Apple · iOS
CVE-2022-42856
Apple iOS Type Confusion Vulnerability
Qué es
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
CISA: Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 4 de enero de 2023
- Añadida a la lista de CISA
- 14 de diciembre de 2022
- Publicada
- 15 de diciembre de 2022
- Gravedad
- Alto 8,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 8,5% entre el 5,0% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-843
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (12)
- https://support.apple.com/en-us/HT213535
- https://support.apple.com/en-us/HT213532
- https://support.apple.com/en-us/HT213531
- https://support.apple.com/en-us/HT213516
- https://support.apple.com/en-us/HT213537
- http://seclists.org/fulldisclosure/2022/Dec/21
- http://seclists.org/fulldisclosure/2022/Dec/23
- http://seclists.org/fulldisclosure/2022/Dec/22
- http://seclists.org/fulldisclosure/2022/Dec/26
- http://seclists.org/fulldisclosure/2022/Dec/28
- http://www.openwall.com/lists/oss-security/2022/12/26/1
- https://security.gentoo.org/glsa/202305-32
Más fallos explotados de Apple
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 24 may 2022 | Information Disclosure | iOS | Media 5,5 | 33% |
| 24 may 2022 | Memory Corruption | iOS | Alto 7,8 | 24% |
| 24 may 2022 | Webkit Memory Corruption | iOS | Alto 8,8 | 67% |
| 23 may 2022 | Memory Corruption | iOS | Alto 7,8 | 4,6% |
| 3 nov 2021 | WebKit Buffer Overflow | iOS | Alto 8,8 | 3,0% |
| 3 nov 2021 | WebKit Memory Corruption | iOS | Alto 8,8 | 11% |
| 3 nov 2021 | WebKit Use-After-Free | iOS | Alto 8,8 | 11% |
| 29 sept 2026 | Out-of-Bounds Write | Multiple Products | Alto 8,8 | 26% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.