CVE-2023-42917

high-risk

Published 2023-11-30

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (9)

Safari

Ipados

Iphone Os

Macos

Debian Linux

Fedora

Webkitgtk\+

Affected Vendors

Debian Apple Fedoraproject Webkitgtk

References (37)

Mailing List http://seclists.org/fulldisclosure/2023/Dec/12

Mailing List http://seclists.org/fulldisclosure/2023/Dec/13

Mailing List http://seclists.org/fulldisclosure/2023/Dec/3

Mailing List http://seclists.org/fulldisclosure/2023/Dec/4

Mailing List http://seclists.org/fulldisclosure/2023/Dec/5

Mailing List http://seclists.org/fulldisclosure/2023/Dec/8

Mailing List http://seclists.org/fulldisclosure/2024/Jan/35

Mailing List http://www.openwall.com/lists/oss-security/2023/12/05/1

Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...

Third Party Advisory https://security.gentoo.org/glsa/202401-04

Vendor Advisory https://support.apple.com/en-us/HT214031

Vendor Advisory https://support.apple.com/en-us/HT214032

Vendor Advisory https://support.apple.com/en-us/HT214033

Vendor Advisory https://support.apple.com/kb/HT214033

Vendor Advisory https://support.apple.com/kb/HT214034

Vendor Advisory https://support.apple.com/kb/HT214062

Mailing List https://www.debian.org/security/2023/dsa-5575

Mailing List http://seclists.org/fulldisclosure/2023/Dec/12

Mailing List http://seclists.org/fulldisclosure/2023/Dec/13

and 17 more references

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 7/34 · Low

Exposure 15/34 · Moderate