CVE-2023-28205 : A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 a

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Published 2023-04-10 19:15:07

Updated 2023-07-27 04:15:23

Source Apple Inc.

View at NVD, CVE.org

Vulnerability category: Memory Corruption

CVE-2023-28205 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Apple Multiple Products WebKit Use-After-Free Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content.

Notes:

https://support.apple.com/en-us/HT213720,https://support.apple.com/en-us/HT213721,https://support.apple.com/en-us/HT213722,https://support.apple.com/en-us/HT213723

Added on 2023-04-10 Action due date 2023-05-01

Exploit prediction scoring system (EPSS) score for CVE-2023-28205

Probability of exploitation activity in the next 30 days: 0.28%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 68 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2023-28205

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-28205

CWE-416 Use After Free

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-28205

https://security.gentoo.org/glsa/202305-32

WebKitGTK+: Multiple Vulnerabilities (GLSA 202305-32) — Gentoo security

CVEs referencing this url
https://support.apple.com/en-us/HT213722

About the security content of Safari 16.4.1 - Apple Support
Release Notes
https://lists.debian.org/debian-lts-announce/2023/05/msg00011.html

[SECURITY] [DLA 3419-1] webkit2gtk security update

CVEs referencing this url
https://support.apple.com/en-us/HT213720

About the security content of iOS 16.4.1 and iPadOS 16.4.1 - Apple Support
Release Notes

CVEs referencing this url
https://support.apple.com/en-us/HT213721

About the security content of macOS Ventura 13.3.1 - Apple Support
Release Notes

CVEs referencing this url
https://support.apple.com/en-us/HT213723

About the security content of iOS 15.7.5 and iPadOS 15.7.5 - Apple Support
Release Notes

CVEs referencing this url

Products affected by CVE-2023-28205