CVE-2023-28206

Katalog CVE

CVSS 8.6 · High KEV · sudah dieksploitasi EPSS 23,2%

Kerentanan Out-of-bounds Write pada apple ipados, apple iphone os +1 lainnya. Skor CVSS 3.1 8.6 (High) menurut NVD. Masuk katalog KEV CISA pada 10 April 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

Rincian

Terbit di NVD

10 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

23,2% peluang dieksploitasi; lebih tinggi dari 97,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

Masuk KEV

10 April 2023

Tenggat CISA

1 Mei 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.apple.com/en-us/HT213720 release notes · advisory vendor
• https://support.apple.com/en-us/HT213721 release notes · advisory vendor
• https://support.apple.com/en-us/HT213723 release notes · advisory vendor
• https://support.apple.com/en-us/HT213724 release notes · advisory vendor
• https://support.apple.com/en-us/HT213725 release notes · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28206 pemerintah AS