PT-2023-5474 · Apple +8 · Ipados +12

Bill Marczak

+1

·

Published

2023-07-18

·

Updated

2025-12-08

·

CVE-2023-41993

CVSS v2.0
10
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 16.6.1 Apple macOS versions prior to Ventura 13.6 Apple iOS versions prior to 16.7 Apple iPadOS versions prior to 16.7 Apple macOS Sonoma versions prior to 14 webkit2gtk versions prior to 2.42.1 Oracle Java SE version 8u401 Oracle GraalVM Enterprise Edition versions 20.3.13 and 21.3.9
Description A vulnerability exists in the WebKit engine, potentially allowing attackers to execute arbitrary code by processing malicious web content. This issue has been actively exploited in some instances, with reports indicating exploitation against iOS versions prior to 16.7. The vulnerability was addressed through improved checks in updated versions of the software. A threat actor, linked to Russia’s Foreign Intelligence Service (SVR), leveraged this vulnerability (CVE-2023-41993) in a watering hole campaign, compromising legitimate websites and redirecting visitors to malicious login pages to harvest Microsoft 365 credentials. Intellexa, a spyware vendor, also utilized this vulnerability as part of a zero-day exploit chain to deploy the Predator spyware on targets in Egypt. The exploit chain involved multiple zero-day vulnerabilities, including CVE-2023-41993, to gain deep access to devices.
Recommendations Update Apple Safari to version 16.6.1 or later. Update Apple macOS to version Ventura 13.6 or later, or macOS Sonoma 14 or later. Update Apple iOS to version 16.7 or later. Update Apple iPadOS to version 16.7 or later. Update webkit2gtk to version 2.42.1 or later. Update Oracle Java SE to a version after 8u401. Update Oracle GraalVM Enterprise Edition to a version after 20.3.13 and 21.3.9.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

ALSA-2023_4201
ALSA-2023_4202
ALSA-2023_6535
ALSA-2023_7055
ALSA-2024_2126
ALSA-2024_2982
ALSA-2025_2034
ALSA-2025_2035
ALSA-2025_22789
ALSA-2025_22790
BDU:2023-06113
CESA-2023_4202
CVE-2023-41993
DSA-5527-1
DSA-5527-2
MGASA-2024-0148
OPENSUSE-SU-2023_4294-1
RHSA-2023:4201
RHSA-2023:4202
RHSA-2023_4201
RHSA-2023_4202
RHSA-2023_6535
RHSA-2023_7055
RHSA-2024_2126
RHSA-2024_2982
RHSA-2024_9636
RHSA-2025:10364
RHSA-2025_2034
SUSE-SU-2023:4209-1
SUSE-SU-2023:4211-1
SUSE-SU-2023:4294-1
SUSE-SU-2023:4339-1
SUSE-SU-2023_4209-1
SUSE-SU-2023_4211-1
SUSE-SU-2023_4294-1
USN-6426-1

Affected Products

Astra Linux
Centos
Debian
Java Platform
Linuxmint
Apple Macos
Red Hat
Safari
Suse
Ubuntu
Webkit
Ios
Ipados