⚠ Actively exploited
Added to CISA KEV on 2022-12-14. Federal agencies required to patch by 2023-01-04. Required action: Apply updates per vendor instructions..
CVE-2022-42856 — Type Confusion in Apple Tvos
Severity
8.8HIGHNVD
EPSS
0.3%
top 50.72%
CISA KEV
KEV
Added 2022-12-14
Due 2023-01-04
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
KEV addedDec 14
PublishedDec 15
KEV dueJan 4
Latest updateDec 3
CISA Required Action: Apply updates per vendor instructions.
Description
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages6 packages
🔴Vulnerability Details
4GHSA
▶
CVEList
▶
📋Vendor Advisories
11Red Hat▶
webkitgtk: processing maliciously crafted web content may lead to an arbitrary code execution↗2022-12-14