Exploit / PoCcriticalExploited in the wild

Apple addressed 2 new iOS zero

Security Affairsby @securityaffairsNov 30, 2023 · 22:33 UTC (Nov 30, 2023)2 min read3 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2023-42916 CVE-2023-42917 CVE-2023-5217 CVE-2023-41993 CVE-2023-41991 CVE-2023-41992 CVE-2023-41064 CVE-2023-41061 CVE-2023-37450 CVE-2023-38606 CVE-2023-32434 CVE-2023-32435 CVE-2023-32439 CVE-2023-32409 CVE-2023-28204 CVE-2023-32373 CVE-2023-28206 CVE-2023-28205 CVE-2023-23529

Tags: cve-2023-42916 cve-2023-42917 cve-2023-5217 cve-2023-41993 cve-2023-41991 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-23529	WebKit Type Confusion RCE in Apple iOS, iPadOS, macOS, and Safari	8.8	9%	KEV	Feb 27, 2023 KEV Feb 14, 2023
CVE-2023-32439 +5 related CVEs CVE-2023-32435 CVE-2023-32373 CVE-2023-32409 CVE-2023-32434 CVE-2023-28204	Type Confusion in Apple WebKit (Safari, iOS, iPadOS, macOS) Enables Code Execution	8.8 group max	24%	KEV	Jun 23, 2023 KEV Jun 23, 2023
CVE-2023-28205	Use-After-Free in Apple WebKit (iOS, iPadOS, macOS, Safari) Enables Code Execution	8.8	27%	KEV	Apr 10, 2023 KEV Apr 10, 2023
CVE-2023-28206	Out-of-Bounds Write in Apple IOSurfaceAccelerator Allows Kernel-Level Code Execution	8.6	23%	KEV	Apr 10, 2023 KEV Apr 10, 2023
CVE-2023-37450 +1 related CVE CVE-2023-38606	Arbitrary Code Execution in Apple WebKit (iOS, iPadOS, macOS, Safari, tvOS, watchOS)	8.8 group max	19%	KEV	Jul 27, 2023 KEV Jul 13, 2023
CVE-2023-41061	Actively Exploited Wallet Flaw Enables Code Execution on Apple iOS, iPadOS, watchOS	7.8	4%	KEV	Sep 7, 2023 KEV Sep 11, 2023
CVE-2023-41064	ImageIO Buffer Overflow in Apple iOS, iPadOS, and macOS Allows Code Execution	7.8	53%	KEV	Sep 7, 2023 KEV Sep 11, 2023
CVE-2023-41993 +2 related CVEs CVE-2023-41992 CVE-2023-41991	WebKit Code Execution Flaw in Apple iOS, iPadOS, macOS, and Safari	8.8 group max	24%	KEV	Sep 21, 2023 KEV Sep 25, 2023
CVE-2023-42917 +1 related CVE CVE-2023-42916	WebKit Memory Corruption in Apple iOS, macOS, and Safari Enables Arbitrary Code Execution	8.8 group max	9%	KEV	Nov 30, 2023 KEV Dec 4, 2023
CVE-2023-5217	Heap Buffer Overflow in Google Chromium libvpx (CVE-2023-5217) Added to CISA KEV	8.8	49%	KEVPoC	Sep 28, 2023 KEV Oct 2, 2023

From the original article

2 min read at securityaffairs.com

Apple released emergency security updates to fix two actively exploited zero-day flaws impacting iPhone, iPad, and Mac devices. Apple released emergency security updates to address two zero-day vulnerabilities impacting iPhone, iPad, and Mac devices. The flaws are actively exploited in attacks in the wild, both issues reside in the WebKit browser engine.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.