⚠ Actively exploited
Added to CISA KEV on 2023-07-13. Federal agencies required to patch by 2023-08-03. Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable..

CVE-2023-37450 — Code Injection in Apple IOS AND Ipados

CWE-94 — Code Injection17 documents10 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 83.14%
CISA KEV
KEV
Added 2023-07-13
Due 2023-08-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
8
Apple IOS AND IpadosApple MacosApple Safari+5 more
Timeline
KEV addedJul 13
PublishedJul 27
Latest updateJul 31
KEV dueAug 3
CISA Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Description

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages12 packages

▶CVEListV5apple/tvosunspecified — 16.6
▶NVDapple/tvos< 16.6
▶CVEListV5apple/macosunspecified — 13.5
▶NVDapple/macos13.0 — 13.5
▶CVEListV5apple/safariunspecified — 16.5

🔴Vulnerability Details

4
OSV
CVE-2023-37450: The issue was addressed with improved checks↗2023-07-27
▶
GHSA
GHSA-v874-wp44-mhr4: The issue was addressed with improved checks↗2023-07-27
▶
CVEList
CVE-2023-37450: The issue was addressed with improved checks↗2023-07-26
▶
VulnCheck
Apple Multiple Products WebKit Code Execution Vulnerability↗2023
▶

📋Vendor Advisories

12
Ubuntu
WebKitGTK vulnerabilities↗2023-07-31
▶
Apple
CVE-2023-37450: watchOS 9.6↗2023-07-24
▶
Apple
CVE-2023-37450: iOS 16.6 and iPadOS 16.6↗2023-07-24
▶
Apple
CVE-2023-37450: macOS Ventura 13.5↗2023-07-24
▶
Apple
CVE-2023-37450: tvOS 16.6↗2023-07-24
▶
CVE-2023-37450 — Code Injection in Apple IOS AND Ipados | cvebase