CVE-2023-42852 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple IOS AND Ipados

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer13 documents8 sources

Severity

8.8HIGHNVD

EPSS

2.2%

top 15.66%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apple IOS AND Ipados Apple Macos Apple Safari +6 more

Timeline

PublishedOct 25

Latest updateNov 20

Description

A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1. Processing web content may lead to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages11 packages

▶NVDapple/ipados17.0 — 17.1+1

▶CVEListV5apple/ios_and_ipadosunspecified — 16.7+1

▶CVEListV5apple/tvosunspecified — 17.1

▶NVDapple/tvos< 17.1

▶CVEListV5apple/macosunspecified — 14.1

Also affects: Debian Linux 11.0, 12.0, Fedora 37

🔴Vulnerability Details

CVEList

CVE-2023-42852: A logic issue was addressed with improved checks↗2023-10-25

▶

GHSA

GHSA-jmh8-4h3g-x5g5: A logic issue was addressed with improved checks↗2023-10-25

▶

OSV

CVE-2023-42852: A logic issue was addressed with improved checks↗2023-10-25

▶

📋Vendor Advisories

Ubuntu

WebKitGTK vulnerabilities↗2023-11-20

▶

Red Hat

webkitgtk: Processing web content may lead to arbitrary code execution↗2023-11-15

▶

Apple

CVE-2023-42852: watchOS 10.1↗2023-10-25

▶

Apple

CVE-2023-42852: Safari 17.1↗2023-10-25

▶

Apple

CVE-2023-42852: iOS 17.1 and iPadOS 17.1↗2023-10-25

▶