IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek KEV

CVE-2023-41993Apple Multiple Products WebKit Code Execution Vulnerability

Apple macOS; apple iphone_os; apple ipad_os; apple macos Yayım: (3 yıl önce)

Aktif olarak istismar ediliyor — Apple Multiple Products WebKit Code Execution Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 25.09.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 16.10.2023.

Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213930; https://nvd.nist.gov/vuln/detail/CVE-2023-41993

Açıklama

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Zayıflık türü (CWE): CWE-754

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
apple ipad_os < 17.0.1
apple ipados < 17.0.1
apple iphone_os < 17.0.1
Apple macOS unspecified – < 14
debian debian_linux 11.0, 12.0
fedoraproject fedora 37
netapp active iq unified manager —
netapp cloud_insights_acquisition_unit 0
netapp cloud_insights_storage_workload_security_agent 0
netapp oncommand_insight 0
netapp oncommand_workflow_automation 0
oracle graalvm 20.3.13
oracle jdk 1.8.0
oracle jre 1.8.0
webkitgtk webkitgtk+ < 2.42.2

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (19)
  • cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* < 17.0.1
  • cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* < 17.0.1
  • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* < 14.0
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
  • cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
  • cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:* < 2.42.2

Aynı üründe son açıklar — Debian

9.2Kritik
CVE-2026-111497 KEV

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Calibre; Siemens Calibre ICE; Siemens Capital

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS
8.4Yüksek
CVE-2026-77118

Out-of-bounds write in GraphicsMagick PCD decoder

GraphicsMagick Group GraphicsMagick; Debian graphicsmagick; Fedora Project GraphicsMagick

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated…

6.0Orta
CVE-2026-12996
OpenVPN OpenVPN

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

3.7Düşük
CVE-2026-56968
GNU GNU SASL

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

7.5Yüksek
CVE-2026-49975

Apache HTTP Server: mod_http2 denial of service

Apache Software Foundation Apache HTTP Server; Red Hat JBoss Core Services for RHEL 8; Red Hat JBoss Core Services on RHEL 7; Red Hat Red Hat Enterprise Linux 10

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

33%EPSS