Apple · Multiple Products
CVE-2023-42917
Apple Multiple Products WebKit Memory Corruption Vulnerability
Qué es
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
CISA: Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Qué hacer
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 25 de diciembre de 2023
- Añadida a la lista de CISA
- 4 de diciembre de 2023
- Publicada
- 30 de noviembre de 2023
- Gravedad
- Alto 8,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 9,3% entre el 4,7% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-787
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (18)
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/kb/HT214033
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZN…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2Y…
- https://support.apple.com/kb/HT214034
- https://www.debian.org/security/2023/dsa-5575
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/12
- https://security.gentoo.org/glsa/202401-04
- https://support.apple.com/kb/HT214062
- http://seclists.org/fulldisclosure/2024/Jan/35
Más fallos explotados de Apple
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 29 sept 2026 | Out-of-Bounds Write | Multiple Products | Alto 8,8 | 26% |
| 20 mar 2026 | Buffer Overflow | Multiple Products | Alto 8,8 | 1,7% |
| 20 mar 2026 | Improper Locking | Multiple Products | Alto 7,8 | 0,4% |
| 20 mar 2026 | Classic Buffer Overflow | Multiple Products | Media 5,5 | 0,4% |
| 5 mar 2026 | Integer Overflow or Wraparound | Multiple Products | Alto 8,8 | 7,0% |
| 5 mar 2026 | Use-After-Free | Multiple Products | Alto 8,8 | 4,0% |
| 12 feb 2026 | Multiple Buffer Overflow | Multiple Products | Alto 7,8 | 1,7% |
| 15 dic 2025 | Use-After-Free WebKit | Multiple Products | Alto 8,8 | 26% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.