Log in Start free

Vulnerability · Published Sep 26, 2023 · Assigned by apple

CVE-2023-40451

High 8.8

In plain English

A high-severity security flaw in Safari from Apple. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.1%top 34.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution may be able to execute arbitrary code.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8webkit2gtk32.40.5-1.el8ALSA-2023:7055
AlmaLinux:9webkit2gtk32.40.5-1.el9ALSA-2023:6535
AlmaLinux:8webkit2gtk3-devel2.40.5-1.el8ALSA-2023:7055
AlmaLinux:9webkit2gtk3-devel2.40.5-1.el9ALSA-2023:6535
AlmaLinux:8webkit2gtk3-jsc2.40.5-1.el8ALSA-2023:7055
AlmaLinux:9webkit2gtk3-jsc2.40.5-1.el9ALSA-2023:6535
AlmaLinux:8webkit2gtk3-jsc-devel2.40.5-1.el8ALSA-2023:7055
AlmaLinux:9webkit2gtk3-jsc-devel2.40.5-1.el9ALSA-2023:6535
Debian:12webkit2gtk2.40.5-1~deb12u1DEBIAN-CVE-2023-40451
Debian:12webkit2gtk2.40.5-1~deb12u1DSA-5468-1
Debian:13webkit2gtk2.40.5-1DEBIAN-CVE-2023-40451
Debian:14webkit2gtk2.40.5-1DEBIAN-CVE-2023-40451
Debian:12wpewebkitno fix listedDEBIAN-CVE-2023-40451
Debian:13wpewebkit2.40.5-1DEBIAN-CVE-2023-40451
Debian:14wpewebkit2.40.5-1DEBIAN-CVE-2023-40451
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2023-40451
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2023-40451
Ubuntu:22.04:LTSwebkit2gtk2.40.5-0ubuntu0.22.04.1UBUNTU-CVE-2023-40451
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2023-40451

Affected products (as reported)

VendorProductVersions
Apple Safari unspecified – before 17

References