PT-2023-6026 · Apple+6 · Macos Sonoma+10

Dohyun Lee + 2 · Published 2023-08-05 · Updated 2025-05-02 · CVE-2023-39434

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions iOS versions prior to 17 iPadOS versions prior to 17 watchOS versions prior to 10 macOS Sonoma versions prior to 14

Description A use-after-free issue was addressed with improved memory management. Processing web content may lead to arbitrary code execution. This issue is related to the WebKitGTK and WPE WebKit modules, which are used for displaying web pages. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For iOS versions prior to 17, update to iOS 17 or later. For iPadOS versions prior to 17, update to iPadOS 17 or later. For watchOS versions prior to 10, update to watchOS 10 or later. For macOS Sonoma versions prior to 14, update to macOS Sonoma 14 or later. As a temporary workaround, consider restricting web content processing until a patch is available. Avoid using vulnerable WebKitGTK and WPE WebKit modules in web page display until the issue is resolved.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2023:6535

ALSA-2023:7055

BDU:2023-06727

CVE-2023-39434

DSA-5468-1

MGASA-2024-0148

OPENSUSE-SU-2023_4294-1

RHSA-2023:6535

RHSA-2023:7055

SUSE-SU-2023:4209-1

SUSE-SU-2023:4211-1

SUSE-SU-2023:4294-1

SUSE-SU-2023:4339-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Apple Macos

Red Hat

Suse

Ios

Ipados

Macos Sonoma

Watchos

References · 125

• 🔥 https://github.com/po6ix/POC-for-CVE-2023-41993 · Exploit
• 🔥 https://github.com/hrtowii/cve-2023-41993-test · Exploit
• 🔥 https://github.com/0x06060606/CVE-2023-41993 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-39434 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-6535.html · Vendor Advisory
• https://support.apple.com/en-us/HT213937 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-7055.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4211-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:7055 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4209-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:6535 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-6535.html · Vendor Advisory
• https://support.apple.com/en-us/HT213940 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06727 · Security Note