CVE-2023-41993 : The issue was addressed with improved checks. This issue is fixed in macOS Sonom

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Published 2023-09-21 19:15:12

Updated 2024-11-29 14:43:21

Source Apple Inc.

View at NVD, CVE.org

Products affected by CVE-2023-41993

Debian » Debian Linux » Version: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 12.0
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
Matching versions
Apple » Iphone Os
Versions before (<) 17.0.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Matching versions
Apple » Macos
Versions before (<) 14.0
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Matching versions
Apple » Ipados
Versions before (<) 17.0.1
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Matching versions
Oracle » JDK » Version: 1.8.0 Update Update401
cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:*
Matching versions
Oracle » JRE » Version: 1.8.0 Update Update401
cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:*
Matching versions
Oracle » Graalvm » Version: 20.3.13 Enterprise Edition
cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*
Matching versions
Oracle » Graalvm » Version: 21.3.9 Enterprise Edition
cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 39
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Workflow Automation » Version: N/A
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Insight » Version: N/A
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Windows
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Matching versions
Netapp » Active Iq Unified Manager » Version: N/A For Vsphere
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
Matching versions
Netapp » Cloud Insights Acquisition Unit » Version: N/A
cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*
Matching versions
Netapp » Cloud Insights Storage Workload Security Agent » Version: N/A
cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
Matching versions
Webkitgtk » Webkitgtk+
Versions before (<) 2.42.2
cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*
Matching versions

CVE-2023-41993 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Apple Multiple Products WebKit Code Execution Vulnerability

CISA required action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description:

Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on

Notes:

https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213930; https://nvd.nist.gov/vuln/detail/CVE-2023-41993

Added on 2023-09-25 Action due date 2023-10-16

Exploit prediction scoring system (EPSS) score for CVE-2023-41993

EPSS FAQ

0.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 70 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-41993

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-07-03
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST	2024-08-14
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-41993

CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2023-41993

https://support.apple.com/en-us/HT213927

About the security content of iOS 16.7 and iPadOS 16.7 - Apple Support
Release Notes;Vendor Advisory

CVEs referencing this url
https://support.apple.com/en-us/HT213941

About the security content of Safari 17 - Apple Support
Release Notes;Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2023/Sep/19

Full Disclosure: APPLE-SA-2023-09-21-6 macOS Ventura 13.6
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/

[SECURITY] Fedora 37 Update: webkitgtk-2.42.1-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List

CVEs referencing this url
https://support.apple.com/en-us/HT213926

About the security content of iOS 17.0.1 and iPadOS 17.0.1 - Apple Support
Vendor Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2023/Oct/3

Full Disclosure: APPLE-SA-09-26-2023-2 macOS Sonoma 14
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EYRHTFVN6FTXLZ27IPTNRSXKBAR2SOMA/

[SECURITY] Fedora 38 Update: webkitgtk-2.42.1-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://support.apple.com/en-us/HT213931

About the security content of macOS Ventura 13.6 - Apple Support

CVEs referencing this url
https://support.apple.com/en-us/HT213930

About the security content of Safari 16.6.1 - Apple Support
Vendor Advisory
https://support.apple.com/kb/HT213926

About the security content of iOS 17.0.1 and iPadOS 17.0.1 - Apple Support

CVEs referencing this url
https://www.debian.org/security/2023/dsa-5527

Debian -- Security Information -- DSA-5527-1 webkit2gtk
Third Party Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2023/Oct/2

Full Disclosure: APPLE-SA-09-26-2023-1 Safari 17
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ELXBV26Q54BIOVN5LBCJFM2G6VQZ7FO/

[SECURITY] Fedora 39 Update: webkitgtk-2.42.1-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://support.apple.com/en-us/HT213940

About the security content of macOS Sonoma 14 - Apple Support
Vendor Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2023/09/28/3

oss-security - WebKitGTK and WPE WebKit Security Advisory WSA-2023-0009
Mailing List;Third Party Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2023/Sep/13

Full Disclosure: APPLE-SA-2023-09-21-1 Safari 16.6.1
Third Party Advisory
https://support.apple.com/kb/HT213930

About the security content of Safari 16.6.1 - Apple Support
http://seclists.org/fulldisclosure/2023/Oct/4

Full Disclosure: APPLE-SA-09-26-2023-3 Additional information for APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7
Mailing List;Third Party Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2023/Sep/14

Full Disclosure: APPLE-SA-2023-09-21-2 iOS 17.0.1 and iPadOS 17.0.1
Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202401-33

WebKitGTK+: Multiple Vulnerabilities (GLSA 202401-33) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://webkitgtk.org/security/WSA-2023-0009.html

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0009 - The WebKitGTK Project
Third Party Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2023/Sep/15

Full Disclosure: APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20240426-0004/

April 2024 Java Platform Standard Edition Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url