Description
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apple | macOS | unspecified – < 13.4 | 13.4 |
| Apple | Safari | unspecified – < 16.5 | 16.5 |
| Apple | watchOS | unspecified – < 9.5 | 9.5 |
| Apple | iOS and iPadOS | unspecified – < 15.7, unspecified – < 16.5 | 15.7 |
| Apple | tvOS | unspecified – < 16.5 | 16.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wpewebkit +1 | 2.42.0-1 | — |
| Debian 13 | wpewebkit +1 | 2.42.0-1 | — |
| Debian 12 | webkit2gtk | 2.42.0-1 | — |
| Debian 12 | wpewebkit | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | qtwebkit-opensource-src | No fix yet | — |
| Ubuntu 22.04 LTS | wpewebkit +1 | No fix yet | — |
| Ubuntu 20.04 LTS | wpewebkit +1 | No fix yet | — |
| Ubuntu 18.04 LTS | qtwebkit-source +1 | No fix yet | — |
| Ubuntu 16.04 LTS | qtwebkit-source +1 | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | webkitgtk4 +3 | 2.38.5-3.amzn2.0.1 | ALAS2-2023-2088 |
Advisories 4
- ALAS2-2023-2088 Important: webkitgtk4 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 28, 2024
- WID-SEC-2023-1251 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 19, 2024
- WID-SEC-2023-1252 Apple iOS/iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 7, 2023
- WID-SEC-2023-1246 Apple Safari: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023