What is CVE-2023-42916?

CVE-2023-42916 is a medium-severity vulnerability affecting various Apple systems, including Safari, iOS, iPadOS, macOS, and Apple Watch Series 4 and later devices running watchOS 10.2. This issue, which involves an out-of-bounds read, has been addressed with improved input validation. However, processing web content may still disclose sensitive information, and there have been reports of exploitation against earlier iOS versions.

Who is impacted by CVE-2023-42916?

Specifically, it impacts Safari versions up to 17.1.1, iPadOS versions up to 17.1.1, iOS versions up to 17.1.1, macOS versions from 14.0 to 14.1.1, and watchOS versions before 10.2. This issue may lead to the disclosure of sensitive information when processing web content.

What should I do if I’m affected by this?

If you're affected by the CVE-2023-42916 vulnerability, it's crucial to update your devices to the latest software versions. Follow these steps:

1. Update Safari to version 17.1.2 or later.

2. Update iOS and iPadOS to version 17.1.2 or later.

3. Update macOS to version 14.1.2 or later.

4. Update Apple Watch Series 4 and later to watchOS 10.2 or later. See Apple's support page for instructions.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-42916 vulnerability, known as Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-125, an out-of-bounds read issue affecting Apple products.

Learn More

For comprehensive information on this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Apple Product Security via Fulldisclosure