The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Safari | Apple | * | 17.0 (excluding) |
| Ipados | Apple | * | 17.0 (excluding) |
| Iphone_os | Apple | * | 17.0 (excluding) |
| Macos | Apple | * | 14.0 (excluding) |
| Tvos | Apple | * | 17.0 (excluding) |
| Watchos | Apple | * | 10.0 (excluding) |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | RedHat | webkitgtk4-0:2.48.3-2.el7_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | webkit2gtk3-0:2.38.5-1.el8_8.5 | * |
| Red Hat Enterprise Linux 9 | RedHat | webkit2gtk3-0:2.38.5-1.el9_2.3 | * |
| Qtwebkit-opensource-src | Ubuntu | bionic | * |
| Qtwebkit-opensource-src | Ubuntu | devel | * |
| Qtwebkit-opensource-src | Ubuntu | esm-apps/bionic | * |
| Qtwebkit-opensource-src | Ubuntu | esm-apps/focal | * |
| Qtwebkit-opensource-src | Ubuntu | esm-apps/jammy | * |
| Qtwebkit-opensource-src | Ubuntu | esm-apps/noble | * |
| Qtwebkit-opensource-src | Ubuntu | esm-infra/xenial | * |
| Qtwebkit-opensource-src | Ubuntu | focal | * |
| Qtwebkit-opensource-src | Ubuntu | jammy | * |
| Qtwebkit-opensource-src | Ubuntu | lunar | * |
| Qtwebkit-opensource-src | Ubuntu | mantic | * |
| Qtwebkit-opensource-src | Ubuntu | noble | * |
| Qtwebkit-opensource-src | Ubuntu | trusty | * |
| Qtwebkit-opensource-src | Ubuntu | upstream | * |
| Qtwebkit-opensource-src | Ubuntu | xenial | * |
| Qtwebkit-source | Ubuntu | bionic | * |
| Qtwebkit-source | Ubuntu | esm-apps/bionic | * |
| Qtwebkit-source | Ubuntu | esm-apps/xenial | * |
| Qtwebkit-source | Ubuntu | trusty | * |
| Qtwebkit-source | Ubuntu | xenial | * |
| Webkit2gtk | Ubuntu | bionic | * |
| Webkit2gtk | Ubuntu | esm-infra/bionic | * |
| Webkit2gtk | Ubuntu | esm-infra/focal | * |
| Webkit2gtk | Ubuntu | esm-infra/xenial | * |
| Webkit2gtk | Ubuntu | focal | * |
| Webkit2gtk | Ubuntu | jammy | * |
| Webkit2gtk | Ubuntu | lunar | * |
| Webkit2gtk | Ubuntu | upstream | * |
| Webkit2gtk | Ubuntu | xenial | * |
| Webkitgtk | Ubuntu | bionic | * |
| Webkitgtk | Ubuntu | esm-apps/bionic | * |
| Webkitgtk | Ubuntu | esm-apps/xenial | * |
| Webkitgtk | Ubuntu | trusty | * |
| Webkitgtk | Ubuntu | xenial | * |
| Wpewebkit | Ubuntu | bionic | * |
| Wpewebkit | Ubuntu | esm-apps/focal | * |
| Wpewebkit | Ubuntu | esm-apps/jammy | * |
| Wpewebkit | Ubuntu | focal | * |
| Wpewebkit | Ubuntu | jammy | * |
| Wpewebkit | Ubuntu | trusty | * |
| Wpewebkit | Ubuntu | xenial | * |
References
- http://seclists.org/fulldisclosure/2023/Oct/10
- http://seclists.org/fulldisclosure/2023/Oct/2
- http://seclists.org/fulldisclosure/2023/Oct/3
- http://seclists.org/fulldisclosure/2023/Oct/8
- http://seclists.org/fulldisclosure/2023/Oct/9
- http://www.openwall.com/lists/oss-security/2023/09/28/3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/
- https://security.gentoo.org/glsa/202401-33
- https://support.apple.com/en-us/HT213936
- https://support.apple.com/en-us/HT213937
- https://support.apple.com/en-us/HT213938
- https://support.apple.com/en-us/HT213940
- https://support.apple.com/en-us/HT213941
- http://seclists.org/fulldisclosure/2023/Oct/10
- http://seclists.org/fulldisclosure/2023/Oct/2
- http://seclists.org/fulldisclosure/2023/Oct/3
- http://seclists.org/fulldisclosure/2023/Oct/8
- http://seclists.org/fulldisclosure/2023/Oct/9
- http://www.openwall.com/lists/oss-security/2023/09/28/3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/
- https://security.gentoo.org/glsa/202401-33
- https://support.apple.com/en-us/HT213936
- https://support.apple.com/en-us/HT213937
- https://support.apple.com/en-us/HT213938
- https://support.apple.com/en-us/HT213940
- https://support.apple.com/en-us/HT213941
- https://webkitgtk.org/security/WSA-2023-0009.html