CVE-2023-40394: Input Validation

Q: What is CVE-2023-40394?

CVE-2023-40394 is a vulnerability related to logging in Apple iOS and iPadOS where improved validation of environment variables has been implemented to address the issue.

Q: What is the severity of CVE-2023-40394?

The severity of CVE-2023-40394 has not been specified.

Q: Which software products are affected by CVE-2023-40394?

CVE-2023-40394 affects Apple iOS and iPadOS versions up to, but not including, version 16.6.

Q: How can I fix CVE-2023-40394?

To fix CVE-2023-40394, it is recommended to update to Apple iOS or iPadOS version 16.6 or later, as the issue has been addressed in this version.

Q: Where can I find more information about CVE-2023-40394?

More information about CVE-2023-40394 can be found in the official Apple security advisory at the following link: https://support.apple.com/en-us/HT213841

Published Jul 24, 2023

Updated

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

Other sources

Accounts. A privacy issue was addressed with improved private data redaction for log entries.

— Apple

Apple Neural Engine. The issue was addressed with improved memory handling.

— Apple

CFNetwork. A privacy issue was addressed with improved private data redaction for log entries.

— Apple

Find My. A logic issue was addressed with improved restrictions.

— Apple

Find My. A privacy issue was addressed with improved private data redaction for log entries.

— Apple

Credit

Wojciech Regula(SecuRing), Nick Brook, Kirin@@Pwnrin, pattern-f@@pattern_F_(Ant Security Light), Mohamed GHANNAM@@_simo36, Kirin@@Pwnrin(SecuRing), (SecuRing), found by OSS-Fuzz, Zweig(Kunlun Lab), 香农的三蹦子(Pangu Lab), an anonymous researcher, Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Peter Nguyễn Vũ Hoàng@@peternguyen14(STAR Labs SG Pte), Certik Skyfall Team, Valentin Pashkov(Kaspersky), Mikhail Vinogradov(Kaspersky), Georgy Kucherin@@kucher1n(Kaspersky), Leonid Bezvershenko@@bzvr_(Kaspersky), (Kaspersky), Boris Larin@@oct0xor(Kaspersky), Kaitao Xie(Alibaba Group), Xiaolong Bai(Alibaba Group), Certik Skyfall Team(Ant Security Light), Sei K., Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), Noah Roskin-Frazee, Thijs Alkemade(Computest Sector 7), Adam M., Johan Carlsson (joaxcar), Hritvik Taneja, Jason Kim, Jie Jeff Xu, Stephan van Schaik, Daniel Genkin, Yuval Yarom, Narendra Bhati (twitter.com/imnarendrabhati)(Suma Soft Pvt), Pune - India(TU Wien), Valentino Dalla Valle(TU Wien), Pedro Bernardo(TU Wien), Marco Squarcina(TU Wien), (TU Wien), Lorenzo Veronese(TU Wien), Pune - India, Yuhao Hu, Jiming Wang, Jikai Ren, Anonymous(Trend Micro Zero Day Initiative), Francisco Alonso@@revskills, Junsung Lee, 이준성(Junsung Lee)(Cross Republic), Apple, YeongHyeon Choi@@hyeon101010

Affected Software

4 affected componentsFixes available

Apple iOS and iPadOS<16.6

16.6

Apple iOS, iPadOS, and macOS<16.6

16.6

Apple iOS, iPadOS, and macOS<16.6

iPhone OS<16.6

Event History

Jul 24, 2023

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Jan 10, 2024

CVE Published

via MITRE·10:03 PM

Data Sourced

via MITRE·10:03 PM

DescriptionWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2023-40394?

CVE-2023-40394 is a vulnerability related to logging in Apple iOS and iPadOS where improved validation of environment variables has been implemented to address the issue.

What is the severity of CVE-2023-40394?

The severity of CVE-2023-40394 has not been specified.

Which software products are affected by CVE-2023-40394?

CVE-2023-40394 affects Apple iOS and iPadOS versions up to, but not including, version 16.6.

How can I fix CVE-2023-40394?

To fix CVE-2023-40394, it is recommended to update to Apple iOS or iPadOS version 16.6 or later, as the issue has been addressed in this version.

Where can I find more information about CVE-2023-40394?

More information about CVE-2023-40394 can be found in the official Apple security advisory at the following link: https://support.apple.com/en-us/HT213841

CVE-2023-40394: Input Validation

Other sources

Credit

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2023-40394?

What is the severity of CVE-2023-40394?

Which software products are affected by CVE-2023-40394?

How can I fix CVE-2023-40394?

Where can I find more information about CVE-2023-40394?

Company

Resources

Contact