Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2023-AVI-0838
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Apple. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et une élévation de privilèges.
L'éditeur mentionne avoir connaissance de l'exploitation de la vulnérabilité, CVE-2023-42824, sur les versions d'iOS 16.6 et antérieures.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
Title | Publication Time | Tags | |||
---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "iOS versions ant\u00e9rieures \u00e0 16.7.1", "product": { "name": "N/A", "vendor": { "name": "Apple", "scada": false } } }, { "description": "iPadOS versions ant\u00e9rieures \u00e0 16.7.1", "product": { "name": "N/A", "vendor": { "name": "Apple", "scada": false } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2023-42824", "url": "https://www.cve.org/CVERecord?id=CVE-2023-42824" }, { "name": "CVE-2023-5217", "url": "https://www.cve.org/CVERecord?id=CVE-2023-5217" } ], "initial_release_date": "2023-10-12T00:00:00", "last_revision_date": "2023-10-12T00:00:00", "links": [], "reference": "CERTFR-2023-AVI-0838", "revisions": [ { "description": "Version initiale", "revision_date": "2023-10-12T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire" }, { "description": "\u00c9 l\u00e9vation de privil\u00e8ges" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Apple\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire et une \u00e9l\u00e9vation\nde privil\u00e8ges.\n\nL\u0027\u00e9diteur mentionne avoir connaissance de l\u0027exploitation de la\nvuln\u00e9rabilit\u00e9, CVE-2023-42824, sur les versions d\u0027iOS 16.6 et\nant\u00e9rieures.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Apple HT213972 du 10 octobre 2023", "url": "https://support.apple.com/en-us/HT213972" } ] }
CVE-2023-42824 (GCVE-0-2023-42824)
Vulnerability from cvelistv5
Published
2023-10-04 18:02
Modified
2025-10-21 23:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
Summary
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Apple | iOS and iPadOS |
Version: unspecified < 16.7 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:30:24.664Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT213972" } ], "title": "CVE Program Container" }, { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2023-42824", "options": [ { "Exploitation": "active" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2023-11-15T16:38:08.096312Z", "version": "2.0.3" }, "type": "ssvc" } }, { "other": { "content": { "dateAdded": "2023-10-05", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42824" }, "type": "kev" } } ], "problemTypes": [ { "descriptions": [ { "description": "CWE-noinfo Not enough information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-10-21T23:05:35.359Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "government-resource" ], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42824" } ], "timeline": [ { "lang": "en", "time": "2023-10-05T00:00:00+00:00", "value": "CVE-2023-42824 added to CISA KEV" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6." } ], "problemTypes": [ { "descriptions": [ { "description": "A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2023-10-25T18:32:11.941Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT213972" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-42824", "datePublished": "2023-10-04T18:02:20.884Z", "dateReserved": "2023-09-14T19:05:11.447Z", "dateUpdated": "2025-10-21T23:05:35.359Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2023-5217 (GCVE-0-2023-5217)
Vulnerability from cvelistv5
Published
2023-09-28 15:23
Modified
2025-10-21 23:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Heap buffer overflow
Summary
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T07:52:08.351Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html" }, { "tags": [ "x_transferred" ], "url": "https://crbug.com/1486441" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/28/5" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/28/6" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/1" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/2" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/7" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/9" }, { "tags": [ "x_transferred" ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/" }, { "tags": [ "x_transferred" ], "url": "https://security-tracker.debian.org/tracker/CVE-2023-5217" }, { "tags": [ "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241191" }, { "tags": [ "x_transferred" ], "url": "https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/" }, { "tags": [ "x_transferred" ], "url": "https://www.openwall.com/lists/oss-security/2023/09/28/5" }, { "tags": [ "x_transferred" ], "url": "https://pastebin.com/TdkC4pDv" }, { "tags": [ "x_transferred" ], "url": "https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590" }, { "tags": [ "x_transferred" ], "url": "https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282" }, { "tags": [ "x_transferred" ], "url": "https://github.com/webmproject/libvpx/tags" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/11" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/12" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/29/14" }, { "tags": [ "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5510" }, { "tags": [ "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5509" }, { "tags": [ "x_transferred" ], "url": "https://www.debian.org/security/2023/dsa-5508" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/1" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html" }, { "tags": [ "x_transferred" ], "url": "https://twitter.com/maddiestone/status/1707163313711497266" }, { "tags": [ "x_transferred" ], "url": "https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/" }, { "tags": [ "x_transferred" ], "url": "https://github.com/webmproject/libvpx/releases/tag/v1.13.1" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/3" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/2" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/4" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/09/30/5" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/01/2" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/01/1" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/01/5" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/02/6" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2023/10/03/11" }, { "tags": [ "x_transferred" ], "url": "https://security.gentoo.org/glsa/202310-04" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213961" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2023/Oct/12" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html" }, { "tags": [ "x_transferred" ], "url": "https://support.apple.com/kb/HT213972" }, { "tags": [ "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2023/Oct/16" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/" }, { "tags": [ "x_transferred" ], "url": "https://security.gentoo.org/glsa/202401-34" } ], "title": "CVE Program Container" }, { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2023-5217", "options": [ { "Exploitation": "active" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2023-11-15T16:38:17.360361Z", "version": "2.0.3" }, "type": "ssvc" } }, { "other": { "content": { "dateAdded": "2023-10-02", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217" }, "type": "kev" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-10-21T23:05:36.191Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "government-resource" ], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217" } ], "timeline": [ { "lang": "en", "time": "2023-10-02T00:00:00+00:00", "value": "CVE-2023-5217 added to CISA KEV" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Chrome", "vendor": "Google", "versions": [ { "lessThan": "117.0.5938.132", "status": "affected", "version": "117.0.5938.132", "versionType": "custom" } ] }, { "product": "libvpx", "vendor": "Google", "versions": [ { "lessThan": "1.13.1", "status": "affected", "version": "1.13.1", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)" } ], "problemTypes": [ { "descriptions": [ { "description": "Heap buffer overflow", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-31T17:08:56.596Z", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome" }, "references": [ { "url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html" }, { "url": "https://crbug.com/1486441" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/28/5" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/28/6" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/1" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/2" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/7" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/9" }, { "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/" }, { "url": "https://security-tracker.debian.org/tracker/CVE-2023-5217" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2241191" }, { "url": "https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/" }, { "url": "https://www.openwall.com/lists/oss-security/2023/09/28/5" }, { "url": "https://pastebin.com/TdkC4pDv" }, { "url": "https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590" }, { "url": "https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282" }, { "url": "https://github.com/webmproject/libvpx/tags" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/11" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/12" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/29/14" }, { "url": "https://www.debian.org/security/2023/dsa-5510" }, { "url": "https://www.debian.org/security/2023/dsa-5509" }, { "url": "https://www.debian.org/security/2023/dsa-5508" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/1" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html" }, { "url": "https://twitter.com/maddiestone/status/1707163313711497266" }, { "url": "https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/" }, { "url": "https://github.com/webmproject/libvpx/releases/tag/v1.13.1" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/3" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/2" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/4" }, { "url": "http://www.openwall.com/lists/oss-security/2023/09/30/5" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/01/2" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/01/1" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/01/5" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/02/6" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/03/11" }, { "url": "https://security.gentoo.org/glsa/202310-04" }, { "url": "https://support.apple.com/kb/HT213961" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/" }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/12" }, { "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html" }, { "url": "https://support.apple.com/kb/HT213972" }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/16" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/" }, { "url": "https://security.gentoo.org/glsa/202401-34" } ] } }, "cveMetadata": { "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2023-5217", "datePublished": "2023-09-28T15:23:18.340Z", "dateReserved": "2023-09-27T01:52:05.679Z", "dateUpdated": "2025-10-21T23:05:36.191Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…