CVE-2023-42852: Use After Free

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-42852.

Q: What is the description of the vulnerability?

A logic issue was addressed with improved checks. Processing web content may lead to arbitrary code execution.

Q: Which products are affected by this vulnerability?

The affected products include macOS Sonoma, Safari, iOS, iPadOS, watchOS, and tvOS.

Q: Which versions are affected by this vulnerability?

Versions up to and excluding macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2 and iPadOS 16.7.2, watchOS 10.1, iOS 17.1 and iPadOS 17.1, tvOS 17.1 are affected by this vulnerability.

Q: How can I fix this vulnerability?

To fix this vulnerability, update to iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1.

Published Oct 25, 2023

Updated

A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1. Processing web content may lead to arbitrary code execution.

Credit

Bistrit Dahal, CVE-2023-42946, Cristian Dinca(Computer Science), Romania, 이준성(Junsung Lee)(Cross Republic), 이준성(Junsung Lee), Pedro Ribeiro@@pedrib1337(Agile Information Security), Vitor Pedreira@@0xvhp_(Agile Information Security), Talal Haj Bakry(Mysk Inc), Tommy Mysk@@mysk_co(Mysk Inc), Mingxuan Yang@@PPPF00L(360 Vulnerability Research Institute), (360 Vulnerability Research Institute), happybabywu(360 Vulnerability Research Institute), Guang Gong(360 Vulnerability Research Institute), Yiğit Can YILMAZ@@yilmazcanyigit, Kirin@@Pwnrin(SecuRing), Wojciech Regula(SecuRing), (Computer Science), JZ, Linus Henze(Pinauten GmbH), Mickey Jin@@patch1t, Grzegorz Riegel, Adam M., Csaba Fitzl@@theevilbit(Offensive Security), Michael (Biscuit) Thomas - @social.lol@@biscuit, CVE-2023-42823, an anonymous researcher, inooo, Alex Renda, Claire Houston, Kacper Kwapisz@@KKKas_, Adis Alic, Sam Lakmaker, Ting Ding, James Mancz, Omar Shibli, Lorenzo Cavallaro, Harry Lewandowski, Abhay Kailasia@@abhay_kailasia(Lakshmi Narain College Of Technology Bhopal India), Peter Nguyễn Vũ Hoàng@@peternguyen14(STAR Labs SG Pte), Tomi Tokics@@tomitokics(iTomsn0w), Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), Noah Roskin-Frazee, Pr

Affected Software

21 affected componentsFixes available

debian/webkit2gtk<=2.36.4-1~deb10u1, <=2.38.6-0+deb10u1, <=2.40.5-1~deb11u1

2.42.4-1~deb11u12.42.2-1~deb12u12.42.4-1~deb12u12.42.4-1

debian/wpewebkit<=2.38.6-1~deb11u1, <=2.38.6-1

2.42.4-1

Apple macOS Sonoma<14.1

14.1

Apple tvOS<17.1

17.1

Apple WatchOS<10.1

10.1

Apple Safari<17.1

17.1

Apple iOS<17.1

17.1

Apple iPadOS<17.1

17.1

Apple iOS<16.7.2

16.7.2

Apple iPadOS<16.7.2

16.7.2

Apple Safari<17.1

Apple iPadOS<16.7.2

Apple iPadOS>=17.0<17.1

Apple iPhone OS<16.7.2

Apple iPhone OS>=17.0<17.1

Apple macOS>=14.0<14.1

Apple tvOS<17.1

Apple WatchOS<10.1

Fedoraproject Fedora=37

Debian Debian Linux=11.0

Debian Debian Linux=12.0

Event History

Oct 25, 2023

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

CVE Published

via MITRE·06:32 PM

Data Sourced

via MITRE·06:32 PM

DescriptionWeakness

Mar 25, 2024

Data Sourced

via Red Hat·05:27 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-42852.

What is the description of the vulnerability?

A logic issue was addressed with improved checks. Processing web content may lead to arbitrary code execution.

Which products are affected by this vulnerability?

The affected products include macOS Sonoma, Safari, iOS, iPadOS, watchOS, and tvOS.

Which versions are affected by this vulnerability?

Versions up to and excluding macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2 and iPadOS 16.7.2, watchOS 10.1, iOS 17.1 and iPadOS 17.1, tvOS 17.1 are affected by this vulnerability.

How can I fix this vulnerability?

To fix this vulnerability, update to iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1.

CVE-2023-42852: Use After Free

Credit

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the vulnerability ID for this issue?

What is the description of the vulnerability?

Which products are affected by this vulnerability?

Which versions are affected by this vulnerability?

How can I fix this vulnerability?

Company

Resources

Contact