ByteOS Network

Vulnerability Details :

CVE-2023-42890

Assigner-apple

Assigner Org ID-286789f9-fbc2-4510-9f9a-43facdede74c

Published At-12 Dec, 2023 | 00:27

Updated At-13 Feb, 2025 | 17:12

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing web content may lead to arbitrary code execution.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:apple

Assigner Org ID:286789f9-fbc2-4510-9f9a-43facdede74c

Published At:12 Dec, 2023 | 00:27

Updated At:13 Feb, 2025 | 17:12

▼CVE Numbering Authority (CNA)

From unspecified before 10.2 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Processing web content may lead to arbitrary code execution

Type: N/A

CWE ID: N/A

Description: Processing web content may lead to arbitrary code execution

References

Hyperlink	Resource
https://support.apple.com/en-us/HT214039	N/A
https://support.apple.com/en-us/HT214035	N/A
https://support.apple.com/en-us/HT214040	N/A
https://support.apple.com/en-us/HT214036	N/A
https://support.apple.com/en-us/HT214041	N/A
https://support.apple.com/kb/HT214039	N/A
http://seclists.org/fulldisclosure/2023/Dec/9	N/A
http://seclists.org/fulldisclosure/2023/Dec/7	N/A
http://seclists.org/fulldisclosure/2023/Dec/6	N/A
http://seclists.org/fulldisclosure/2023/Dec/13	N/A
http://seclists.org/fulldisclosure/2023/Dec/12	N/A
http://www.openwall.com/lists/oss-security/2023/12/18/1	N/A
https://security.gentoo.org/glsa/202401-33	N/A

Hyperlink: https://support.apple.com/en-us/HT214039

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT214035

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT214040

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT214036

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT214041

Resource: N/A

Hyperlink: https://support.apple.com/kb/HT214039

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/9

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/7

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/6

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/13

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/12

Resource: N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2023/12/18/1

Resource: N/A

Hyperlink: https://security.gentoo.org/glsa/202401-33

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://support.apple.com/en-us/HT214039	x_transferred
https://support.apple.com/en-us/HT214035	x_transferred
https://support.apple.com/en-us/HT214040	x_transferred
https://support.apple.com/en-us/HT214036	x_transferred
https://support.apple.com/en-us/HT214041	x_transferred
https://support.apple.com/kb/HT214039	x_transferred
http://seclists.org/fulldisclosure/2023/Dec/9	x_transferred
http://seclists.org/fulldisclosure/2023/Dec/7	x_transferred
http://seclists.org/fulldisclosure/2023/Dec/6	x_transferred
http://seclists.org/fulldisclosure/2023/Dec/13	x_transferred
http://seclists.org/fulldisclosure/2023/Dec/12	x_transferred
http://www.openwall.com/lists/oss-security/2023/12/18/1	x_transferred
https://security.gentoo.org/glsa/202401-33	x_transferred

Hyperlink: https://support.apple.com/en-us/HT214039

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT214035

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT214040

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT214036

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT214041

Resource:

x_transferred

Hyperlink: https://support.apple.com/kb/HT214039

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/9

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/7

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/6

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/13

Resource:

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2023/Dec/12

Resource:

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2023/12/18/1

Resource:

x_transferred

Hyperlink: https://security.gentoo.org/glsa/202401-33

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-94	CWE-94 Improper Control of Generation of Code ('Code Injection')

Type: CWE

CWE ID: CWE-94

Description: CWE-94 Improper Control of Generation of Code ('Code Injection')

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:12 Dec, 2023 | 01:15

Updated At:28 Aug, 2024 | 15:35

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CPE Matches

Apple Inc.

>>safari>>Versions before 17.2(exclusive)

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Apple Inc.

>>ipados>>Versions before 17.2(exclusive)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

Apple Inc.

>>iphone_os>>Versions before 17.2(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Apple Inc.

>>macos>>Versions from 14.0(inclusive) to 14.2(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Apple Inc.

>>tvos>>Versions before 17.2(exclusive)

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

Apple Inc.

>>watchos>>Versions before 10.2(exclusive)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-94	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-94

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0