CVE-2023-42917

HIGH severity · CVSS 8.8 · Out-of-bounds write · actively exploited (CISA KEV)

8.8CVSS HIGH ● exploited

🔴 Actively exploited in the wild (CISA Known Exploited Vulnerabilities). Added to KEV 2023-12-04. US federal agencies must patch by 2023-12-25.

Summary

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products we track (1)

Apple Safari

Recommendation

This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.

Additional information

NVD record
http://seclists.org/fulldisclosure/2023/Dec/12Advisory
http://seclists.org/fulldisclosure/2023/Dec/13Advisory
http://seclists.org/fulldisclosure/2023/Dec/3Advisory
http://seclists.org/fulldisclosure/2023/Dec/4Advisory
http://seclists.org/fulldisclosure/2023/Dec/5Advisory
http://seclists.org/fulldisclosure/2023/Dec/8Advisory
http://seclists.org/fulldisclosure/2024/Jan/35Advisory
http://www.openwall.com/lists/oss-security/2023/12/05/1Advisory