PT-2023-5474 · Apple+8 · Safari+12

Bill Marczak + 1 · Published 2023-07-18 · Updated 2026-03-16 · CVE-2023-41993

Positive Technologies · (AI Summary)

CVSS v2.0

10

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 16.6.1 Apple macOS versions prior to Ventura 13.6 Apple iOS versions prior to 16.7 Apple iPadOS versions prior to 16.7 Apple macOS Sonoma versions prior to 14 webkit2gtk versions prior to 2.42.1 Oracle Java SE version 8u401 Oracle GraalVM Enterprise Edition versions 20.3.13 and 21.3.9

Description A vulnerability exists in the WebKit engine, potentially allowing attackers to execute arbitrary code by processing malicious web content. This issue has been actively exploited in some instances, with reports indicating exploitation against iOS versions prior to 16.7. The vulnerability was addressed through improved checks in updated versions of the software. A threat actor, linked to Russia’s Foreign Intelligence Service (SVR), leveraged this vulnerability (CVE-2023-41993) in a watering hole campaign, compromising legitimate websites and redirecting visitors to malicious login pages to harvest Microsoft 365 credentials. Intellexa, a spyware vendor, also utilized this vulnerability as part of a zero-day exploit chain to deploy the Predator spyware on targets in Egypt. The exploit chain involved multiple zero-day vulnerabilities, including CVE-2023-41993, to gain deep access to devices.

Recommendations Update Apple Safari to version 16.6.1 or later. Update Apple macOS to version Ventura 13.6 or later, or macOS Sonoma 14 or later. Update Apple iOS to version 16.7 or later. Update Apple iPadOS to version 16.7 or later. Update webkit2gtk to version 2.42.1 or later. Update Oracle Java SE to a version after 8u401. Update Oracle GraalVM Enterprise Edition to a version after 20.3.13 and 21.3.9.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

ALSA-2023_4201

ALSA-2023_4202

ALSA-2023_6535

ALSA-2023_7055

ALSA-2024_2126

ALSA-2024_2982

ALSA-2025_16880

ALSA-2025_2034

ALSA-2025_2035

ALSA-2025_22789

ALSA-2025_22790

BDU:2023-06113

CESA-2023_4202

CVE-2023-41993

DSA-5527-1

DSA-5527-2

MGASA-2024-0148

OPENSUSE-SU-2023_4294-1

RHSA-2023:4201

RHSA-2023:4202

RHSA-2023_4201

RHSA-2023_4202

RHSA-2025:10364

SUSE-SU-2023:4209-1

SUSE-SU-2023:4211-1

SUSE-SU-2023:4294-1

SUSE-SU-2023:4339-1

SUSE-SU-2023_4209-1

SUSE-SU-2023_4211-1

SUSE-SU-2023_4294-1

USN-6426-1

Affected Products

Astra Linux

Centos

Debian

Java Platform

Linuxmint

Apple Macos

Red Hat

Safari

Suse

Ubuntu

Webkit

Ios

Ipados

References · 189

• 🔥 https://github.com/po6ix/POC-for-CVE-2023-41993 · Exploit
• 🔥 https://github.com/hrtowii/cve-2023-41993-test · Exploit
• 🔥 https://github.com/0x06060606/CVE-2023-41993 · Exploit
• https://ubuntu.com/security/notices/USN-6426-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/708758 · Security Note
• https://ubuntu.com/security/CVE-2023-41074 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/706926 · Security Note
• https://support.apple.com/en-us/HT213926 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5527-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0212SE17 · Vendor Advisory
• https://support.apple.com/en-us/HT213927 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://support.apple.com/kb/HT213930 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-41993 · Vendor Advisory