First published: Wed Oct 25 2023(Updated: )
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1. Processing web content may lead to arbitrary code execution.
Credit: product-security@apple.com Bistrit Dahal CVE-2023-42946 Cristian Dinca Computer ScienceRomania 이준성(Junsung Lee) Cross Republic이준성(Junsung Lee) Pedro Ribeiro @pedrib1337 Agile Information SecurityVitor Pedreira @0xvhp_ Agile Information SecurityTalal Haj Bakry Mysk IncTommy Mysk @mysk_co Mysk IncMingxuan Yang @PPPF00L 360 Vulnerability Research Institute 360 Vulnerability Research Institutehappybabywu 360 Vulnerability Research InstituteGuang Gong 360 Vulnerability Research InstituteYiğit Can YILMAZ @yilmazcanyigit Kirin @Pwnrin SecuRingWojciech Regula SecuRing Computer ScienceJZ Linus Henze Pinauten GmbHMickey Jin @patch1t Grzegorz Riegel Adam M. Csaba Fitzl @theevilbit Offensive SecurityMichael (Biscuit) Thomas - @social.lol @biscuit CVE-2023-42823 an anonymous researcher inooo Alex Renda Claire Houston Kacper Kwapisz @KKKas_ Adis Alic Sam Lakmaker Ting Ding James Mancz Omar Shibli Lorenzo Cavallaro Harry Lewandowski Abhay Kailasia @abhay_kailasia Lakshmi Narain College Of Technology Bhopal IndiaPeter Nguyễn Vũ Hoàng @peternguyen14 STAR Labs SG PteTomi Tokics @tomitokics iTomsn0wZhipeng Huo @R3dF09 Tencent Security Xuanwu LabNoah Roskin-Frazee Pr
Affected Software | Affected Version | How to fix |
---|---|---|
debian/webkit2gtk | <=2.36.4-1~deb10u1<=2.38.6-0+deb10u1<=2.40.5-1~deb11u1 | 2.42.4-1~deb11u1 2.42.2-1~deb12u1 2.42.4-1~deb12u1 2.42.4-1 |
debian/wpewebkit | <=2.38.6-1~deb11u1<=2.38.6-1 | 2.42.4-1 |
Apple macOS | <14.1 | 14.1 |
tvOS | <17.1 | 17.1 |
Apple iOS, iPadOS, and watchOS | <10.1 | 10.1 |
Safari | <17.1 | 17.1 |
Apple iOS and iPadOS | <17.1 | 17.1 |
Apple iOS, iPadOS, and macOS | <17.1 | 17.1 |
Apple iOS and iPadOS | <16.7.2 | 16.7.2 |
Apple iOS, iPadOS, and macOS | <16.7.2 | 16.7.2 |
Safari | <17.1 | |
Apple iOS, iPadOS, and macOS | <16.7.2 | |
Apple iOS, iPadOS, and macOS | >=17.0<17.1 | |
iPhone OS | <16.7.2 | |
iPhone OS | >=17.0<17.1 | |
macOS | >=14.0<14.1 | |
tvOS | <17.1 | |
Apple iOS, iPadOS, and watchOS | <10.1 | |
Red Hat Fedora | =37 | |
Debian Linux | =11.0 | |
Debian Linux | =12.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
The vulnerability ID for this issue is CVE-2023-42852.
A logic issue was addressed with improved checks. Processing web content may lead to arbitrary code execution.
The affected products include macOS Sonoma, Safari, iOS, iPadOS, watchOS, and tvOS.
Versions up to and excluding macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2 and iPadOS 16.7.2, watchOS 10.1, iOS 17.1 and iPadOS 17.1, tvOS 17.1 are affected by this vulnerability.
To fix this vulnerability, update to iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1.