HIGH

CVE-2022-42856

Apple Safari 2022-12-15 CVSS v3.1

CVSS

8.8

KEV

Description

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..

Summary dbcve.org

A type confusion vulnerability in WebKit allows arbitrary code execution when processing maliciously crafted web content. This client-side flaw affects Safari, iOS, iPadOS, tvOS, and macOS. It was actively exploited in the wild against iOS versions before 15.1.

Mitigation

Apply vendor-supplied patches: update to Safari 16.2, iOS/iPadOS 15.7.2 or 16.1.2+, tvOS 16.2, or macOS Ventura 13.1. Prioritize mobile devices given confirmed in-the-wild exploitation.

Weakness (CWE)

CWE-843 Type Confusion

EPSS Score

8.52%

Probability of exploitation in next 30 days

94.8th percentile

References

http://seclists.org/fulldisclosure/2022/Dec/21 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Dec/22 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Dec/23 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Dec/26 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Dec/28 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2022/12/26/1 Mailing List, Third Party Advisory https://security.gentoo.org/glsa/202305-32 Third Party Advisory https://support.apple.com/en-us/HT213516 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213531 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213532 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213535 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213537 Release Notes, Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42856 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE