HIGH

CVE-2022-32893

Apple Safari 2022-08-24 CVSS v3.1

CVSS

8.8

KEV

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Summary dbcve.org

An out-of-bounds write vulnerability in WebKit (Safari's browser engine) allows arbitrary code execution when processing maliciously crafted web content. This was a zero-day vulnerability actively exploited before Apple released patches in iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1.

Mitigation

Apply the available security updates immediately to all affected Apple devices (iOS/iPadOS 15.6.1+, macOS 12.5.1+, Safari 15.6.1+) and consider restricting browser usage until patches are deployed.

Weakness (CWE)

CWE-787 Out-of-bounds Write

EPSS Score

9.93%

Probability of exploitation in next 30 days

95.4th percentile

References

http://seclists.org/fulldisclosure/2022/Aug/16 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Oct/49 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/08/25/5 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/08/26/2 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/08/29/1 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/08/29/2 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/09/02/10 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/09/13/1 Mailing List, Third Party Advisory https://lists.debian.org/debian-lts-announce/2022/08/msg00019.html Mailing List, Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7SETAAXEPGNBMYKTUDFEZHS5LGSQ64QL/ Broken Link https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKJGV2EXVMYQW3OAJNI4WUTKKVMD2YYK/ Broken Link https://security.gentoo.org/glsa/202208-39 Third Party Advisory https://support.apple.com/en-us/HT213412 Vendor Advisory https://support.apple.com/en-us/HT213413 Vendor Advisory https://support.apple.com/en-us/HT213414 Vendor Advisory https://www.debian.org/security/2022/dsa-5219 Mailing List, Third Party Advisory https://www.debian.org/security/2022/dsa-5220 Mailing List, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-32893 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.