Apple has released security advisories to address a vulnerability in WebKit. The vulnerability has been assigned with the CVE-2023-23529. It affects multiple devices, including macOS, iPadOS, and iOS.
Apple has mentioned in its advisory that they are aware of a report that the CVE-2023-23529 may have been actively exploited. The zero-day vulnerability might be used in attacks to hack iPhones, iPads, and Macs.
CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog, urging its users to patch it as soon as possible.
WebKit is a fast open-source web browser engine used by Safari, Mail, App Store, and many other apps on macOS, iOS, and Linux.
Description
Apple has patched the type confusion vulnerability with improved checks. On successful exploitation, this vulnerability could allow an attacker to process maliciously crafted web content that may lead to arbitrary code execution.
Along with the zero-day CVE-2023-23529, Apple also addressed some other vulnerabilities in iOS and macOS.
CVE-2023-23514: This use-after-free vulnerability may allow an attacker to execute arbitrary code with kernel privileges. The vulnerability is addressed with improved memory management.
CVE-2023-23522: This is a privacy issue due to which an app may be able to observe unprotected user data. The vulnerability is addressed with improved handling of temporary files.
Affected versions
- iPhone 8 and later
- iPad Pro (all models)
- iPad 5th generation and later
- Safari Versions Prior to 16.3.1
- iPad Air 3rd generation and later
- iPad mini 5th generation and later
- macOS Ventura Versions Prior to 13.2.1
Mitigation
Customers are requested to upgrade to the latest versions of macOS Ventura 13.2.1, Safari 16.3.1, iOS 16.3.1, and iPadOS 16.3.1 to patch the vulnerability.
For more information, please visit the Apple security advisories HT213633, HT213635, and HT213638.
Qualys Detection
Qualys customers can scan their devices with QIDs 377967, 377968, and 610469 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
References
https://support.apple.com/en-us/HT213633
https://support.apple.com/en-us/HT213635
https://support.apple.com/en-us/HT213638
