Apple Multiple Products WebKit Out-of-Bounds Read
CVE-2023-42916 is a medium-severity out-of-bounds read vulnerability in Safari from Apple, with a CVSS 3.1 base score of 6.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists versions 17.1, 17.1.2 as the first without the flaw, so updating Safari to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on December 4, 2023, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update Safari to 17.1 or 17.1.2, whichever matches your release line, or a later version.
- Update macOS to 14.1 or 14.1.2, whichever matches your release line, or a later version.
- Update iOS and iPadOS to 17.1 or a later version.
- CISA's required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Read the advisory on support.apple.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Apple | Safari | before 17.1; before 17.1.2 | 17.1, 17.1.2 |
| Apple | macOS | before 14.1; 14.0.0 up to, but not including, 14.1.2 | 14.1, 14.1.2 |
| Apple | iOS and iPadOS | before 17.1 | 17.1 |
| Apple | iphone_os | before 17.1.2 | 17.1.2 |
| Apple | ipados | before 17.1.2 | 17.1.2 |
| Fedora Project | Fedora | 38; 39 | Not stated |
| Debian | Debian Linux | 11.0; 12.0 | Not stated |
| Webkitgtk | Webkitgtk+ | before 2.42.3 | 2.42.3 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 6.5 | Medium | NVD |
| CVSS 3.1 | 6.5 | Medium | CISA (ADP) |
Official description
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: partial).
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- Record last changed materially (score, affected products, status or references).
References
Advisories
Third-party and government advisories
- seclists.org/fulldisclosure/2023/Dec/12Mailing List, Third Party Advisory
- seclists.org/fulldisclosure/2023/Dec/13Mailing List, Third Party Advisory
- seclists.org/fulldisclosure/2023/Dec/3Mailing List, Third Party Advisory
- seclists.org/fulldisclosure/2023/Dec/4Mailing List, Third Party Advisory
- seclists.org/fulldisclosure/2023/Dec/5Mailing List, Third Party Advisory
- seclists.org/fulldisclosure/2023/Dec/8Mailing List, Third Party Advisory
- seclists.org/fulldisclosure/2024/Jan/35Mailing List, Third Party Advisory
- openwall.com/lists/oss-security/2023/12/05/1Mailing List, Third Party Advisory
- security.gentoo.org/glsa/202401-04Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42916US Government Resource
Other references
Other vulnerabilities in Safari
- 7.5 High severity
- 7.5 High severity
- 8.8 High severity
- 10.0 Critical severity
- 8.8 High severity
- 8.8 High severity
Recent Out-of-bounds Read vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.