pwn.watch: WebKit incident updates

[high] Apple Multiple Products: 2 exploited vulnerabilities (CVE-2023-42916, CVE-2023-42917)

Mon, 04 Dec 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-12-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-12-04: CISA added CVE-2023-42916 to the KEV catalog (due 2023-12-25).
2023-12-04: CISA added CVE-2023-42917 to the KEV catalog (due 2023-12-25).

CVEs: CVE-2023-42916, CVE-2023-42917

[high] Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)

Mon, 25 Sep 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-09-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-09-25: CISA added CVE-2023-41991 to the KEV catalog (due 2023-10-16).
2023-09-25: CISA added CVE-2023-41992 to the KEV catalog (due 2023-10-16).
2023-09-25: CISA added CVE-2023-41993 to the KEV catalog (due 2023-10-16).

CVEs: CVE-2023-41991, CVE-2023-41992, CVE-2023-41993

[high] Apple Multiple Products: WebKit Code Execution (CVE-2023-37450)

Thu, 13 Jul 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-07-13.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-07-13: CISA added CVE-2023-37450 to the KEV catalog (due 2023-08-03).

CVEs: CVE-2023-37450

[high] Apple Multiple Products: WebKit Type Confusion (CVE-2023-32439)

Fri, 23 Jun 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-06-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-06-23: CISA added CVE-2023-32439 to the KEV catalog (due 2023-07-14).

CVEs: CVE-2023-32439

[high] Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)

Mon, 22 May 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-05-22.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-05-22: CISA added CVE-2023-28204 to the KEV catalog (due 2023-06-12).
2023-05-22: CISA added CVE-2023-32373 to the KEV catalog (due 2023-06-12).
2023-05-22: CISA added CVE-2023-32409 to the KEV catalog (due 2023-06-12).

CVEs: CVE-2023-28204, CVE-2023-32373, CVE-2023-32409

[high] Apple Multiple Products: WebKit Use-After-Free (CVE-2023-28205)

Mon, 10 Apr 2023 00:00:00 GMT

Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-04-10.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-04-10: CISA added CVE-2023-28205 to the KEV catalog (due 2023-05-01).

CVEs: CVE-2023-28205

[high] Apple Multiple Products: WebKit Type Confusion (CVE-2023-23529)

Tue, 14 Feb 2023 00:00:00 GMT

Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-02-14.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-02-14: CISA added CVE-2023-23529 to the KEV catalog (due 2023-03-07).

CVEs: CVE-2023-23529