CVE-2023-41074CWE-94code-injection

CVE-2023-41074

High · published September 27, 2023

CVSS v3.1
8.8
EPSS
4%
Percentile
90.8
In the wild
Unconfirmed
What it is

The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04122 · 90.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-09-27T19:19Z
Affected products (9)
ProductVersionsFixed in
apple/safari< 17.017.0
apple/ipados< 17.017.0
apple/iphone_os< 17.017.0
apple/macos< 14.014.0
apple/tvos< 17.017.0
apple/watchos< 10.010.0
debian/debian_linuxall versions—
debian/debian_linuxall versions—
fedoraproject/fedoraall versions—
References (29)
http://seclists.org/fulldisclosure/2023/Oct/10 · [email protected]http://seclists.org/fulldisclosure/2023/Oct/2 · [email protected]http://seclists.org/fulldisclosure/2023/Oct/3 · [email protected]http://seclists.org/fulldisclosure/2023/Oct/8 · [email protected]http://seclists.org/fulldisclosure/2023/Oct/9 · [email protected]http://www.openwall.com/lists/oss-security/2023/09/28/3 · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/ · [email protected]https://security.gentoo.org/glsa/202401-33 · [email protected]https://support.apple.com/en-us/HT213936 · [email protected]https://support.apple.com/en-us/HT213937 · [email protected]https://support.apple.com/en-us/HT213938 · [email protected]https://support.apple.com/en-us/HT213940 · [email protected]https://support.apple.com/en-us/HT213941 · [email protected]https://www.debian.org/security/2023/dsa-5527 · [email protected]http://seclists.org/fulldisclosure/2023/Oct/10 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2023/Oct/2 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2023/Oct/3 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2023/Oct/8 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2023/Oct/9 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/09/28/3 · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202401-33 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/en-us/HT213936 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/en-us/HT213937 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/en-us/HT213938 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/en-us/HT213940 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/en-us/HT213941 · af854a3a-2127-422b-91ae-364da2661108https://webkitgtk.org/security/WSA-2023-0009.html · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5527 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 26 SEP 20:14Z
    The issue was addressed with improved checks
    cvelistv5