CVE-2023-41993
8.8HighPublished 21 Sep 2023 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-754
Impact
Remote attackers can execute arbitrary code when a user processes malicious web content. Exploitation requires an unauthenticated target to load attacker-controlled web content, and it has been actively exploited in the wild.
Root cause
WebKit fails to perform proper validation checks when processing web content.
Affected systems
Apple iOS versions prior to 16.7 and macOS versions prior to Sonoma 14 (also affects WebKitGTK / Safari components prior to vendor patches).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to macOS Sonoma 14, iOS 16.7, or later. If updating client devices cannot be done immediately, avoid browsing untrusted websites or processing untrusted links in affected WebKit-based browsers.
$ softwareupdate -i -aAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
References
- https://security.gentoo.org/glsa/202401-33Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240426-0004/Third Party Advisory
- https://support.apple.com/en-us/HT213940Vendor Advisory
- https://security.gentoo.org/glsa/202401-33Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240426-0004/Third Party Advisory
- https://support.apple.com/en-us/HT213940Vendor Advisory
- https://support.apple.com/kb/HT213926Vendor Advisory
- https://support.apple.com/kb/HT213930Vendor Advisory
- https://webkitgtk.org/security/WSA-2023-0009.htmlThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41993US Government Resource