Use-after-free in WebKitGTK+ and WPE WebKit - CVE-2023-41976

Vulnerability identifier: #VU82395

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-41976

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to open a specially crafted website, trigger a use-after-free error and execute arbitrary code on the target system.

WebKitGTK+
WPE WebKit
watchOS
macOS
iPadOS
Apple iOS
tvOS
Apple Safari

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

watchOS - update to 10.1
macOS - update to 14.1 23B74
iPadOS - addressed in versions 16.7.2, 17.1
Apple iOS - addressed in versions 16.7.2 20H115, 17.1 21B74, 17.1 21B80
Apple Safari - update to 17.1
tvOS - update to 17.1

• https://support.apple.com/en-us/HT213986

• Multiple vulnerabilities in WebKitGTK+ and WPE WebKit
• Multiple vulnerabilities in Apple Safari 17
• Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
• Multiple vulnerabilities in Apple iOS 17 and iPadOS 17
• Multiple vulnerabilities in Apple tvOS 17
• Multiple vulnerabilities in Apple watchOS 10
• Multiple vulnerabilities in Apple macOS Sonoma