CVE Vulnerability Advisory Database

[Affected Scope] Apple WebKit engine in Safari prior to 16.2, tvOS prior to 16.2, macOS Ventura prior to 13.1, iOS prior to 15.7.2/16.1.2, and iPadOS prior to 15.7.2

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) on the target system, with active exploitation observed in the wild

[Mitigation] Immediately update affected Apple operating systems and Safari browsers to the latest patched versions (iOS 16.2, macOS 13.1, or later)

[Affected Scope] Apple devices running versions prior to iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1

[Impact] Processing maliciously crafted web content may allow remote attackers to execute arbitrary code (RCE) and compromise the target system

[Mitigation] Immediately apply the official security patches provided by Apple (iOS 15.6.1, macOS 12.5.1, Safari 15.6.1 or later)

[Affected Scope] Google Chrome prior to version 103.0.5060.114 and other applications utilizing the WebRTC library

[Impact] A remote attacker can trigger heap corruption and potentially execute arbitrary code or cause a Denial of Service (DoS) via a crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to version 103.0.5060.114 or later

[Affected Scope] Systems running macOS Monterey prior to 12.2.1, iOS prior to 15.3.1, iPadOS prior to 15.3.1, and Safari prior to 15.3

[Impact] Processing maliciously crafted web content may lead to arbitrary remote code execution (RCE) on the target system, with active exploitation reported in the wild

[Mitigation] Immediately apply official Apple security updates to upgrade macOS, iOS, iPadOS, and Safari to the patched versions

[Affected Scope] Apple WebKit engine in versions prior to iOS 14.5.1, iPadOS 14.5.1, macOS Big Sur 11.3.1, watchOS 7.4.1, and tvOS 14.6

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution, with active exploitation reported in the wild

[Mitigation] Immediately update Apple operating systems to the latest patched versions (iOS 14.5.1, macOS 11.3.1, or later) using official software update channels

[Affected Scope] Apple devices running versions prior to iOS 14.5, iPadOS 14.5, macOS Big Sur 11.3, tvOS 14.6, and Safari 14.1.1

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) on the target device

[Mitigation] Immediately apply the official software updates provided by Apple (iOS 14.5.1, macOS 11.3.1, or later)

[Affected Scope] Systems running Safari prior to 14.1, iOS prior to 12.5.3, iOS/iPadOS prior to 14.5, watchOS prior to 7.4, tvOS prior to 14.5, and macOS Big Sur prior to 11.3

[Impact] Processing maliciously crafted web content may trigger a Use-After-Free vulnerability in the WebKit rendering engine, allowing remote attackers to execute arbitrary code on the target device. Active exploitation in the wild has been reported

[Mitigation] Immediately apply the official security updates provided by Apple to upgrade to patched versions

[Affected Scope] Legacy Apple devices running iOS versions prior to 12.5.4 (including iPhone 5s, iPhone 6, iPad Air, iPad mini 2/3, and iPod touch 6th gen)

[Impact] Processing maliciously crafted web content may trigger a Use-After-Free condition, leading to arbitrary code execution (RCE) and potential device compromise

[Mitigation] Immediately update affected legacy iOS devices to version 12.5.4 or later, and restrict access to untrusted web links

[Affected Scope] Apple devices running iOS versions prior to 12.5.4 (including iPhone 5s, iPhone 6, iPad Air, iPad mini 2, iPad mini 3, and iPod touch 6th generation)

[Impact] Processing maliciously crafted web content may allow remote attackers to trigger memory corruption and execute arbitrary code with system privileges

[Mitigation] Immediately update affected devices to iOS 12.5.4 or later to remediate the vulnerability

[Affected Scope] iOS/iPadOS before 15.2, macOS Monterey before 12.1, Safari before 15.2, tvOS before 15.2, watchOS before 8.3

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution on the target system.

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to the patched versions.

[Affected Scope] Apple WebKit-based browsers and applications running on iOS versions prior to 14.8, iPadOS versions prior to 14.8, and macOS Big Sur versions prior to 11.6

[Impact] Processing maliciously crafted web content may allow remote attackers to trigger a Use-After-Free condition, leading to arbitrary code execution (RCE) on the target system

[Mitigation] Immediately apply the official Apple software updates to upgrade to iOS/iPadOS 14.8, macOS Big Sur 11.6, or later

[Affected Scope] Apple iOS before 14.4, iPadOS before 14.4, macOS Big Sur before 11.2, and macOS Catalina/Mojave prior to Security Update 2021-001.

[Impact] A remote attacker can execute arbitrary code on the target device via malicious web content, bypassing sandbox restrictions. This vulnerability has been actively exploited in the wild.

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to iOS/iPadOS 14.4, macOS Big Sur 11.2, or later.

[Affected Scope] Systems running macOS Big Sur prior to 11.2, Catalina/Mojave without Security Update 2021-001, iOS/iPadOS prior to 14.4, tvOS prior to 14.4, watchOS prior to 7.3, and Safari prior to 14.0.3

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) within the context of the browser process

[Mitigation] Immediately apply official Apple software updates to upgrade to patched versions (macOS 11.2, iOS 14.4, Safari 14.0.3, etc.)

[Affected Scope] Legacy Apple operating systems prior to iOS 14.2, macOS Catalina 10.15.7, and watchOS 7.1

[Impact] Processing a maliciously crafted font file triggers an out-of-bounds write (CWE-787), leading to arbitrary remote code execution (RCE)

[Mitigation] Immediately apply the official security patches provided by Apple (iOS 14.2, macOS Big Sur 11.0.1, or later)

[Affected Scope] Systems running versions prior to iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, and iCloud for Windows 7.11

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) on the target system

[Mitigation] Immediately update all affected operating systems and applications to their latest patched versions