CVE-2023-28206

CVSS V2 None CVSS V3 None
Description
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.7.5 and iPadOS 15.7.5, macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Big Sur 11.7.6, macOS Ventura 13.3.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
Overview
  • CVE ID
  • CVE-2023-28206
  • Assigner
  • product-security@apple.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-04-10T19:15:07
  • Last Modified Date
  • 2023-04-11T14:35:55
Weakness Enumerations
CWE URL
CWE-787 http://cwe.mitre.org/data/definitions/787.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* 1 OR 15.7.5
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* 1 OR 16.0 16.4.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* 1 OR 15.7.5
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* 1 OR 16.0 16.4.1
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* 1 OR 11.7.6
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* 1 OR 12.0 12.6.5
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* 1 OR 13.0 13.3.1
References
Reference URL Reference Tags
http://seclists.org/fulldisclosure/2023/Apr/1 Mailing List Release Notes
http://seclists.org/fulldisclosure/2023/Apr/2 Mailing List Release Notes
http://seclists.org/fulldisclosure/2023/Apr/4 Mailing List Release Notes
http://seclists.org/fulldisclosure/2023/Apr/5 Mailing List Release Notes
http://seclists.org/fulldisclosure/2023/Apr/6 Mailing List Release Notes
https://support.apple.com/en-us/HT213720 Release Notes
https://support.apple.com/en-us/HT213721 Release Notes
https://support.apple.com/en-us/HT213723 Release Notes
https://support.apple.com/en-us/HT213724 Release Notes
https://support.apple.com/en-us/HT213725 Release Notes
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-28206
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28206
History
Created Old Value New Value Data Type Notes
2023-04-17 04:27:11 Added to TrackCVE
2023-04-17 04:27:13 Weakness Enumeration new