Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2023-AVI-0806
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Apple. Elles permettent à un attaquant de provoquer une élévation de privilèges et une exécution de code arbitraire.
L'éditeur a connaissance d'un rapport indiquant que la vulnérabilité est activement exploitée.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneReferences
Title | Publication Time | Tags | |||
---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "iOS 17.0.3", "product": { "name": "N/A", "vendor": { "name": "Apple", "scada": false } } }, { "description": "iPadOS 17.0.3", "product": { "name": "N/A", "vendor": { "name": "Apple", "scada": false } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2023-42824", "url": "https://www.cve.org/CVERecord?id=CVE-2023-42824" }, { "name": "CVE-2023-5217", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5217" } ], "initial_release_date": "2023-10-05T00:00:00", "last_revision_date": "2023-10-05T00:00:00", "links": [], "reference": "CERTFR-2023-AVI-0806", "revisions": [ { "description": "Version initiale", "revision_date": "2023-10-05T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire" }, { "description": "\u00c9l\u00e9vation de privil\u00e8ges" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Apple\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et une ex\u00e9cution de\ncode arbitraire.\n\nL\u0027\u00e9diteur a connaissance d\u0027un rapport indiquant que la vuln\u00e9rabilit\u00e9 est\nactivement exploit\u00e9e.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Apple HT213961 du 04 octobre 2023", "url": "https://support.apple.com/en-us/HT213961" } ] }
CVE-2023-42824 (GCVE-0-2023-42824)
Vulnerability from cvelistv5
Published
2023-10-04 18:02
Modified
2025-10-21 23:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
Summary
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Apple | iOS and iPadOS |
Version: unspecified < 16.7 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:30:24.664Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT213972" } ], "title": "CVE Program Container" }, { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2023-42824", "options": [ { "Exploitation": "active" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2023-11-15T16:38:08.096312Z", "version": "2.0.3" }, "type": "ssvc" } }, { "other": { "content": { "dateAdded": "2023-10-05", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42824" }, "type": "kev" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-10-21T23:05:35.359Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "government-resource" ], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42824" } ], "timeline": [ { "lang": "en", "time": "2023-10-05T00:00:00+00:00", "value": "CVE-2023-42824 added to CISA KEV" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6." } ], "problemTypes": [ { "descriptions": [ { "description": "A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2023-10-25T18:32:11.941Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT213972" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-42824", "datePublished": "2023-10-04T18:02:20.884Z", "dateReserved": "2023-09-14T19:05:11.447Z", "dateUpdated": "2025-10-21T23:05:35.359Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2023-5217 (GCVE-0-2023-5217)
Vulnerability from cvelistv5
Published
2023-09-28 15:23
Modified
2025-10-21 23:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Heap buffer overflow
Summary
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:52:08.351Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html" }, { "tags": [ "x_transferred" ], "url": "https://crbug.com/1486441" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/28/5" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/28/6" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/1" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/2" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/7" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/9" }, { "tags": [ "x_transferred" ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/" }, { "tags": [ "x_transferred" ], "url": "https://security-tracker.debian.org/tracker/CVE-2023-5217" }, { "tags": [ "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241191" }, { "tags": [ "x_transferred" ], "url": "https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/" }, { "tags": [ "x_transferred" ], "url": "https://www.openwall.com/lists/oss-security/2023/09/28/5" }, { "tags": [ "x_transferred" ], "url": "https://pastebin.com/TdkC4pDv" }, { "tags": [ "x_transferred" ], "url": "https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590" }, { "tags": [ "x_transferred" ], "url": "https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282" }, { "tags": [ "x_transferred" ], "url": "https://github.com/webmproject/libvpx/tags" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/11" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/12" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/14" }, { "tags": [ "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5510" }, { "tags": [ "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5509" }, { "tags": [ "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5508" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/1" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html" }, { "tags": [ "x_transferred" ], "url": "https://twitter.com/maddiestone/status/1707163313711497266" }, { "tags": [ "x_transferred" ], "url": "https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/" }, { "tags": [ "x_transferred" ], "url": "https://github.com/webmproject/libvpx/releases/tag/v1.13.1" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/3" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/2" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/4" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/5" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/01/2" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/01/1" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/01/5" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/02/6" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/03/11" }, { "tags": [ "x_transferred" ], "url": "https://security.gentoo.org/glsa/202310-04" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213961" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2023/Oct/12" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213972" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2023/Oct/16" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/" }, { "tags": [ "x_transferred" ], "url": "https://security.gentoo.org/glsa/202401-34" } ], "title": "CVE Program Container" }, { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2023-5217", "options": [ { "Exploitation": "active" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2023-11-15T16:38:17.360361Z", "version": "2.0.3" }, "type": "ssvc" } }, { "other": { "content": { "dateAdded": "2023-10-02", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217" }, "type": "kev" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-10-21T23:05:36.191Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "government-resource" ], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217" } ], "timeline": [ { "lang": "en", "time": "2023-10-02T00:00:00+00:00", "value": "CVE-2023-5217 added to CISA KEV" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Chrome", "vendor": "Google", "versions": [ { "lessThan": "117.0.5938.132", "status": "affected", "version": "117.0.5938.132", "versionType": "custom" } ] }, { "product": "libvpx", "vendor": "Google", "versions": [ { "lessThan": "1.13.1", "status": "affected", "version": "1.13.1", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)" } ], "problemTypes": [ { "descriptions": [ { "description": "Heap buffer overflow", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-31T17:08:56.596Z", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome" }, "references": [ { "url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html" }, { "url": "https://crbug.com/1486441" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/28/5" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/28/6" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/1" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/2" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/7" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/9" }, { "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/" }, { "url": "https://security-tracker.debian.org/tracker/CVE-2023-5217" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241191" }, { "url": "https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/" }, { "url": "https://www.openwall.com/lists/oss-security/2023/09/28/5" }, { "url": "https://pastebin.com/TdkC4pDv" }, { "url": "https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590" }, { "url": "https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282" }, { "url": "https://github.com/webmproject/libvpx/tags" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/11" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/12" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/14" }, { "url": "https://www.debian.org/security/2023/dsa-5510" }, { "url": "https://www.debian.org/security/2023/dsa-5509" }, { "url": "https://www.debian.org/security/2023/dsa-5508" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/1" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html" }, { "url": "https://twitter.com/maddiestone/status/1707163313711497266" }, { "url": "https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/" }, { "url": "https://github.com/webmproject/libvpx/releases/tag/v1.13.1" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/3" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/2" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/4" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/5" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/01/2" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/01/1" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/01/5" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/02/6" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/03/11" }, { "url": "https://security.gentoo.org/glsa/202310-04" }, { "url": "https://support.apple.com/kb/HT213961" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/" }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/12" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html" }, { "url": "https://support.apple.com/kb/HT213972" }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/16" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/" }, { "url": "https://security.gentoo.org/glsa/202401-34" } ] } }, "cveMetadata": { "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2023-5217", "datePublished": "2023-09-28T15:23:18.340Z", "dateReserved": "2023-09-27T01:52:05.679Z", "dateUpdated": "2025-10-21T23:05:36.191Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…