CVE-2023-42917: Apple Multiple Products WebKit Memory Corruption Vulnerability

Q: What is CVE-2023-42917?

CVE-2023-42917 is a memory corruption vulnerability in WebKit that allows for arbitrary code execution.

Q: Which Apple products are affected by CVE-2023-42917?

Apple Safari, macOS Sonoma, iOS, and iPadOS versions up to and including 17.1.2 are affected by CVE-2023-42917.

Q: How was CVE-2023-42917 fixed?

CVE-2023-42917 was fixed with improved locking in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2.

Q: Is there a remedy available for CVE-2023-42917?

Yes, the remedy for CVE-2023-42917 is to update to iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, or Safari 17.1.2.

Q: Where can I find more information about CVE-2023-42917?

You can find more information about CVE-2023-42917 in the following references: - [Apple Support - HT214031](https://support.apple.com/en-us/HT214031) - [Apple Support - HT214033](https://support.apple.com/en-us/HT214033) - [Apple Support - HT214032](https://support.apple.com/en-us/HT214032)

Published Nov 30, 2023

Updated

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Credit

an anonymous researcher, Zhenjiang Zhao(Pangu Team), Qianxin, Junsung Lee, Meysam Firouzi@@R00tkitSMM, Eloi Benoist-Vanderbeken@@elvanderb(Synacktiv), CVE-2023-42893, Csaba Fitzl@@theevilbit(OffSec), Zhongquan Li@@Guluisacat(Dawn Security Lab of JingDong), Csaba Fitzl@@theevilbit(Offensive Security), Joshua Jewett@@JoshJewett33, Pwn2car, Zoom Offensive Security Team, Clément Lecigne(Google's Threat Analysis Group), Nan Wang@@eternalsakura13(360 Vulnerability Research Institute), rushikesh nandedkar, rushikesh nandedka, Noah Roskin-Frazee, Pr, Kirin@@Pwnrin, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative)

Affected Software

36 affected componentsFixes available

debian/webkit2gtk<=2.36.4-1~deb10u1, <=2.38.6-0+deb10u1, <=2.42.2-1~deb11u1, <=2.42.2-1~deb12u1

2.42.5-1~deb11u12.42.5-1~deb12u12.42.5-12.44.1-1

debian/wpewebkit<=2.38.6-1~deb11u1, <=2.38.6-1

2.42.5-12.44.1-1

ubuntu/webkit2gtk<2.42.3-0ubuntu0.22.04.1

2.42.3-0ubuntu0.22.04.1

ubuntu/webkit2gtk<2.42.3-0ubuntu0.23.04.1

2.42.3-0ubuntu0.23.04.1

ubuntu/webkit2gtk<2.42.3-0ubuntu0.23.10.1

2.42.3-0ubuntu0.23.10.1

ubuntu/webkit2gtk<2.42.3-1

2.42.3-1

ubuntu/webkit2gtk<2.42.3

2.42.3

Apple Multiple Products

Apple macOS Sonoma<14.1.2

14.1.2

Apple tvOS<17.2

17.2

Apple iPhone

Apple Mac

Apple TV

Apple Watch

Apple WatchOS<10.2

10.2

redhat/webkitgtk<2.42.3

2.42.3

Apple Safari<17.1.2

17.1.2

Apple iOS<15.8.1

15.8.1

Apple iPadOS<15.8.1

15.8.1

Apple iOS<17.1.2

17.1.2

Apple iPadOS<17.1.2

17.1.2

Apple iOS<16.7.3

16.7.3

Apple iPadOS<16.7.3

16.7.3

Apple Safari<17.1.2

Apple iPadOS<15.8.1

Apple iPadOS>=16.0<16.7.3

Apple iPadOS>=17.0<17.1.2

Apple iPhone OS<15.8.1

Apple iPhone OS>=16.0<16.7.3

Apple iPhone OS>=17.0<17.1.2

Apple macOS>=14.0<14.1.2

Debian Debian Linux=11.0

Debian Debian Linux=12.0

Fedoraproject Fedora=38

Fedoraproject Fedora=39

WebKitGTK Webkitgtk\+<2.42.3

Remediation

Information

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Event History

Nov 30, 2023

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·10:18 PM

Data Sourced

via MITRE·10:18 PM

DescriptionWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Dec 1, 2023

News Published

09:31 PM

Dec 4, 2023

Known Exploited

via CISA·12:00 AM

Dec 5, 2023

Data Sourced

via Red Hat·07:46 PM

DescriptionSeverityAffected Software

Dec 11, 2023

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Description

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionAffected Software

Dec 13, 2023

News Published

12:41 AM

Jan 31, 2024

News Published

via BleepingComputer·07:02 PM

News Published

via BleepingComputer·07:04 PM

Feb 1, 2024

Data Sourced

via Launchpad·04:37 PM

Description

Frequently Asked Questions

What is CVE-2023-42917?

CVE-2023-42917 is a memory corruption vulnerability in WebKit that allows for arbitrary code execution.

Which Apple products are affected by CVE-2023-42917?

Apple Safari, macOS Sonoma, iOS, and iPadOS versions up to and including 17.1.2 are affected by CVE-2023-42917.

How was CVE-2023-42917 fixed?

CVE-2023-42917 was fixed with improved locking in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2.

Is there a remedy available for CVE-2023-42917?

Yes, the remedy for CVE-2023-42917 is to update to iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, or Safari 17.1.2.

Where can I find more information about CVE-2023-42917?

You can find more information about CVE-2023-42917 in the following references: - [Apple Support - HT214031](https://support.apple.com/en-us/HT214031) - [Apple Support - HT214033](https://support.apple.com/en-us/HT214033) - [Apple Support - HT214032](https://support.apple.com/en-us/HT214032)

CVE-2023-42917: Apple Multiple Products WebKit Memory Corruption Vulnerability

Credit

Affected Software

Remediation

Information

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2023-42917?

Which Apple products are affected by CVE-2023-42917?

How was CVE-2023-42917 fixed?

Is there a remedy available for CVE-2023-42917?

Where can I find more information about CVE-2023-42917?

Company

Resources

Contact