CVE-2024-23222

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 10,6%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada apple safari, apple ipados +4 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 23 Januari 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.

Rincian

Terbit di NVD

23 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

10,6% peluang dieksploitasi; lebih tinggi dari 95,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apple Multiple Products WebKit Type Confusion Vulnerability

Masuk KEV

23 Januari 2024

Tenggat CISA

13 Februari 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.apple.com/en-us/118479 release notes · advisory vendor
• https://support.apple.com/en-us/120304 release notes · advisory vendor
• https://support.apple.com/en-us/120305 release notes · advisory vendor
• https://support.apple.com/en-us/120307 release notes · advisory vendor
• https://support.apple.com/en-us/120309 release notes · advisory vendor
• https://support.apple.com/en-us/120310 release notes · advisory vendor
• https://support.apple.com/en-us/120311 release notes · advisory vendor
• https://support.apple.com/en-us/120339 release notes · advisory vendor
• https://support.apple.com/en-us/126632 release notes · advisory vendor
• https://support.apple.com/en-us/HT214055 release notes · advisory vendor
• https://support.apple.com/en-us/HT214059 release notes · advisory vendor
• https://support.apple.com/en-us/HT214061 release notes · advisory vendor
• https://support.apple.com/kb/HT214055 release notes · advisory vendor
• https://support.apple.com/kb/HT214056 release notes · advisory vendor
• https://support.apple.com/kb/HT214057 release notes · advisory vendor
• https://support.apple.com/kb/HT214058 release notes · advisory vendor
• https://support.apple.com/kb/HT214059 release notes · advisory vendor
• https://support.apple.com/kb/HT214061 release notes · advisory vendor
• https://support.apple.com/kb/HT214063 release notes · advisory vendor
• https://support.apple.com/kb/HT214070 release notes · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23222 pemerintah AS
• http://seclists.org/fulldisclosure/2024/Feb/6 advisory pihak ketiga
• http://seclists.org/fulldisclosure/2024/Jan/34 advisory pihak ketiga
• http://seclists.org/fulldisclosure/2024/Jan/40 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/US43EQFC2IS66EA... broken link