CVE-2023-42843: Use After Free
First published: Wed Oct 25 2023(Updated: )
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing.
Credit: product-security@apple.com Adam M. JZ an anonymous researcher Linus Henze Pinauten GmbHinooo Mickey Jin @patch1t Grzegorz Riegel Talal Haj Bakry Mysk IncTommy Mysk @mysk_co Mysk IncMingxuan Yang @PPPF00L 360 Vulnerability Research Institutehappybabywu 360 Vulnerability Research InstituteGuang Gong 360 Vulnerability Research Institute 360 Vulnerability Research InstituteAlex Renda Bistrit Dahal Cristian Dinca Computer ScienceRomania Claire Houston 이준성(Junsung Lee) Cross RepublicPedro Ribeiro @pedrib1337 Agile Information SecurityVitor Pedreira @0xvhp_ Agile Information Security이준성(Junsung Lee) Kacper Kwapisz @KKKas_ Adis Alic Yiğit Can YILMAZ @yilmazcanyigit Sam Lakmaker Kirin @Pwnrin SecuRingWojciech Regula SecuRing Computer ScienceCVE-2023-42946 Ting Ding James Mancz Omar Shibli Lorenzo Cavallaro Harry Lewandowski Abhay Kailasia @abhay_kailasia Lakshmi Narain College Of Technology Bhopal IndiaCsaba Fitzl @theevilbit Offensive SecurityMichael (Biscuit) Thomas - @social.lol @biscuit Peter Nguyễn Vũ Hoàng @peternguyen14 STAR Labs SG PteTomi Tokics @tomitokics iTomsn0wCVE-2023-42823 Zhipeng Huo @R3dF09 Tencent Security Xuanwu LabNoah Roskin-Frazee Pr
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ubuntu/webkit2gtk | <2.44.0-0ubuntu0.22.04.1 | 2.44.0-0ubuntu0.22.04.1 |
| ubuntu/webkit2gtk | <2.44.0-0ubuntu0.23.10.1 | 2.44.0-0ubuntu0.23.10.1 |
| ubuntu/webkit2gtk | <2.44.0 | 2.44.0 |
| debian/webkit2gtk | <=2.36.4-1~deb10u1<=2.38.6-0+deb10u1<=2.42.2-1~deb11u1<=2.42.2-1~deb12u1 | 2.44.1-1~deb11u1 2.44.1-1~deb12u1 2.44.1-1 |
| debian/wpewebkit | <=2.38.6-1~deb11u1<=2.38.6-1 | 2.44.1-1 |
| redhat/WebKitGTK | <2.44.0 | 2.44.0 |
| Apple macOS | <14.1 | 14.1 |
| Safari | <17.1 | 17.1 |
| Safari | <17.1 | |
| iPadOS | <16.7.2 | |
| iPadOS | >=17.0<17.1 | |
| iPhone OS | <16.7.2 | |
| iPhone OS | >=17.0<17.1 | |
| macOS | =14.0 | |
| Red Hat Fedora | =40 | |
| Oracle Webkitgtk4-jsc | <2.44.0 | |
| WPE WebKit | <2.44.0 | |
| Apple iOS and iPadOS | <17.1 | 17.1 |
| Apple iOS, iPadOS, and macOS | <17.1 | 17.1 |
| Apple iOS and iPadOS | <16.7.2 | 16.7.2 |
| Apple iOS, iPadOS, and macOS | <16.7.2 | 16.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://webkitgtk.org/security/WSA-2024-0002.html
- https://www.cve.org/CVERecord?id=CVE-2023-42843
- https://ubuntu.com/security/notices/USN-6732-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-42843
- https://launchpad.net/bugs/cve/CVE-2023-42843
- https://security-tracker.debian.org/tracker/CVE-2023-42843
- https://ubuntu.com/security/CVE-2023-42843
- https://support.apple.com/en-us/HT213981 (Advisory)
- https://support.apple.com/en-us/HT213982 (Advisory)
- https://support.apple.com/en-us/HT213984 (Advisory)
- https://support.apple.com/en-us/HT213986 (Advisory)
- http://www.openwall.com/lists/oss-security/2024/03/26/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXLXIOAH5S7J22LJTCIAVFVVJ4TESAX4/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2271721
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2274441
- https://access.redhat.com/errata/RHSA-2024:9144
- https://bugzilla.redhat.com/show_bug.cgi?id=2271717
- https://support.apple.com/kb/HT213986
- https://support.apple.com/kb/HT213981
- https://support.apple.com/kb/HT213982
- https://support.apple.com/en-us/109053 (Advisory)
- https://support.apple.com/en-us/109052 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2023-30774
- CVE-2023-40444
- CVE-2023-42952
- CVE-2023-42945
- CVE-2023-41072
- CVE-2023-42857
- CVE-2023-40449
- CVE-2023-42823
- CVE-2023-41989
- CVE-2023-42854
- CVE-2023-40413
- CVE-2023-42834
- CVE-2023-42844
- CVE-2023-42953
- CVE-2023-40416
- CVE-2023-42848
- CVE-2023-40423
- CVE-2023-38403
- CVE-2023-42849
- CVE-2023-42850
- CVE-2023-40446
- CVE-2023-42942
- CVE-2023-42861
- CVE-2023-42935
- CVE-2023-40408
- CVE-2023-40405
- CVE-2023-28826
- CVE-2023-42856
- CVE-2023-40404
- CVE-2023-42859
- CVE-2023-42877
- CVE-2023-42840
- CVE-2023-42853
- CVE-2023-42860
- CVE-2023-42889
- CVE-2023-42847
- CVE-2023-42845
- CVE-2023-42841
- CVE-2023-42873
- CVE-2023-42838
- CVE-2023-42835
- CVE-2023-41977
- CVE-2023-42438
- CVE-2023-42836
- CVE-2023-42839
- CVE-2023-42878
- CVE-2023-41982
- CVE-2023-41997
- CVE-2023-41988
- CVE-2023-42946
- CVE-2023-36191
- CVE-2023-40421
- CVE-2023-42842
- CVE-2023-4733
- CVE-2023-4734
- CVE-2023-4735
- CVE-2023-4736
- CVE-2023-4738
- CVE-2023-4750
- CVE-2023-4751
- CVE-2023-4752
- CVE-2023-4781
- CVE-2023-41254
- CVE-2023-40447
- CVE-2023-41976
- CVE-2023-42852
- CVE-2023-42843
- CVE-2023-41983
- CVE-2023-41975
- CVE-2023-42858
- CVE-2023-42928
- CVE-2023-42846
- CVE-2023-42951
- CVE-2023-42855
- CVE-2023-40445
- CVE-2023-42939
- CVE-2023-32359
Frequently Asked Questions
What is the severity of CVE-2023-42843?
CVE-2023-42843 has been categorized as a medium severity vulnerability.
How do I fix CVE-2023-42843?
To fix CVE-2023-42843, update your device to iOS 16.7.2, iPadOS 16.7.2, iOS 17.1, iPadOS 17.1, Safari 17.1, or macOS Sonoma 14.1.
What systems are affected by CVE-2023-42843?
CVE-2023-42843 affects Apple Safari, iOS, iPadOS, and macOS versions prior to the specified updates.
What type of vulnerability is CVE-2023-42843?
CVE-2023-42843 is an inconsistent user interface issue that may lead to address bar spoofing.
Is there a known exploit for CVE-2023-42843?
There are no known public exploits specifically for CVE-2023-42843, but users are advised to apply the updates to mitigate risks.
- agent/first-publish-date
- agent/type
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-cve
- source/NVD
- collector/security-tracker-debian
- source/Debian
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-42843
- agent/last-modified-date
- agent/severity
- agent/event
- agent/trending
- collector/apple-support
- source/Apple
- agent/software-canonical-lookup-request
- agent/source
- agent/references
- agent/weakness
- agent/author
- agent/description
- collector/nvd-api
- agent/softwarecombine
- agent/tags
- alias/CVE-2023-40447
- alias/CVE-2023-41976
- alias/CVE-2023-42852
- alias/CVE-2023-42939
- alias/CVE-2023-41983
- alias/CVE-2023-42878
- alias/CVE-2023-41982
- alias/CVE-2023-41997
- alias/CVE-2023-41988
- alias/CVE-2023-42946
- alias/CVE-2023-40445
- alias/CVE-2023-41254
- alias/CVE-2023-42845
- alias/CVE-2023-42841
- alias/CVE-2023-42873
- alias/CVE-2023-42951
- alias/CVE-2023-42836
- alias/CVE-2023-42839
- alias/CVE-2023-42855
- alias/CVE-2023-41072
- alias/CVE-2023-42857
- alias/CVE-2023-40449
- alias/CVE-2023-42823
- alias/CVE-2023-42928
- alias/CVE-2023-40413
- alias/CVE-2023-42834
- alias/CVE-2023-42953
- alias/CVE-2023-40416
- alias/CVE-2023-42848
- alias/CVE-2023-40423
- alias/CVE-2023-42849
- alias/CVE-2023-40446
- alias/CVE-2023-42942
- alias/CVE-2023-40408
- alias/CVE-2023-42846
- alias/CVE-2023-42847
- alias/CVE-2023-41977
- alias/CVE-2023-32359
- package-manager/ubuntu
- package-manager/debian
- package-manager/redhat
- vendor/apple
- canonical/apple macos
- canonical/safari
- canonical/ipados
- version/ipados/17.0
- canonical/iphone os
- version/iphone os/17.0
- canonical/macos
- version/macos/14.0
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/40
- vendor/webkitgtk
- canonical/oracle webkitgtk4-jsc
- vendor/wpewebkit
- canonical/wpe webkit
- canonical/apple ios and ipados
- canonical/apple ios, ipados, and macos