CVE-2023-42843
First published: Wed Oct 25 2023(Updated: )
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing.
Credit: product-security@apple.com product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ubuntu/webkit2gtk | <2.44.0-0ubuntu0.22.04.1 | 2.44.0-0ubuntu0.22.04.1 |
| ubuntu/webkit2gtk | <2.44.0-0ubuntu0.23.10.1 | 2.44.0-0ubuntu0.23.10.1 |
| ubuntu/webkit2gtk | <2.44.0 | 2.44.0 |
| debian/webkit2gtk | <=2.36.4-1~deb10u1<=2.38.6-0+deb10u1<=2.42.2-1~deb11u1<=2.42.2-1~deb12u1 | 2.44.1-1~deb11u1 2.44.1-1~deb12u1 2.44.1-1 |
| debian/wpewebkit | <=2.38.6-1~deb11u1<=2.38.6-1 | 2.44.1-1 |
| redhat/WebKitGTK | <2.44.0 | 2.44.0 |
| Apple macOS | <14.1 | 14.1 |
| Apple Mobile Safari | <17.1 | 17.1 |
| Apple iOS, iPadOS, and watchOS | <16.7.2 | 16.7.2 |
| Apple iOS, iPadOS, and watchOS | <16.7.2 | 16.7.2 |
| Apple iOS, iPadOS, and watchOS | <17.1 | 17.1 |
| Apple iOS, iPadOS, and watchOS | <17.1 | 17.1 |
| Apple Mobile Safari | <17.1 | |
| iPadOS | <16.7.2 | |
| iPadOS | >=17.0<17.1 | |
| iOS | <16.7.2 | |
| iOS | >=17.0<17.1 | |
| Apple iOS and macOS | =14.0 | |
| Fedora | =40 | |
| WebKitGTK+ | <2.44.0 | |
| wpewebkit WPE WebKit | <2.44.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://webkitgtk.org/security/WSA-2024-0002.html
- https://www.cve.org/CVERecord?id=CVE-2023-42843
- https://ubuntu.com/security/notices/USN-6732-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-42843
- https://launchpad.net/bugs/cve/CVE-2023-42843
- https://security-tracker.debian.org/tracker/CVE-2023-42843
- https://ubuntu.com/security/CVE-2023-42843
- https://support.apple.com/en-us/HT213981 (Advisory)
- https://support.apple.com/en-us/HT213982 (Advisory)
- https://support.apple.com/en-us/HT213984 (Advisory)
- https://support.apple.com/en-us/HT213986 (Advisory)
- http://www.openwall.com/lists/oss-security/2024/03/26/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXLXIOAH5S7J22LJTCIAVFVVJ4TESAX4/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2271721
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2274441
- https://access.redhat.com/errata/RHSA-2024:9144
- https://bugzilla.redhat.com/show_bug.cgi?id=2271717
- https://support.apple.com/kb/HT213986
- https://support.apple.com/kb/HT213981
- https://support.apple.com/kb/HT213982
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2023-30774
- CVE-2023-40444
- CVE-2023-42952
- CVE-2023-42945
- CVE-2023-41072
- CVE-2023-42857
- CVE-2023-40449
- CVE-2023-42823
- CVE-2023-41989
- CVE-2023-42854
- CVE-2023-40413
- CVE-2023-42834
- CVE-2023-42844
- CVE-2023-42953
- CVE-2023-40416
- CVE-2023-42848
- CVE-2023-40423
- CVE-2023-38403
- CVE-2023-42849
- CVE-2023-42850
- CVE-2023-40446
- CVE-2023-42942
- CVE-2023-42861
- CVE-2023-42935
- CVE-2023-40408
- CVE-2023-40405
- CVE-2023-28826
- CVE-2023-42856
- CVE-2023-40404
- CVE-2023-42859
- CVE-2023-42877
- CVE-2023-42840
- CVE-2023-42853
- CVE-2023-42860
- CVE-2023-42889
- CVE-2023-42847
- CVE-2023-42845
- CVE-2023-42841
- CVE-2023-42873
- CVE-2023-42838
- CVE-2023-42835
- CVE-2023-41977
- CVE-2023-42438
- CVE-2023-42836
- CVE-2023-42839
- CVE-2023-42878
- CVE-2023-41982
- CVE-2023-41997
- CVE-2023-41988
- CVE-2023-42946
- CVE-2023-36191
- CVE-2023-40421
- CVE-2023-42842
- CVE-2023-4733
- CVE-2023-4734
- CVE-2023-4735
- CVE-2023-4736
- CVE-2023-4738
- CVE-2023-4750
- CVE-2023-4751
- CVE-2023-4752
- CVE-2023-4781
- CVE-2023-41254
- CVE-2023-40447
- CVE-2023-41976
- CVE-2023-42852
- CVE-2023-42843
- CVE-2023-41983
- CVE-2023-41975
- CVE-2023-42858
- CVE-2023-42846
- CVE-2023-32359
- CVE-2023-42928
- CVE-2023-42951
- CVE-2023-42855
- CVE-2023-40445
- CVE-2023-42939
Frequently Asked Questions
What is the severity of CVE-2023-42843?
CVE-2023-42843 has been categorized as a medium severity vulnerability.
How do I fix CVE-2023-42843?
To fix CVE-2023-42843, update your device to iOS 16.7.2, iPadOS 16.7.2, iOS 17.1, iPadOS 17.1, Safari 17.1, or macOS Sonoma 14.1.
What systems are affected by CVE-2023-42843?
CVE-2023-42843 affects Apple Safari, iOS, iPadOS, and macOS versions prior to the specified updates.
What type of vulnerability is CVE-2023-42843?
CVE-2023-42843 is an inconsistent user interface issue that may lead to address bar spoofing.
Is there a known exploit for CVE-2023-42843?
There are no known public exploits specifically for CVE-2023-42843, but users are advised to apply the updates to mitigate risks.
- agent/first-publish-date
- agent/type
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- collector/security-tracker-debian
- source/Debian
- collector/mitre-cve
- source/MITRE
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-42843
- agent/description
- agent/last-modified-date
- agent/severity
- agent/event
- agent/trending
- collector/apple-support
- source/Apple
- agent/software-canonical-lookup-request
- agent/source
- agent/references
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- package-manager/ubuntu
- package-manager/debian
- package-manager/redhat
- vendor/apple
- canonical/apple macos
- canonical/apple mobile safari
- canonical/apple ios, ipados, and watchos
- canonical/ipados
- version/ipados/17.0
- canonical/ios
- version/ios/17.0
- canonical/apple ios and macos
- version/apple ios and macos/14.0
- vendor/fedoraproject
- canonical/fedora
- version/fedora/40
- vendor/webkitgtk
- canonical/webkitgtk+
- vendor/wpewebkit
- canonical/wpewebkit wpe webkit