Actively exploited in the wild
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2023-12-04. This indicates confirmed attacks in production environments.
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
CVE-2023-42916
MediumCVSS 6.5KEVSummary
An out-of-bounds read issue in web content processing that may disclose sensitive information. Fixed in iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2. Apple is aware of reports of exploitation against iOS versions before 16.7.1.
Risk Assessment
Risk of sensitive information disclosure when processing malicious web content, especially on older system versions.
Recommendation
Update iOS, iPadOS, macOS, and Safari to the latest patched versions.
Other vulnerabilities in Apple iOS, iPadOS, macOS, Safari
See all- CVE-2023-42917HighActively exploited
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2. Processing web content may lead to arbitrary code execution.
- CVE-2023-32439HighActively exploited
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2023-23529HighActively exploited
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2022-32893HighActively exploited
An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. This affects iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1. Processing malicious web content may lead to arbitrary code execution.
Original NVD description (English source)
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.