CVE-2023-41074
Summary
| CVE | CVE-2023-41074 |
|---|---|
| State | PUBLISHED |
| Assigner | apple |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-09-27 15:19:26 UTC |
| Updated | 2026-10-07 17:16:44 UTC |
| Description | The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution. |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.039140000 probability, percentile 0.900240000 (date 2026-10-07)
Problem Types: NVD-CWE-noinfo | CWE-94 | Processing web content may lead to arbitrary code execution | CWE-94 CWE-94 Improper Control of Generation of Code ('Code Injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Apple | Ipados | All | All | All | All |
| Operating System | Apple | Iphone Os | All | All | All | All |
| Operating System | Apple | Macos | All | All | All | All |
| Application | Apple | Safari | All | All | All | All |
| Operating System | Apple | Tvos | All | All | All | All |
| Operating System | Apple | Watchos | All | All | All | All |
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Operating System | Debian | Debian Linux | 12.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 37 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apple | IOS And IPadOS | affected unspecified 17 custom | Not specified |
| CNA | Apple | TvOS | affected unspecified 17 custom | Not specified |
| CNA | Apple | Safari | affected unspecified 17 custom | Not specified |
| CNA | Apple | MacOS | affected unspecified 14 custom | Not specified |
| CNA | Apple | WatchOS | affected unspecified 10 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 37 Update: webkitgtk-2.42.1-1.fc37 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Mailing List, Third Party Advisory |
| WebKitGTK+: Multiple Vulnerabilities (GLSA 202401-33) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| webkitgtk.org/security/WSA-2023-0009.html | af854a3a-2127-422b-91ae-364da2661108 | webkitgtk.org | |
| About the security content of tvOS 17 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Release Notes, Vendor Advisory |
| Full Disclosure: APPLE-SA-09-26-2023-7 iOS 17 and iPadOS 17 | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Mailing List, Third Party Advisory |
| About the security content of watchOS 10 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Release Notes, Vendor Advisory |
| Full Disclosure: APPLE-SA-09-26-2023-8 watchOS 10 | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Mailing List, Third Party Advisory |
| Full Disclosure: APPLE-SA-09-26-2023-2 macOS Sonoma 14 | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Mailing List, Third Party Advisory |
| Full Disclosure: APPLE-SA-09-26-2023-9 tvOS 17 | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Mailing List, Third Party Advisory |
| Full Disclosure: APPLE-SA-09-26-2023-1 Safari 17 | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Mailing List, Third Party Advisory |
| Debian -- Security Information -- DSA-5527-1 webkit2gtk | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| About the security content of macOS Sonoma 14 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Release Notes, Vendor Advisory |
| oss-security - WebKitGTK and WPE WebKit Security Advisory WSA-2023-0009 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Third Party Advisory |
| About the security content of iOS 17 and iPadOS 17 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Release Notes, Vendor Advisory |
| support.apple.com/en-us/HT213941 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Release Notes, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 199822 Ubuntu Security Notification for WebKitGTK Vulnerabilities (USN-6426-1)
- 284627 Fedora Security Update for webkitgtk (FEDORA-2023-1536766e9f)
- 357018 Amazon Linux Security Advisory for webkitgtk4 : ALAS2-2024-2427
- 378902 Apple Safari Multiple Vulnerabilities (HT213941)
- 6000292 Debian Security Update for webkit2gtk (DSA 5527-1)
- 610525 Apple iOS 17 and iPadOS 17 Security Update Missing (HT213938)
- 710848 Gentoo Linux WebKitGTK+ Multiple Vulnerabilities (GLSA 202401-33)
- 755164 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2023:4211-1)
- 755166 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2023:4209-1)
- 755202 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2023:4294-1)
- 755555 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2024:0004-1)
- 755556 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2024:0003-1)
- 755557 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2024:0002-1)