Actively exploited in the wild
Apple Multiple Products WebKit Memory Corruption Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2023-12-04. This indicates confirmed attacks in production environments.
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
CVE-2023-42917
HighCVSS 8.8KEVSummary
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2. Processing web content may lead to arbitrary code execution.
Risk Assessment
Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1, posing a high risk to users.
Recommendation
Immediately update Apple devices to the latest OS and Safari versions.
Other vulnerabilities in Apple iOS, iPadOS, macOS, Safari
See all- CVE-2023-32439HighActively exploited
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2023-23529HighActively exploited
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2022-32893HighActively exploited
An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. This affects iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1. Processing malicious web content may lead to arbitrary code execution.
Original NVD description (English source)
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.