high8.8Known exploited
CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-09-25. Federal due date: 2023-10-16.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Ipados | before 17.0.1 |
| Apple | Iphone Os | before 17.0.1 |
| Apple | Macos | before 14.0 |
| Fedoraproject | Fedora | Versions 37, 38, 39 |
| Debian | Debian Linux | Versions 11.0, 12.0 |
| Oracle | Graalvm | Versions 20.3.13, 21.3.9 |
| Oracle | Jdk | Version 1.8.0 |
| Oracle | Jre | Version 1.8.0 |
| Netapp | Active Iq Unified Manager | All versions |
| Netapp | Cloud Insights Acquisition Unit | All versions |
| Netapp | Cloud Insights Storage Workload Security Agent | All versions |
| Netapp | Oncommand Insight | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://security.gentoo.org/glsa/202401-33
- https://security.netapp.com/advisory/ntap-20240426-0004/
- https://support.apple.com/en-us/HT213940
- https://security.gentoo.org/glsa/202401-33
- https://security.netapp.com/advisory/ntap-20240426-0004/
- https://support.apple.com/en-us/HT213940
- https://support.apple.com/kb/HT213926
- https://support.apple.com/kb/HT213930
- https://webkitgtk.org/security/WSA-2023-0009.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41993