HIGH

CVE-2023-28205

Apple Safari 2023-04-10 CVSS v3.1

CVSS

8.8

KEV

Description

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Summary dbcve.org

A use-after-free vulnerability in WebKit allows processing of maliciously crafted web content to lead to arbitrary code execution. The vulnerability stems from improper memory management where memory is accessed after being freed, which can be exploited to achieve code execution. This is actively exploited in the wild as a zero-day.

Mitigation

Apply the available security updates: Safari 16.4.1, iOS/iPadOS 15.7.5 or 16.4.1, or macOS Ventura 13.3.1 to address the vulnerability.

Weakness (CWE)

CWE-416 Use After Free

EPSS Score

27.08%

Probability of exploitation in next 30 days

98th percentile

References

https://support.apple.com/en-us/HT213720 Release Notes https://support.apple.com/en-us/HT213721 Release Notes https://support.apple.com/en-us/HT213722 Release Notes https://support.apple.com/en-us/HT213723 Release Notes https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28205 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE