高危
Apple iOS, iPadOS, macOS和Safari WebKit类型混淆漏洞
2023-06-23 00:00:00 公开 ，2026-02-27 07:40:19 更新
- 关键漏洞
- CISA KEV
- 远程
- 无需认证
- 开源组件漏洞
- CWE Top 25 (2023)
- CWE Top 25 (2024)
- 公开PoC
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2024-01-09 23:34:08
风险信息
- CVSS v3 向量
- AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 8.8
- CVSS v3.1 向量
- AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 8.8
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- APPLE iOS和iPadOS可能允许远程攻击者在系统上执行任意代码，这是由WebKit组件中的类型混淆引起的。通过说服受害者访问特制的网站，远程攻击者可以利用此漏洞在系统上执行任意代码。
- 修复建议
- 此问题在iOS 16.5.1和iPadOS 16.5.1、Safari 16.5.1、macOS Ventura 13.4.1、iOS 15.7.7和iPadOS15.7.7中得到修复，有关补丁、升级或建议的解决方法信息，请参阅苹果安全文档HT213811： https://support.apple.com/en-us/HT213811 https://support.apple.com/en-us/HT213813 https://support.apple.com/en-us/HT213814 https://support.apple.com/en-us/HT213816
参考链接
- https://support.apple.com/en-us/HT213811
Snyk · Release Notes · Vendor Advisory
- https://support.apple.com/en-us/HT213816
OSV · Release Notes · Vendor Advisory
- https://support.apple.com/en-us/HT213814
OSV · Release Notes · Vendor Advisory
- https://support.apple.com/en-us/HT213813
OSV · Release Notes · Vendor Advisory
- https://support.apple.com/kb/HT213814
OSV · Vendor Advisory
- https://support.apple.com/kb/HT213816
OSV · Vendor Advisory
- https://security.gentoo.org/glsa/202401-04
OSV · Third Party Advisory
- https://errata.rockylinux.org/RLSA-2023:4201
OSV
- https://bugzilla.redhat.com/show_bug.cgi?id=2218626
OSV
- https://bugzilla.redhat.com/show_bug.cgi?id=2218640
OSV
- https://osv.dev/vulnerability/RLSA-2023:4201
OSV
- https://errata.rockylinux.org/RLSA-2023:4202
OSV
- https://osv.dev/vulnerability/RLSA-2023:4202
OSV
- https://access.redhat.com/errata/RHSA-2023:4201
OSV
- https://access.redhat.com/security/cve/CVE-2023-32435
OSV
- https://access.redhat.com/security/cve/CVE-2023-32439
OSV
- https://bugzilla.redhat.com/2218626
OSV
- https://bugzilla.redhat.com/2218640
OSV
- https://errata.almalinux.org/9/ALSA-2023-4201.html
OSV
- https://osv.dev/vulnerability/ALSA-2023:4201
OSV
- https://access.redhat.com/errata/RHSA-2023:4202
OSV
- https://errata.almalinux.org/8/ALSA-2023-4202.html
OSV
- https://osv.dev/vulnerability/ALSA-2023:4202
OSV
- https://osv.dev/vulnerability/DSA-5449-1
OSV
- https://github.com/WebKit/WebKit/pull/13677
Snyk
- https://bugs.webkit.org/show_bug.cgi?id=256567
Snyk
- https://github.com/WebKit/WebKit/commit/52fe95e5805c735cc1fa4d6200fcaa1912efbfea
Snyk
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Snyk
- https://osv.dev/vulnerability/CVE-2023-32439
OSV
- https://security-tracker.debian.org/tracker/CVE-2023-32439
OSV
- https://ubuntu.com/security/CVE-2023-32439
OSV
- https://webkitgtk.org/security/WSA-2023-0005.html
OSV
- https://ubuntu.com/security/notices/USN-6264-1
OSV
- https://www.cve.org/CVERecord?id=CVE-2023-32439
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2023-32439
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2023-32439
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32439
NVD · US Government Resource