高危
APPLE IOS WebKit类型混淆漏洞(CVE-2022-42856)
2022-12-15 00:00:00 公开 ，2026-02-27 03:26:03 更新
- 关键漏洞
- CISA KEV
- 远程
- 无需认证
- 开源组件漏洞
- 公开PoC
- CWEs：
- CWE-843 （Type Confusion）
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-01-29 05:34:19
风险信息
- CVSS v3 向量
- AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 8.8
- CVSS v3.1 向量
- AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 8.8
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- Apple Safari、tvOS、macOS Ventura、iOS和iPadOS可能允许远程攻击者在系统上执行任意代码，这是由WebKit组件中的类型混淆缺陷造成的。通过说服受害者打开精心制作的web内容，攻击者可以利用此漏洞在系统上执行任意代码。苹果公司了解到一份报告，该问题可能已被iOS 15.1之前发布的iOS版本积极利用。
- 修复建议
- Safari 16.2、tvOS 16.2、macOS Ventura 13.1、iOS 15.7.2和iPadOS 15.7.2、iOS 16.1.2中已修复此问题。有关修补程序、升级或建议的解决方法信息，请参阅Apple安全文档HT213537和HT213516： https://support.apple.com/en-us/HT213516 https://support.apple.com/en-us/HT213537
参考链接
- https://support.apple.com/en-us/HT213535
NVD · Vendor Advisory · Release Notes
- https://support.apple.com/en-us/HT213532
NVD · Vendor Advisory · Release Notes
- https://support.apple.com/en-us/HT213531
NVD · Vendor Advisory · Release Notes
- https://support.apple.com/en-us/HT213516
NVD · Vendor Advisory · Release Notes
- https://support.apple.com/en-us/HT213537
NVD · Vendor Advisory · Release Notes
- http://seclists.org/fulldisclosure/2022/Dec/21
NVD · mailing-list
- http://seclists.org/fulldisclosure/2022/Dec/23
NVD · mailing-list
- http://seclists.org/fulldisclosure/2022/Dec/22
NVD · mailing-list
- http://seclists.org/fulldisclosure/2022/Dec/26
NVD · mailing-list
- http://seclists.org/fulldisclosure/2022/Dec/28
NVD · mailing-list
- http://www.openwall.com/lists/oss-security/2022/12/26/1
NVD · mailing-list
- https://security.gentoo.org/glsa/202305-32
NVD · Third Party Advisory
- https://osv.dev/vulnerability/DLA-3274-1
OSV
- https://errata.rockylinux.org/RLSA-2023:0021
OSV
- https://bugzilla.redhat.com/show_bug.cgi?id=2153683
OSV
- https://osv.dev/vulnerability/RLSA-2023:0021
OSV
- https://errata.rockylinux.org/RLSA-2023:0016
OSV
- https://osv.dev/vulnerability/RLSA-2023:0016
OSV
- https://access.redhat.com/errata/RHSA-2023:0016
OSV
- https://access.redhat.com/security/cve/CVE-2022-42856
OSV
- https://bugzilla.redhat.com/2153683
OSV
- https://errata.almalinux.org/8/ALSA-2023-0016.html
OSV
- https://osv.dev/vulnerability/ALSA-2023:0016
OSV
- https://access.redhat.com/errata/RHSA-2023:0021
OSV
- https://errata.almalinux.org/9/ALSA-2023-0021.html
OSV
- https://osv.dev/vulnerability/ALSA-2023:0021
OSV
- https://osv.dev/vulnerability/DSA-5308-1
OSV
- https://osv.dev/vulnerability/DSA-5309-1
OSV
- https://ubuntu.com/security/CVE-2022-42856
OSV
- https://ubuntu.com/security/notices/USN-5797-1
OSV
- https://www.cve.org/CVERecord?id=CVE-2022-42856
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2022-42856
OSV
- https://security-tracker.debian.org/tracker/CVE-2022-42856
OSV
- https://osv.dev/vulnerability/CVE-2022-42856
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2022-42856
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42856
NVD · US Government Resource