Apple macOS Web Contents memory corruption

Summaryinfo

A vulnerability was found in Apple macOS. It has been declared as critical. This vulnerability affects unknown code of the component Web Contents Handler. The manipulation results in memory corruption. This vulnerability is identified as CVE-2023-42917. The attack can be executed remotely. Additionally, an exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Apple macOS (Operating System) (version now known). Affected is some unknown processing of the component Web Contents Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

The weakness was released 12/01/2023. The advisory is available at support.apple.com. This vulnerability is traded as CVE-2023-42917 since 09/14/2023. Successful exploitation requires user interaction by the victim. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 02/04/2025). It is expected to see the exploit prices for this product increasing in the near future.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 209883 (RHEL 9 : webkit2gtk3 (RHSA-2024:8496)), which helps to determine the existence of the flaw in a target environment. This issue was added on 12/04/2023 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 12/25/2023:

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (838) and Tenable (209883). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion