CVE-2022-32893
Published on: Not Yet Published
Last Modified on: 11/07/2022 01:50:00 PM UTC
Certain versions of Ipados from Apple contain the following vulnerability:
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2022-32893 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity. - Affected Vendor/Software: Apple - Safari version < 15.6
- Affected Vendor/Software: Apple - iOS and iPadOS version < 15.6
- Affected Vendor/Software: Apple - macOS version < 12.5
CVSS3 Score: 8.8 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | REQUIRED |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| oss-security - WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 | www.openwall.com text/html |
MLIST [oss-security] 20220825 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 |
| Full Disclosure: APPLE-SA-2022-10-27-13 watchOS 9 | seclists.org text/html |
FULLDISC 20221030 APPLE-SA-2022-10-27-13 watchOS 9 |
| oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 | www.openwall.com text/html |
MLIST [oss-security] 20220913 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 |
| Debian -- Security Information -- DSA-5220-1 wpewebkit | www.debian.org Depreciated Link text/html |
DEBIAN DSA-5220 |
| Debian -- Security Information -- DSA-5219-1 webkit2gtk | www.debian.org Depreciated Link text/html |
DEBIAN DSA-5219 |
| WebKitGTK+: Multiple Vulnerabilities (GLSA 202208-39) — Gentoo security | security.gentoo.org text/html |
GENTOO GLSA-202208-39 |
| oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 | Third Party Advisory www.openwall.com text/html |
MLIST [oss-security] 20220829 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 |
| [SECURITY] Fedora 35 Update: webkit2gtk3-2.36.7-1.fc35 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org text/html |
FEDORA FEDORA-2022-ddfeee50c9 |
| oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 | www.openwall.com text/html |
MLIST [oss-security] 20220826 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 |
| oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 | www.openwall.com text/html |
MLIST [oss-security] 20220829 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 |
| oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 | www.openwall.com text/html |
MLIST [oss-security] 20220902 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 |
| [SECURITY] [DLA 3087-1] webkit2gtk security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20220830 [SECURITY] [DLA 3087-1] webkit2gtk security update |
| About the security content of iOS 15.6.1 and iPadOS 15.6.1 - Apple Support | support.apple.com text/html |
MISC support.apple.com/en-us/HT213412 |
| About the security content of macOS Monterey 12.5.1 - Apple Support | support.apple.com text/html |
MISC support.apple.com/en-us/HT213413 |
| About the security content of Safari 15.6.1 - Apple Support | support.apple.com text/html |
MISC support.apple.com/en-us/HT213414 |
| [SECURITY] Fedora 36 Update: webkit2gtk3-2.36.7-1.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org text/html |
FEDORA FEDORA-2022-eada5f24a0 |
| Full Disclosure: APPLE-SA-2022-08-31-1 iOS 12.5.6 | seclists.org text/html |
FULLDISC 20220831 APPLE-SA-2022-08-31-1 iOS 12.5.6 |
Related QID Numbers
- 160104 Oracle Enterprise Linux Security Update for webkit2gtk3 (ELSA-2022-6634)
- 160113 Oracle Enterprise Linux Security Update for webkit2gtk3 (ELSA-2022-6540)
- 180973 Debian Security Update for webkit2gtk (DSA 5219-1)
- 180974 Debian Security Update for wpewebkit (DSA 5220-1)
- 180979 Debian Security Update for webkit2gtk (DLA 3087-1)
- 198937 Ubuntu Security Notification for WebKitGTK Vulnerability (USN-5611-1)
- 240671 Red Hat Update for webkit2gtk3 (RHSA-2022:6540)
- 240675 Red Hat Update for webkit2gtk3 (RHSA-2022:6634)
- 283070 Fedora Security Update for webkit2gtk3 (FEDORA-2022-eada5f24a0)
- 283103 Fedora Security Update for webkit2gtk3 (FEDORA-2022-ddfeee50c9)
- 376830 Apple macOS Monterey 12.5.1 Not Installed (HT213413)
- 376842 Apple Safari Remote Code Execution (RCE) Vulnerability (HT213414)
- 377604 Alibaba Cloud Linux Security Update for webkit2gtk3 (ALINUX3-SA-2022:0162)
- 610426 Apple iOS 15.6.1 and iPadOS 15.6.1 Security Update Missing
- 610427 Apple iOS 12.5.6 Security Update Missing
- 710613 Gentoo Linux WebKitGTK+ Multiple Vulnerabilities (GLSA 202208-39)
- 752555 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2022:3136-1)
- 752558 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2022:3137-1)
- 752608 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2022:3351-1)
- 752609 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2022:3352-1)
- 940672 AlmaLinux Security Update for webkit2gtk3 (ALSA-2022:6540)
- 940690 AlmaLinux Security Update for webkit2gtk3 (ALSA-2022:6634)
- 960448 Rocky Linux Security Update for webkit2gtk3 (RLSA-2022:6540)
- 960569 Rocky Linux Security Update for webkit2gtk3 (RLSA-2022:6634)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Apple | Ipados | All | All | All | All |
| Operating System | Apple | Iphone Os | All | All | All | All |
| Operating System | Apple | Macos | All | All | All | All |
| Application | Apple | Safari | All | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 35 | All | All | All |
| Operating System | Fedoraproject | Fedora | 36 | All | All | All |
| Application | Webkitgtk | Webkitgtk | All | All | All | All |
| Application | Wpewebkit | Wpe Webkit | All | All | All | All |
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*:
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*:
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*:
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*:
- cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*:
- cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @aaronjschaffer |
Apple announces patch for macOS, iOS WebKit zero-day (CVE-2022-32893) that may have been exploited #itw0days… twitter.com/i/web/status/1… | 2022-08-17 17:45:00 |
| @ApplSec |
? ZERO-DAY DETAILS: - CVE-2022-32894 in Kernel - CVE-2022-32893 in WebKit | 2022-08-17 18:00:23 |
| @gvarisco |
iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1 are out. This version fixes CVE-2022-32893 and CVE-2022-32894. Bot… twitter.com/i/web/status/1… | 2022-08-17 18:33:49 |
| @macmacintosh |
Blog更新しました(*^_^*） ? macOS Monterey 12.5.1（21G83）リリース｡ 【重要なセキュリティアップデートの実施】 積極的に悪用された可能性がある脆弱性(CVE-2022-32893 / CVE-… twitter.com/i/web/status/1… | 2022-08-17 19:57:10 |
| @kawn2020 |
#AppleUpdate #iOS #iPadOS Apple が iOS および iPadOS 向けに OS バージョン 15.6.1 リリース． CVE ベースで 2 件の脆弱性に対処． ・CVE-2022-32893 ・… twitter.com/i/web/status/1… | 2022-08-18 02:56:55 |
| @macmacintosh |
新着案内 ? macOS Monterey 12.5.1（21G83）リリース｡ 【重要なセキュリティアップデートの実施】 積極的に悪用された可能性がある脆弱性(CVE-2022-32893 / CVE-2022-32894)に対… twitter.com/i/web/status/1… | 2022-08-18 03:46:41 |
| @the_yellow_fall |
CVE-2022-32893 & CVE-2022-32894: 0-day flaws in iOS/iPadOS, and macOS securityonline.info/cve-2022-32893… #opensource #infosec #security #pentesting | 2022-08-18 04:53:47 |
| @AcooEdi |
CVE-2022-32893 & CVE-2022-32894: 0-day flaws in iOS/iPadOS, and macOS dlvr.it/SWq7dx via securityonline https://t.co/rmuQ5GaoqS | 2022-08-18 04:56:03 |
 /r/KomodoCyberConsulting |
CVE-2022-32893 & CVE-2022-32894: 0-day flaws in iOS/iPadOS, and macOS | 2022-08-18 07:39:07 |
| /r/k12cybersecurity |
MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution - PATCH: NOW | 2022-08-18 12:56:42 |
| /r/k12cybersecurity |
UPDATED MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution - PATCH: NOW | 2022-08-19 13:26:45 |
| /r/iphone |
Did Apple also fixed hacked iPhones with the new update? iOS 15.6.1 | 2022-08-19 23:42:36 |
| /r/ios |
Did Apple also fixed hacked iPhones with the new update? iOS 15.6.1 | 2022-08-19 23:40:28 |
| /r/KibernetinisSaugumas |
"MacOS" nulinės dienos pažeidžiamumas leidžia valdyti įrenginį | 2022-08-20 10:37:10 |
| /r/ios |
Anyway to check if your iOS was affected by the CVE-2022-32893,CVE-2022-32893 virus? | 2022-08-20 23:50:36 |
| /r/netcve |
CVE-2022-32893 | 2022-08-24 21:38:11 |
| /r/jailbreak |
[QUESTION] CVE-2022-32894 and CVE-2022-32893 vulnerabilities | 2022-08-28 01:35:08 |
| /r/k12cybersecurity |
A Vulnerability in iOS Could Allow For Arbitrary Code Execution (CVE-2022-32893) | 2022-09-02 13:15:24 |
| /r/applesucks |
Two Apple Zero-Days Exploited in Wild Patch Now consider leaving Apple | 2022-09-16 10:34:42 |