Information disclosure in iPadOS and Apple iOS - CVE-2023-41997
Published: October 25, 2023
Vulnerability identifier: #VU82412
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-41997
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a attacker to gain access to potentially sensitive information.
The vulnerability exists due to certain Siri options are present on the locked screen. An attacker with physical access to device can gain access to sensitive information.
Affected software
iPadOS
Apple iOS
watchOS
macOS
Apple iOS
watchOS
macOS
How to mitigate CVE-2023-41997
Install updates from vendor's website.
iPadOS - addressed in versions 16.7.2, 17.1
Apple iOS - addressed in versions 16.7.2 20H115, 17.1 21B74, 17.1 21B80
watchOS - update to 10.1
macOS - update to 14.1 23B74
Apple iOS - addressed in versions 16.7.2 20H115, 17.1 21B74, 17.1 21B80
watchOS - update to 10.1
macOS - update to 14.1 23B74