PT-2023-6795 · Apple+6 · Safari+7

Published 2023-08-05 · Updated 2024-04-26 · CVE-2023-40451

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Safari versions prior to 17

Description This issue is related to improved iframe sandbox enforcement. An attacker with JavaScript execution may be able to execute arbitrary code. The vulnerability is also associated with the WPE WebKit and WebKitGTK modules, which may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 17, update to Safari 17 to resolve the issue. As a temporary workaround, consider restricting JavaScript execution until a patch is available. Restrict access to sensitive data and implement additional security measures to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALSA-2023:6535

ALSA-2023:7055

BDU:2023-07660

CESA-2023_7055

CVE-2023-40451

DSA-5468-1

MGASA-2024-0148

OPENSUSE-SU-2023_4294-1

OPENSUSE-SU-2024_0004-1

RHSA-2023:6535

RHSA-2023:7055

RHSA-2023_6535

RHSA-2023_7055

RHSA-2025:10364

SUSE-SU-2023:4209-1

SUSE-SU-2023:4211-1

SUSE-SU-2023:4294-1

SUSE-SU-2023:4339-1

SUSE-SU-2023:4978-1

SUSE-SU-2024:0002-1

SUSE-SU-2024:0004-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Apple Macos

Red Hat

Safari

Suse

References · 124

• 🔥 https://github.com/po6ix/POC-for-CVE-2023-41993 · Exploit
• 🔥 https://github.com/hrtowii/cve-2023-41993-test · Exploit
• 🔥 https://github.com/0x06060606/CVE-2023-41993 · Exploit
• https://ubuntu.com/security/CVE-2023-40451 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4211-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0004-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4978-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-40451 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:4339-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40451 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:6535 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-40451 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-40451 · Vendor Advisory