CVE-2023-42917

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2023-42917", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2023-09-14T19:05:11.463Z", "datePublished": "2023-11-30T22:18:50.340Z", "dateUpdated": "2025-10-21T23:05:31.441Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1."}]}], "affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "17.1", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "14.1", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "17.1", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1."}], "references": [{"url": "https://support.apple.com/en-us/HT214033"}, {"url": "https://support.apple.com/en-us/HT214032"}, {"url": "https://support.apple.com/en-us/HT214031"}, {"url": "https://support.apple.com/kb/HT214033"}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/05/1"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/"}, {"url": "https://support.apple.com/kb/HT214034"}, {"url": "https://www.debian.org/security/2023/dsa-5575"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/3"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/4"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/5"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/8"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/13"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/12"}, {"url": "https://security.gentoo.org/glsa/202401-04"}, {"url": "https://support.apple.com/kb/HT214062"}, {"url": "http://seclists.org/fulldisclosure/2024/Jan/35"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2024-06-12T09:05:54.874Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:30:24.968Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.apple.com/en-us/HT214033", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214032", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214031", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/kb/HT214033", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/05/1", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/kb/HT214034", "tags": ["x_transferred"]}, {"url": "https://www.debian.org/security/2023/dsa-5575", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/3", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/4", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/5", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/8", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/13", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/12", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202401-04", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/kb/HT214062", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Jan/35", "tags": ["x_transferred"]}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-42917", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2023-12-02T05:00:19.060611Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2023-12-04", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917"}}}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917", "tags": ["government-resource"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "timeline": [{"time": "2023-12-04T00:00:00.000Z", "lang": "en", "value": "CVE-2023-42917 added to CISA KEV"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T23:05:31.441Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.apple.com/en-us/HT214033", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214032", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/en-us/HT214031", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/kb/HT214033", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/05/1", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/kb/HT214034", "tags": ["x_transferred"]}, {"url": "https://www.debian.org/security/2023/dsa-5575", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/3", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/4", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/5", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/8", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/13", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/12", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202401-04", "tags": ["x_transferred"]}, {"url": "https://support.apple.com/kb/HT214062", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2024/Jan/35", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:30:24.968Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-42917", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2023-12-02T05:00:19.060611Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2023-12-04", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917"}}}], "timeline": [{"lang": "en", "time": "2023-12-04T00:00:00.000Z", "value": "CVE-2023-42917 added to CISA KEV"}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917", "tags": ["government-resource"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T13:50:52.311Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17.1", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "14.1", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17.1", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/HT214033"}, {"url": "https://support.apple.com/en-us/HT214032"}, {"url": "https://support.apple.com/en-us/HT214031"}, {"url": "https://support.apple.com/kb/HT214033"}, {"url": "http://www.openwall.com/lists/oss-security/2023/12/05/1"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/"}, {"url": "https://support.apple.com/kb/HT214034"}, {"url": "https://www.debian.org/security/2023/dsa-5575"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/3"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/4"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/5"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/8"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/13"}, {"url": "http://seclists.org/fulldisclosure/2023/Dec/12"}, {"url": "https://security.gentoo.org/glsa/202401-04"}, {"url": "https://support.apple.com/kb/HT214062"}, {"url": "http://seclists.org/fulldisclosure/2024/Jan/35"}], "descriptions": [{"lang": "en", "value": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1."}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2024-06-12T09:05:54.874Z"}}}, "cveMetadata": {"cveId": "CVE-2023-42917", "state": "PUBLISHED", "dateUpdated": "2025-10-21T23:05:31.441Z", "dateReserved": "2023-09-14T19:05:11.463Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2023-11-30T22:18:50.340Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Safari", "vendor": "Apple", "versions": [{"lessThan": "17.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "14.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "17.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "cisaActionDue": "2023-12-25", "cisaExploitAdd": "2023-12-04", "cisaRequiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "cisaVulnerabilityName": "Apple Multiple Products WebKit Memory Corruption Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB99F7C8-7DB8-41EB-817C-CCA0B26A8573", "versionEndExcluding": "17.1.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "328EF092-09AD-4809-A921-7390D4CE4BFF", "versionEndExcluding": "15.8.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "47A8EDA8-BDDB-413A-AF89-C10FD7B1EA06", "versionEndExcluding": "16.7.3", "versionStartIncluding": "16.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "3DA5F940-604E-4F88-BB50-51EC9A39E8A4", "versionEndExcluding": "17.1.2", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "7A20BCB8-8DB0-495A-8946-036926C91E96", "versionEndExcluding": "15.8.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8EBFB96-37E1-4861-83BB-ECE8770C9153", "versionEndExcluding": "16.7.3", "versionStartIncluding": "16.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "89BC75AA-3A30-4D2B-80C3-C3F754689AC4", "versionEndExcluding": "17.1.2", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5BB9989-686F-4AD9-B34E-4FB5161AB658", "versionEndExcluding": "14.1.2", "versionStartIncluding": "14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*", "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webkitgtk:webkitgtk\\+:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C7F88F0-0092-4338-A52F-1A2ED27460B5", "versionEndExcluding": "2.42.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1."}, {"lang": "es", "value": "Se solucion\u00f3 una vulnerabilidad de corrupci\u00f3n de memoria con un bloqueo mejorado. Este problema se solucion\u00f3 en iOS 17.1.2 y iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. El procesamiento de contenido web puede dar lugar a la ejecuci\u00f3n de c\u00f3digo arbitrario. Apple tiene conocimiento de un informe que indica que este problema puede haberse explotado en versiones de iOS anteriores a iOS 16.7.1."}], "id": "CVE-2023-42917", "lastModified": "2026-06-17T06:24:49.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-42917", "options": [{"exploitation": "active"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2023-12-02T05:00:19.060611Z", "version": "2.0.3"}}]}, "published": "2023-11-30T23:15:07.280", "references": [{"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/12"}, {"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/13"}, {"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/3"}, {"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/4"}, {"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/5"}, {"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/8"}, {"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2024/Jan/35"}, {"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/12/05/1"}, {"source": "product-security@apple.com", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/"}, {"source": "product-security@apple.com", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/"}, {"source": "product-security@apple.com", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202401-04"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214031"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214032"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214033"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/kb/HT214033"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/kb/HT214034"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/kb/HT214062"}, {"source": "product-security@apple.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://www.debian.org/security/2023/dsa-5575"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Dec/8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2024/Jan/35"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2023/12/05/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202401-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214031"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214032"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/HT214033"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/kb/HT214033"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/kb/HT214034"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/kb/HT214062"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://www.debian.org/security/2023/dsa-5575"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["US Government Resource"], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:10364", "cpe": "cpe:/o:redhat:rhel_els:7", "package": "webkitgtk4-0:2.48.3-2.el7_9", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2025-07-07T00:00:00Z"}, {"advisory": "RHSA-2023:7716", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "webkit2gtk3-0:2.40.5-1.el8_9.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:2982", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "webkit2gtk3-0:2.42.5-1.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-05-22T00:00:00Z"}, {"advisory": "RHSA-2024:9680", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "webkit2gtk3-0:2.46.3-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9679", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "webkit2gtk3-0:2.46.3-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9679", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "webkit2gtk3-0:2.46.3-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9679", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "webkit2gtk3-0:2.46.3-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9653", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "webkit2gtk3-0:2.46.3-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9653", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "webkit2gtk3-0:2.46.3-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9653", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "webkit2gtk3-0:2.46.3-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2024:9646", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "webkit2gtk3-0:2.46.3-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-11-14T00:00:00Z"}, {"advisory": "RHSA-2023:7715", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "webkit2gtk3-0:2.40.5-1.el9_3.1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-12-11T00:00:00Z"}, {"advisory": "RHSA-2024:2126", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "webkit2gtk3-0:2.42.5-1.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}, {"advisory": "RHSA-2024:8496", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "webkit2gtk3-0:2.46.1-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2024-10-28T00:00:00Z"}, {"advisory": "RHSA-2024:8492", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "webkit2gtk3-0:2.46.1-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-10-28T00:00:00Z"}], "bugzilla": {"description": "webkitgtk: Arbitrary Remote Code Execution", "id": "2253058", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253058"}, "csaw": true, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-787", "details": ["A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.", "A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog."], "mitigation": {"lang": "en:us", "value": "Do not process or load untrusted web content with WebKitGTK.\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality."}, "name": "CVE-2023-42917", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "webkitgtk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2023-12-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-42917\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-42917\nhttps://webkitgtk.org/security/WSA-2023-0011.html\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog"], "statement": "All versions of Red Hat Enterprise Linux are affected to this vulnerability. To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content. For this reason, this flaw was rated with an important, and not critical, severity.", "threat_severity": "Important"}

{}