PT-2023-7335 · Apple+7 · Safari+12

Clement Lecigne · Published 2023-07-18 · Updated 2024-11-29 · CVE-2023-42916

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions iOS versions prior to 17.1.2 iPadOS versions prior to 17.1.2 macOS Sonoma versions prior to 14.1.2 Safari versions prior to 17.1.2

Description The issue is related to an out-of-bounds read in the WebKit web browser engine, which may allow an attacker to disclose sensitive information when processing web content. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Recommendations For iOS versions prior to 17.1.2, update to iOS 17.1.2 or later. For iPadOS versions prior to 17.1.2, update to iPadOS 17.1.2 or later. For macOS Sonoma versions prior to 14.1.2, update to macOS Sonoma 14.1.2 or later. For Safari versions prior to 17.1.2, update to Safari 17.1.2 or later.

Exploit

Fix

Information Disclosure

Incorrect Privilege Assignment

Out of bounds Read

Improper Access Control

Weakness Enumeration

CWE-200

CWE-266

CWE-125

CWE-284

Related Identifiers

ALT-PU-2023-7817

ALT-PU-2023-7818

ALT-PU-2023-7819

BDU:2023-08366

CESA-2023_4202

CVE-2023-42916

DSA-5575-1

MGASA-2024-0148

RHSA-2023:4201

RHSA-2023:4202

RHSA-2023_4201

RHSA-2023_4202

RHSA-2025:10364

SUSE-SU-2023:4824-1

SUSE-SU-2023:4827-1

SUSE-SU-2023:4828-1

SUSE-SU-2023:4829-1

SUSE-SU-2023_4824-1

SUSE-SU-2023_4827-1

SUSE-SU-2023_4828-1

SUSE-SU-2023_4829-1

USN-6545-1

Affected Products

Alt Linux

Centos

Debian

Linuxmint

Apple Macos

Red Hat

Safari

Suse

Ubuntu

Webkit

Ios

Ipados

Macos Sonoma

References · 139

• 🔥 https://github.com/po6ix/POC-for-CVE-2023-41993 · Exploit
• 🔥 https://github.com/hrtowii/cve-2023-41993-test · Exploit
• 🔥 https://github.com/0x06060606/CVE-2023-41993 · Exploit
• https://support.apple.com/kb/HT214034 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-42916 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-42916 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-42916 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/702041 · Security Note
• https://bdu.fstec.ru/vul/2023-08366 · Security Note
• https://ubuntu.com/security/notices/USN-6545-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/702042 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:4824-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-42916 · Vendor Advisory
• https://support.apple.com/kb/HT214062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42916 · Security Note