SB2023040801 - Multiple vulnerabilities in Apple iOS 16 and iPadOS 16

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023040801

SB2023040801 - Multiple vulnerabilities in Apple iOS 16 and iPadOS 16

Published: April 8, 2023 Updated: December 6, 2024

Security Bulletin ID SB2023040801
Severity
Critical
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 50% High 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2023-28206)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in IOSurfaceAccelerator. A local application can trigger an out-of-bounds write and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.


2) Use-after-free (CVE-ID: CVE-2023-28205)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to open a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

References