CVE-2023-42916

moderate-risk

Published 2023-11-30

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (9)

Safari

Ipados

Iphone Os

Macos

Fedora

Debian Linux

Webkitgtk\+

Affected Vendors

Debian Apple Fedoraproject Webkitgtk

References (37)

Mailing List http://seclists.org/fulldisclosure/2023/Dec/12

Mailing List http://seclists.org/fulldisclosure/2023/Dec/13

Mailing List http://seclists.org/fulldisclosure/2023/Dec/3

Mailing List http://seclists.org/fulldisclosure/2023/Dec/4

Mailing List http://seclists.org/fulldisclosure/2023/Dec/5

Mailing List http://seclists.org/fulldisclosure/2023/Dec/8

Mailing List http://seclists.org/fulldisclosure/2024/Jan/35

Mailing List http://www.openwall.com/lists/oss-security/2023/12/05/1

Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...

Third Party Advisory https://security.gentoo.org/glsa/202401-04

Vendor Advisory https://support.apple.com/en-us/HT214031

Vendor Advisory https://support.apple.com/en-us/HT214032

Vendor Advisory https://support.apple.com/en-us/HT214033

Vendor Advisory https://support.apple.com/kb/HT214033

Vendor Advisory https://support.apple.com/kb/HT214034

Vendor Advisory https://support.apple.com/kb/HT214062

Mailing List https://www.debian.org/security/2023/dsa-5575

Mailing List http://seclists.org/fulldisclosure/2023/Dec/12

Mailing List http://seclists.org/fulldisclosure/2023/Dec/13

and 17 more references

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 7/34 · Low

Exposure 15/34 · Moderate