First published: Mon Dec 11 2023(Updated: )
Accessibility. A privacy issue was addressed with improved private data redaction for log entries.
Credit: product-security@apple.com Noah Roskin-Frazee Pr Kirin @Pwnrin Mickey Jin @patch1t an anonymous researcher Marc Newlin SkySafeChristopher Reynolds Aymane Chabat Wojciech Regula SecuRingZhenjiang Zhao Pangu TeamQianxin Junsung Lee Meysam Firouzi @R00tkitSMM Michael DePlante @izobashi Trend Micro Zero Day InitiativePan ZhenPeng @Peterpan0927 STAR Labs SG PteEloi Benoist-Vanderbeken @elvanderb SynacktivCVE-2023-42893 ARJUN S D Csaba Fitzl @theevilbit OffSecAndrew Goldberg The McCombs School of BusinessThe University Texas at AustinZhongquan Li @Guluisacat Dawn Security Lab of JingDongCsaba Fitzl @theevilbit Offensive SecurityJoshua Jewett @JoshJewett33 Pwn2car Zoom Offensive Security Team Nan Wang @eternalsakura13 360 Vulnerability Research Instituterushikesh nandedkar SungKwon Lee (Demon.Team) Ivan Fratric Google Project Zero Trend Micro Zero Day InitiativeKoh M. Nakagawa @tsunek0h CVE-2023-38545 CVE-2023-38039 CVE-2023-38546 Yann GASCUEL Alter SolutionsAnthony Cruz Tyrant Corp @App CVE-2023-3618 CVE-2020-19185 CVE-2020-19186 CVE-2020-19187 CVE-2020-19188 CVE-2020-19189 CVE-2020-19190 Ron Masas BreakPointArsenii Kostromin (0x3c3e) Mattie Behrens Zhongquan Li @Guluisacat CVE-2023-5344 Don Clarke Clément Lecigne Google's Threat Analysis Grouprushikesh nandedka
Affected Software | Affected Version | How to fix |
---|---|---|
ubuntu/webkit2gtk | <2.42.4-0ubuntu0.22.04.1 | 2.42.4-0ubuntu0.22.04.1 |
ubuntu/webkit2gtk | <2.42.4-0ubuntu0.23.04.1 | 2.42.4-0ubuntu0.23.04.1 |
ubuntu/webkit2gtk | <2.42.4-0ubuntu0.23.10.1 | 2.42.4-0ubuntu0.23.10.1 |
ubuntu/wpewebkit | <2.42.4-1 | 2.42.4-1 |
debian/webkit2gtk | <=2.36.4-1~deb10u1<=2.38.6-0+deb10u1<=2.42.2-1~deb11u1<=2.42.2-1~deb12u1 | 2.42.5-1~deb11u1 2.42.5-1~deb12u1 2.42.5-1 |
debian/wpewebkit | <=2.38.6-1~deb11u1<=2.38.6-1 | 2.42.5-1 |
Apple macOS | <14.2 | 14.2 |
tvOS | <17.2 | 17.2 |
Apple iOS, iPadOS, and watchOS | <10.2 | 10.2 |
Safari | <17.2 | 17.2 |
Apple iOS and iPadOS | <17.2 | 17.2 |
Apple iOS, iPadOS, and macOS | <17.2 | 17.2 |
Apple iOS and iPadOS | <16.7.3 | 16.7.3 |
Apple iOS, iPadOS, and macOS | <16.7.3 | 16.7.3 |
Safari | <17.2 | |
Apple iOS, iPadOS, and macOS | <16.7.3 | |
Apple iOS, iPadOS, and macOS | >=17.0<17.2 | |
iPhone OS | <16.7.3 | |
iPhone OS | >=17.0<17.2 | |
macOS | >=14.0<14.2 | |
tvOS | <17.2 | |
Apple iOS, iPadOS, and watchOS | <10.2 | |
Debian Linux | =11.0 | |
Debian Linux | =12.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
CVE-2023-42883 has been classified as a denial-of-service vulnerability due to inadequate memory handling.
To mitigate CVE-2023-42883, update to the latest versions of WebKit2GTK or the relevant Apple software as specified in the security advisories.
CVE-2023-42883 affects various versions of WebKit2GTK and Apple's Safari and associated operating systems.
CVE-2023-42883 was disclosed in December 2023 as a critical vulnerability impacting certain browsers and systems.
Currently, no specific workaround is available for CVE-2023-42883 aside from applying the recommended updates.