Actively exploited in the wild
Apple Multiple Products WebKit Use-After-Free Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2023-05-22. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2023-32373
HighCVSS 8.8KEVSummary
A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Risk Assessment
An attacker could remotely execute arbitrary code on a user's device, potentially leading to full system compromise or data theft.
Recommendation
Update systems to the latest versions: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5.
Other vulnerabilities in Apple WebKit
See all- CVE-2023-32435HighActively exploited
A memory corruption issue was addressed with improved state management. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
- CVE-2023-32409HighActively exploited
The issue was addressed with improved bounds checks. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2021-1789HighActively exploited
A type confusion issue exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS, Safari) due to improper state handling. Processing maliciously crafted web content may lead to arbitrary code execution.
Original NVD description (English source)
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.