CVE-2023-42916: Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
First published: Thu Nov 30 2023(Updated: )
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
Credit: product-security@apple.com product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Multiple Products | ||
| Apple macOS Sonoma | <14.1.2 | 14.1.2 |
| Apple Safari | <17.1.2 | 17.1.2 |
| Apple iOS | <17.1.2 | 17.1.2 |
| Apple iPadOS | <17.1.2 | 17.1.2 |
| Apple iOS | <15.8.1 | 15.8.1 |
| Apple iPadOS | <15.8.1 | 15.8.1 |
| Apple Safari | <17.1.2 | |
| Apple iPadOS | <17.1.2 | |
| Apple iPhone OS | <17.1.2 | |
| Apple macOS | >=14.0<14.1.2 | |
| Apple iPhone | ||
| Apple Mac | ||
| Apple TV | ||
| Apple watch | ||
| Apple watchOS | <10.2 | 10.2 |
| Apple tvOS | <17.2 | 17.2 |
| Apple iOS | <16.7.3 | 16.7.3 |
| Apple iPadOS | <16.7.3 | 16.7.3 |
| ubuntu/webkit2gtk | <2.42.3-0ubuntu0.22.04.1 | 2.42.3-0ubuntu0.22.04.1 |
| ubuntu/webkit2gtk | <2.42.3-0ubuntu0.23.04.1 | 2.42.3-0ubuntu0.23.04.1 |
| ubuntu/webkit2gtk | <2.42.3-0ubuntu0.23.10.1 | 2.42.3-0ubuntu0.23.10.1 |
| ubuntu/webkit2gtk | <2.42.3 | 2.42.3 |
| debian/webkit2gtk | <=2.36.4-1~deb10u1<=2.38.6-0+deb10u1<=2.42.2-1~deb11u1<=2.42.2-1~deb12u1 | 2.42.5-1~deb11u1 2.42.5-1~deb12u1 2.42.5-1 2.44.1-1 |
| debian/wpewebkit | <=2.38.6-1~deb11u1<=2.38.6-1 | 2.42.5-1 2.44.1-1 |
Remedy
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT214031,
- https://support.apple.com/en-us/HT214032,
- https://support.apple.com/en-us/HT214033 (Advisory)
- https://support.apple.com/en-us/HT214032 (Advisory)
- https://support.apple.com/kb/HT214033
- https://support.apple.com/en-us/HT214031 (Advisory)
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://www.debian.org/security/2023/dsa-5575
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/12
- https://security.gentoo.org/glsa/202401-04
- http://seclists.org/fulldisclosure/2024/Jan/35
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-patched-iphone-kernel-bug-now-exploited-in-attacks/
- https://launchpad.net/bugs/cve/CVE-2023-42916
- https://support.apple.com/en-us/HT214062 (Advisory)
- https://support.apple.com/en-us/HT214041 (Advisory)
- https://support.apple.com/en-us/HT214040 (Advisory)
- https://support.apple.com/en-us/HT214034 (Advisory)
- https://webkitgtk.org/security/WSA-2023-0011.html
- https://security-tracker.debian.org/tracker/CVE-2023-42916
- https://ubuntu.com/security/notices/USN-6545-1
- https://www.cve.org/CVERecord?id=CVE-2023-42916
- https://nvd.nist.gov/vuln/detail/CVE-2023-42916
- https://ubuntu.com/security/CVE-2023-42916
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-42916.
What is the title of this vulnerability?
The title of this vulnerability is 'WebKit. An out-of-bounds read was addressed with improved input validation.'
What is the severity of CVE-2023-42916?
The severity of CVE-2023-42916 is not mentioned in the description.
How can this vulnerability be exploited?
This vulnerability can be exploited by processing web content, which may disclose sensitive information.
How can I fix this vulnerability?
To fix this vulnerability, update to the latest versions of affected software: iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2.
- agent/type
- agent/first-publish-date
- agent/author
- agent/remedy
- agent/title
- agent/weakness
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/description
- collector/apple-support
- source/Apple
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2022-48618
- alias/CVE-2024-23222
- alias/CVE-2023-42916
- alias/CVE-2023-42917
- agent/severity
- agent/references
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- agent/news-ai
- agent/last-modified-date
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/apple
- canonical/apple multiple products
- canonical/apple macos sonoma
- canonical/apple safari
- canonical/apple ios
- canonical/apple ipados
- canonical/apple iphone os
- canonical/apple macos
- version/apple macos/14.0
- canonical/apple iphone
- canonical/apple mac
- canonical/apple tv
- canonical/apple watch
- canonical/apple watchos
- canonical/apple tvos
- package-manager/debian
- package-manager/ubuntu