Vulnerability Details : CVE-2023-28205
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Vulnerability category: Memory Corruption
CVE-2023-28205 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Apple Multiple Products WebKit Use-After-Free Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content.
Notes:
https://support.apple.com/en-us/HT213720,https://support.apple.com/en-us/HT213721,https://support.apple.com/en-us/HT213722,https://support.apple.com/en-us/HT213723
Added on
2023-04-10
Action due date
2023-05-01
Exploit prediction scoring system (EPSS) score for CVE-2023-28205
Probability of exploitation activity in the next 30 days: 0.28%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 68 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2023-28205
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2023-28205
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-28205
-
https://security.gentoo.org/glsa/202305-32
WebKitGTK+: Multiple Vulnerabilities (GLSA 202305-32) — Gentoo security
-
https://support.apple.com/en-us/HT213722
About the security content of Safari 16.4.1 - Apple SupportRelease Notes
-
https://lists.debian.org/debian-lts-announce/2023/05/msg00011.html
[SECURITY] [DLA 3419-1] webkit2gtk security update
-
https://support.apple.com/en-us/HT213720
About the security content of iOS 16.4.1 and iPadOS 16.4.1 - Apple SupportRelease Notes
-
https://support.apple.com/en-us/HT213721
About the security content of macOS Ventura 13.3.1 - Apple SupportRelease Notes
-
https://support.apple.com/en-us/HT213723
About the security content of iOS 15.7.5 and iPadOS 15.7.5 - Apple SupportRelease Notes
Products affected by CVE-2023-28205
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*