Log in Start free

Actively exploited · Published Nov 30, 2023 · Assigned by apple

CVE-2023-42917

High 8.8 Exploited

In plain English

A high-severity out-of-bounds write in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on December 4, 2023). The chance it is exploited in the next 30 days is estimated at 9.3% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)9.3%top 4.6% of all CVEs
Exploited in the wildYesCISA KEV since Dec 4, 2023
Attack toolingNoneno public tooling known

CISA guidance

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Federal agencies must remediate by Dec 25, 2023.

Official description

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8webkit2gtk32.42.5-1.el8ALSA-2024:2982
AlmaLinux:8webkit2gtk32.40.5-1.el8_9.1.alma.1ALSA-2023:7716
AlmaLinux:9webkit2gtk32.40.5-1.el9_3.1ALSA-2023:7715
AlmaLinux:8webkit2gtk3-devel2.42.5-1.el8ALSA-2024:2982
AlmaLinux:8webkit2gtk3-devel2.40.5-1.el8_9.1.alma.1ALSA-2023:7716
AlmaLinux:9webkit2gtk3-devel2.40.5-1.el9_3.1ALSA-2023:7715
AlmaLinux:8webkit2gtk3-jsc2.40.5-1.el8_9.1.alma.1ALSA-2023:7716
AlmaLinux:8webkit2gtk3-jsc2.42.5-1.el8ALSA-2024:2982
AlmaLinux:9webkit2gtk3-jsc2.40.5-1.el9_3.1ALSA-2023:7715
AlmaLinux:8webkit2gtk3-jsc-devel2.42.5-1.el8ALSA-2024:2982
AlmaLinux:8webkit2gtk3-jsc-devel2.40.5-1.el8_9.1.alma.1ALSA-2023:7716
AlmaLinux:9webkit2gtk3-jsc-devel2.40.5-1.el9_3.1ALSA-2023:7715
Debian:12webkit2gtk2.42.3-1~deb12u1DSA-5575-1
Debian:12webkit2gtk2.42.3-1~deb12u1DEBIAN-CVE-2023-42917
Debian:13webkit2gtk2.42.3-1DEBIAN-CVE-2023-42917
Debian:14webkit2gtk2.42.3-1DEBIAN-CVE-2023-42917
Debian:12wpewebkitno fix listedDEBIAN-CVE-2023-42917
Debian:13wpewebkit2.42.3-1DEBIAN-CVE-2023-42917
Debian:14wpewebkit2.42.3-1DEBIAN-CVE-2023-42917
Rocky Linux:8webkit2gtk30:2.40.5-1.el8_9.1RLSA-2023:7716
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2023-42917
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2023-42917
Ubuntu:22.04:LTSwebkit2gtk2.42.3-0ubuntu0.22.04.1USN-6545-1
Ubuntu:22.04:LTSwebkit2gtk2.42.3-0ubuntu0.22.04.1UBUNTU-CVE-2023-42917
Ubuntu:24.04:LTSwebkit2gtk2.42.3-1UBUNTU-CVE-2023-42917
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2023-42917

Affected products (as reported)

VendorProductVersions
Apple Safari unspecified – before 17.1
Apple macOS unspecified – before 14.1
Apple iOS and iPadOS unspecified – before 17.1

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References