A vulnerability, which was classified as critical, has been found in Apple Safari up to 16.4.0 (Web Browser). Affected by this issue is an unknown part of the component WebKit. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability.

The weakness was released 04/07/2023 by Clément Lecigne as HT213722 as confirmed advisory (Website). The advisory is available at support.apple.com. This vulnerability is handled as CVE-2023-28205. Successful exploitation requires user interaction by the victim. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 04/26/2023). The advisory points out:

Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

It is declared as highly functional.

Upgrading to version 16.4.1 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

A use after free issue was addressed with improved memory management.

Productinfo

Type

• Web Browser

Vendor

• Apple

Name

• Safari

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion