CVE-2022-32893

high-risk

Published 2022-08-24

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Do I need to act?

0.16% chance of exploitation

EPSS score — low exploit probability

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (10)

Safari

Ipados

Iphone Os

Macos

Fedora

Debian Linux

Webkitgtk

Wpe Webkit

Affected Vendors

Debian Apple Fedoraproject Webkitgtk Wpewebkit

References (35)

Mailing List http://seclists.org/fulldisclosure/2022/Aug/16

Mailing List http://seclists.org/fulldisclosure/2022/Oct/49

Mailing List http://www.openwall.com/lists/oss-security/2022/08/25/5

Mailing List http://www.openwall.com/lists/oss-security/2022/08/26/2

Mailing List http://www.openwall.com/lists/oss-security/2022/08/29/1

Mailing List http://www.openwall.com/lists/oss-security/2022/08/29/2

Mailing List http://www.openwall.com/lists/oss-security/2022/09/02/10

Mailing List http://www.openwall.com/lists/oss-security/2022/09/13/1

Mailing List https://lists.debian.org/debian-lts-announce/2022/08/msg00019.html

Broken Link https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202208-39

Vendor Advisory https://support.apple.com/en-us/HT213412

Vendor Advisory https://support.apple.com/en-us/HT213413

Vendor Advisory https://support.apple.com/en-us/HT213414

Mailing List https://www.debian.org/security/2022/dsa-5219

Mailing List https://www.debian.org/security/2022/dsa-5220

Mailing List http://seclists.org/fulldisclosure/2022/Aug/16

Mailing List http://seclists.org/fulldisclosure/2022/Oct/49

Mailing List http://www.openwall.com/lists/oss-security/2022/08/25/5

and 15 more references

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 8/34 · Low

Exposure 16/34 · Moderate