CVE-2023-42917: Apple Multiple Products WebKit Memory Corruption Vulnerability
First published: Thu Nov 30 2023(Updated: )
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
Credit: product-security@apple.com an anonymous researcher Zhenjiang Zhao Pangu TeamQianxin Junsung Lee Meysam Firouzi @R00tkitSMM Eloi Benoist-Vanderbeken @elvanderb SynacktivCVE-2023-42893 Csaba Fitzl @theevilbit OffSecZhongquan Li @Guluisacat Dawn Security Lab of JingDongCsaba Fitzl @theevilbit Offensive SecurityJoshua Jewett @JoshJewett33 Pwn2car Zoom Offensive Security Team Clément Lecigne Google's Threat Analysis GroupNan Wang @eternalsakura13 360 Vulnerability Research Instituterushikesh nandedkar rushikesh nandedka Noah Roskin-Frazee Pr Kirin @Pwnrin Michael DePlante @izobashi Trend Micro Zero Day Initiative
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/webkit2gtk | <=2.36.4-1~deb10u1<=2.38.6-0+deb10u1<=2.42.2-1~deb11u1<=2.42.2-1~deb12u1 | 2.42.5-1~deb11u1 2.42.5-1~deb12u1 2.42.5-1 2.44.1-1 |
| debian/wpewebkit | <=2.38.6-1~deb11u1<=2.38.6-1 | 2.42.5-1 2.44.1-1 |
| ubuntu/webkit2gtk | <2.42.3-0ubuntu0.22.04.1 | 2.42.3-0ubuntu0.22.04.1 |
| ubuntu/webkit2gtk | <2.42.3-0ubuntu0.23.04.1 | 2.42.3-0ubuntu0.23.04.1 |
| ubuntu/webkit2gtk | <2.42.3-0ubuntu0.23.10.1 | 2.42.3-0ubuntu0.23.10.1 |
| ubuntu/webkit2gtk | <2.42.3-1 | 2.42.3-1 |
| ubuntu/webkit2gtk | <2.42.3 | 2.42.3 |
| Apple Multiple Products | ||
| Apple macOS | <14.1.2 | 14.1.2 |
| tvOS | <17.2 | 17.2 |
| Apple iPhone | ||
| Apple macOS | ||
| Apple TV | ||
| Apple Watch | ||
| Apple iOS, iPadOS, and watchOS | <10.2 | 10.2 |
| redhat/webkitgtk | <2.42.3 | 2.42.3 |
| Safari | <17.1.2 | 17.1.2 |
| Apple iOS and iPadOS | <15.8.1 | 15.8.1 |
| Apple iOS, iPadOS, and macOS | <15.8.1 | 15.8.1 |
| Apple iOS and iPadOS | <17.1.2 | 17.1.2 |
| Apple iOS, iPadOS, and macOS | <17.1.2 | 17.1.2 |
| Apple iOS and iPadOS | <16.7.3 | 16.7.3 |
| Apple iOS, iPadOS, and macOS | <16.7.3 | 16.7.3 |
| Safari | <17.1.2 | |
| Apple iOS, iPadOS, and macOS | <15.8.1 | |
| Apple iOS, iPadOS, and macOS | >=16.0<16.7.3 | |
| Apple iOS, iPadOS, and macOS | >=17.0<17.1.2 | |
| iPhone OS | <15.8.1 | |
| iPhone OS | >=16.0<16.7.3 | |
| iPhone OS | >=17.0<17.1.2 | |
| macOS | >=14.0<14.1.2 | |
| Debian Linux | =11.0 | |
| Debian Linux | =12.0 | |
| Red Hat Fedora | =38 | |
| Red Hat Fedora | =39 | |
| WebKitGTK+ | <2.42.3 |
Remedy
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-patched-iphone-kernel-bug-now-exploited-in-attacks/
- https://support.apple.com/en-us/HT214031 (Advisory)
- https://support.apple.com/en-us/HT214032 (Advisory)
- https://support.apple.com/en-us/HT214033 (Advisory)
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://www.debian.org/security/2023/dsa-5575
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/13
- https://security.gentoo.org/glsa/202401-04
- http://seclists.org/fulldisclosure/2024/Jan/35
- https://launchpad.net/bugs/cve/CVE-2023-42917
- https://webkitgtk.org/security/WSA-2023-0011.html
- https://security-tracker.debian.org/tracker/CVE-2023-42917
- https://ubuntu.com/security/notices/USN-6545-1
- https://www.cve.org/CVERecord?id=CVE-2023-42917
- https://nvd.nist.gov/vuln/detail/CVE-2023-42917
- https://ubuntu.com/security/CVE-2023-42917
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214062
- https://support.apple.com/en-us/HT214031,
- https://support.apple.com/en-us/HT214032,
- https://support.apple.com/kb/HT214032
- https://support.apple.com/en-us/HT214040 (Advisory)
- https://support.apple.com/kb/HT214031
- https://support.apple.com/en-us/HT214034 (Advisory)
- https://support.apple.com/en-us/HT214062 (Advisory)
- https://support.apple.com/en-us/HT214041 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2253059
- https://access.redhat.com/errata/RHSA-2023:7715
- https://access.redhat.com/errata/RHSA-2023:7716
- https://access.redhat.com/errata/RHSA-2024:8492
- https://access.redhat.com/errata/RHSA-2024:8496
- https://access.redhat.com/errata/RHSA-2024:9646
- https://access.redhat.com/errata/RHSA-2024:9653
- https://access.redhat.com/errata/RHSA-2024:9680
- https://access.redhat.com/errata/RHSA-2024:9679
- https://access.redhat.com/errata/RHSA-2024:2982
- https://access.redhat.com/errata/RHSA-2024:2126
- https://bugzilla.redhat.com/show_bug.cgi?id=2253058
- https://support.apple.com/en-us/120876 (Advisory)
- https://support.apple.com/en-us/120878 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2023-42916
- CVE-2023-42917
- CVE-2023-42884
- CVE-2023-42898
- CVE-2023-42899
- CVE-2023-42914
- CVE-2023-42893
- CVE-2023-42936
- CVE-2023-42947
- CVE-2023-40389
- CVE-2023-42890
- CVE-2023-42883
- CVE-2023-42950
- CVE-2022-48618
- CVE-2024-23222
- CVE-2023-42937
- CVE-2023-42919
- CVE-2023-42888
- CVE-2023-42896
- CVE-2023-42962
- CVE-2023-42922
- CVE-2023-42974
Frequently Asked Questions
What is CVE-2023-42917?
CVE-2023-42917 is a memory corruption vulnerability in WebKit that allows for arbitrary code execution.
Which Apple products are affected by CVE-2023-42917?
Apple Safari, macOS Sonoma, iOS, and iPadOS versions up to and including 17.1.2 are affected by CVE-2023-42917.
How was CVE-2023-42917 fixed?
CVE-2023-42917 was fixed with improved locking in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2.
Is there a remedy available for CVE-2023-42917?
Yes, the remedy for CVE-2023-42917 is to update to iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, or Safari 17.1.2.
Where can I find more information about CVE-2023-42917?
You can find more information about CVE-2023-42917 in the following references: - [Apple Support - HT214031](https://support.apple.com/en-us/HT214031) - [Apple Support - HT214033](https://support.apple.com/en-us/HT214033) - [Apple Support - HT214032](https://support.apple.com/en-us/HT214032)
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/title
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2022-48618
- alias/CVE-2024-23222
- alias/CVE-2023-42916
- alias/CVE-2023-42917
- agent/severity
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- collector/mitre-cve
- source/MITRE
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/trending
- agent/source
- collector/apple-support
- source/Apple
- agent/software-canonical-lookup-request
- agent/news-ai
- alias/CVE-2023-42950
- alias/CVE-2023-42893
- alias/CVE-2023-42936
- alias/CVE-2023-42947
- alias/CVE-2023-40389
- alias/CVE-2023-42890
- alias/CVE-2023-42883
- alias/CVE-2023-42919
- alias/CVE-2023-42898
- alias/CVE-2023-42899
- alias/CVE-2023-42888
- alias/CVE-2023-42914
- agent/references
- agent/weakness
- agent/author
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- package-manager/debian
- package-manager/ubuntu
- vendor/apple
- canonical/apple multiple products
- canonical/apple macos
- canonical/tvos
- canonical/apple iphone
- canonical/apple tv
- canonical/apple watch
- canonical/apple ios, ipados, and watchos
- package-manager/redhat
- canonical/safari
- canonical/apple ios and ipados
- canonical/apple ios, ipados, and macos
- version/apple ios, ipados, and macos/16.0
- version/apple ios, ipados, and macos/17.0
- canonical/iphone os
- version/iphone os/16.0
- version/iphone os/17.0
- canonical/macos
- version/macos/14.0
- vendor/debian
- canonical/debian linux
- version/debian linux/11.0
- version/debian linux/12.0
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/38
- version/red hat fedora/39
- vendor/webkitgtk
- canonical/webkitgtk+