
• https://webkitgtk.org/2023/12/21/webkitgtk2.43.3-released.html · Nota
• https://webkitgtk.org/2023/12/05/webkitgtk2.42.3-released.html · Nota
• https://bugzilla.redhat.com/2236843 · Nota
• http://seclists.org/fulldisclosure/2023/Oct/2 · Nota
• https://suse.com/support/update/announcement/2023/suse-su-20234978-1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2023:4211-1 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Aviso do Fabricante
• https://bugzilla.suse.com/1215866 · Nota