Buffer overflow in macOS - CVE-2023-23496

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU71451

Buffer overflow in macOS - CVE-2023-23496

Published: January 23, 2023


Vulnerability identifier: #VU71451
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-23496
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

macOS
watchOS
Apple iOS
iPadOS
tvOS
WebKitGTK+
WPE WebKit
Apple Safari

How to mitigate CVE-2023-23496

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

macOS - update to 13.2 22D49
watchOS - update to 9.3 20S648
Apple Safari - update to 16.3
Apple iOS - addressed in versions 15.7.2 19H218, 16.3 20D47
iPadOS - addressed in versions 15.7.2 19H218, 16.3 20D47
tvOS - update to 16.3 20K650

External References

Related Security Bulletins