Actively exploited in the wild
Apple Multiple Products WebKit Type Confusion Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2023-02-14. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2023-23529
HighCVSS 8.8KEVSummary
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Risk Assessment
The vulnerability is actively exploited, potentially leading to arbitrary code execution on Apple devices and takeover.
Recommendation
Immediately update Apple systems to iOS 15.7.4, iPadOS 15.7.4, iOS 16.3.1, iPadOS 16.3.1, macOS Ventura 13.2.1, or Safari 16.3.
Other vulnerabilities in Apple iOS, iPadOS, macOS, Safari
See all- CVE-2023-42917HighActively exploited
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2. Processing web content may lead to arbitrary code execution.
- CVE-2023-32439HighActively exploited
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2022-32893HighActively exploited
An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. This affects iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1. Processing malicious web content may lead to arbitrary code execution.
Original NVD description (English source)
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.