Vulnerability-Lookup

CVE-2023-43000 (GCVE-0-2023-43000)

Vulnerability from cvelistv5 – Published: 2025-11-05 18:33 – Updated: 2026-09-21 19:03

CISA Previdian

Summary

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-06 05:01 UTC

CWE

Processing maliciously crafted web content may lead to memory corruption
CWE-416 - Use After Free

Assigner

apple mitre root Scorecard

References

6 references

URL	Tags
https://support.apple.com/en-us/120331
https://support.apple.com/en-us/120338
https://support.apple.com/en-us/120324
https://support.apple.com/en-us/126632
https://cloud.google.com/blog/topics/threat-intel…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

4 products

Vendor	Product	Version
Apple	macOS	Affected: unspecified , < 13.5 (custom)
Apple	iOS and iPadOS	Affected: unspecified , < 16.6 (custom)
Apple	Safari	Affected: unspecified , < 16.6 (custom)
Apple	iOS and iPadOS	Affected: unspecified , < 15.8.7 (custom)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 79d90107-b980-4f72-adca-5863c41e8f3d

Vulnerability ID: CVE-2023-43000

Status: Confirmed

Status Updated: 2026-03-05 01:00 CET

Exploited: Yes

Timestamps

First Seen: 2026-03-05

Asserted: 2026-03-05

Scope

Notes: Apple Multiple products Use-After-Free Vulnerability | Affected: Apple / Multiple Products | Description: Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-03-26 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-416
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Multiple Products
Due Date	2026-03-26
Date Added	2026-03-05
Vendorproject	Apple
Vulnerabilityname	Apple Multiple products Use-After-Free Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2023-43000

Created: 2026-10-02 08:09 CEST | Updated: 2026-10-02 08:09 CEST

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: a951d712-ab8c-477b-94c5-c39fede4a6eb

Vulnerability ID: CVE-2023-43000

Status: Confirmed

Status Updated: 2026-06-01 15:30 CEST

Exploited: Yes

Timestamps

First Seen: 2026-06-01

Asserted: 2026-06-01

Scope

Notes: A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari... | Affected: Apple / macOS, iOS and iPadOS, Safari | CVSS: 8.8 (HIGH) | EPSS: 0.03898 | Used in malware: unknown | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari...
Cve Id	CVE-2023-43000
Vendor	Apple
Ghsa Id	GHSA-96FF-3RWM-724G
Product	macOS, iOS and iPadOS, Safari
Added Date	2026-06-01T13:30:35.576Z
Cvss Score	8.8
Epss Score	0.03898
Previous Ids
Cvss Severity	HIGH
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.89933
Used In Malware	unknown
Vulnerability Id	CVE-2023-43000
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-10-02 09:09 CEST | Updated: 2026-10-02 09:09 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-43000",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T05:01:14.932410Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-03-05",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T19:03:00.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "13.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.8.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing maliciously crafted web content may lead to memory corruption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-12T00:52:04.293Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/120331"
        },
        {
          "url": "https://support.apple.com/en-us/120338"
        },
        {
          "url": "https://support.apple.com/en-us/120324"
        },
        {
          "url": "https://support.apple.com/en-us/126632"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2023-43000",
    "datePublished": "2025-11-05T18:33:23.777Z",
    "dateReserved": "2023-09-14T19:05:11.491Z",
    "dateUpdated": "2026-09-21T19:03:00.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-43000",
      "date": "2026-10-02",
      "epss": "0.03898",
      "percentile": "0.89942"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "macOS",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "13.5",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "iOS and iPadOS",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "16.6",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Safari",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "16.6",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "iOS and iPadOS",
                "vendor": "Apple",
                "versions": [
                  {
                    "lessThan": "15.8.7",
                    "status": "affected",
                    "version": "unspecified",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "product-security@apple.com"
          }
        ],
        "cisaActionDue": "2026-03-26",
        "cisaExploitAdd": "2026-03-05",
        "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "cisaVulnerabilityName": "Apple Multiple products Use-After-Free Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DB91291B-DB98-4E2A-BDA6-F9B5C48CDC6F",
                    "versionEndExcluding": "16.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1E574928-4E49-45B0-AE6E-DF4D38897F67",
                    "versionEndExcluding": "15.8.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "33013784-1828-4402-81CF-2794D94A7C48",
                    "versionEndExcluding": "16.6",
                    "versionStartIncluding": "16.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D1E9DC1A-618A-4CAF-96C7-EC5BA2C1F617",
                    "versionEndExcluding": "15.8.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4C67BFEB-764A-4C07-A02A-117C6AFAAC6A",
                    "versionEndExcluding": "16.6",
                    "versionStartIncluding": "16.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7FB2CB0B-A635-4057-98B8-AF71F9CB0171",
                    "versionEndExcluding": "13.5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption."
          }
        ],
        "id": "CVE-2023-43000",
        "lastModified": "2026-09-21T18:17:03.620",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-43000",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T05:01:14.932410Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-11-05T19:15:47.937",
        "references": [
          {
            "source": "product-security@apple.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/120324"
          },
          {
            "source": "product-security@apple.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/120331"
          },
          {
            "source": "product-security@apple.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/120338"
          },
          {
            "source": "product-security@apple.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://support.apple.com/en-us/126632"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000"
          }
        ],
        "sourceIdentifier": "product-security@apple.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-26T21:40:03+00:00",
      "cve": "CVE-2023-43000",
      "id": "CVE-2023-43000",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "412",
      "product_status:known_affected": "9",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "webkitgtk: Processing maliciously crafted web content may lead to memory corruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-43000.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 8.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-43000",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-06T05:01:14.932410Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-03-05",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000"
                  },
                  "type": "kev"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-11-05T18:52:52.612Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "third-party-advisory"
                ],
                "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit"
              },
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "macOS",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "13.5",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "iOS and iPadOS",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "16.6",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Safari",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "16.6",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "iOS and iPadOS",
              "vendor": "Apple",
              "versions": [
                {
                  "lessThan": "15.8.7",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Processing maliciously crafted web content may lead to memory corruption",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-12T00:52:04.293Z",
            "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
            "shortName": "apple"
          },
          "references": [
            {
              "url": "https://support.apple.com/en-us/120331"
            },
            {
              "url": "https://support.apple.com/en-us/120338"
            },
            {
              "url": "https://support.apple.com/en-us/120324"
            },
            {
              "url": "https://support.apple.com/en-us/126632"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "assignerShortName": "apple",
        "cveId": "CVE-2023-43000",
        "datePublished": "2025-11-05T18:33:23.777Z",
        "dateReserved": "2023-09-14T19:05:11.491Z",
        "dateUpdated": "2026-09-21T19:03:00.605Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ALSA-2025:22789

Vulnerability from osv_almalinux – Published: 2025-12-08 00:00 – Updated: 2025-12-08 13:59 – Source website

CISA Previdian

Summary

Important: webkit2gtk3 security update

Details

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2025:22789	ADVISORY
	https://access.redhat.com/security/cve/CVE-2023-43000	REPORT
	https://access.redhat.com/security/cve/CVE-2025-13502	REPORT
	https://access.redhat.com/security/cve/CVE-2025-13947	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43392	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43419	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43421	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43425	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43427	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43429	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43430	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43431	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43432	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43434	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43440	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43443	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43458	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43480	REPORT
	https://access.redhat.com/security/cve/CVE-2025-66287	REPORT
	https://bugzilla.redhat.com/2416300	REPORT
	https://bugzilla.redhat.com/2416324	REPORT
	https://bugzilla.redhat.com/2416325	REPORT
	https://bugzilla.redhat.com/2416326	REPORT
	https://bugzilla.redhat.com/2416327	REPORT
	https://bugzilla.redhat.com/2416329	REPORT
	https://bugzilla.redhat.com/2416330	REPORT
	https://bugzilla.redhat.com/2416331	REPORT
	https://bugzilla.redhat.com/2416332	REPORT
	https://bugzilla.redhat.com/2416334	REPORT
	https://bugzilla.redhat.com/2416335	REPORT
	https://bugzilla.redhat.com/2416336	REPORT
	https://bugzilla.redhat.com/2416337	REPORT
	https://bugzilla.redhat.com/2416338	REPORT
	https://bugzilla.redhat.com/2416355	REPORT
	https://bugzilla.redhat.com/2418576	REPORT
	https://bugzilla.redhat.com/2418855	REPORT
	https://bugzilla.redhat.com/2418857	REPORT
	https://errata.almalinux.org/8/ALSA-2025-22789.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "webkit2gtk3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.3-1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "webkit2gtk3-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.3-1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "webkit2gtk3-jsc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.3-1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "webkit2gtk3-jsc-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.3-1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.  \n\nSecurity Fix(es):  \n\n  * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n  * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)\n  * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n  * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n  * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n  * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n  * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2025:22789",
  "modified": "2025-12-08T13:59:43Z",
  "published": "2025-12-08T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2025:22789"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-43000"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-13502"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-13947"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43392"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43419"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43421"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43425"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43427"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43429"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43430"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43431"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43432"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43434"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43440"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43443"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43458"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43480"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-66287"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416300"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416324"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416325"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416326"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416327"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416330"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416331"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416332"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416334"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416335"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416336"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416337"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416338"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416355"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2418576"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2418855"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2418857"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2025-22789.html"
    }
  ],
  "related": [
    "CVE-2025-13502",
    "CVE-2023-43000",
    "CVE-2025-43392",
    "CVE-2025-43419",
    "CVE-2025-43425",
    "CVE-2025-43427",
    "CVE-2025-43429",
    "CVE-2025-43430",
    "CVE-2025-43431",
    "CVE-2025-43432",
    "CVE-2025-43434",
    "CVE-2025-43440",
    "CVE-2025-43443",
    "CVE-2025-43480",
    "CVE-2025-43421",
    "CVE-2025-13947",
    "CVE-2025-43458",
    "CVE-2025-66287"
  ],
  "summary": "Important: webkit2gtk3 security update"
}

ALSA-2025:22790

Vulnerability from osv_almalinux – Published: 2025-12-08 00:00 – Updated: 2025-12-08 14:01 – Source website

CISA Previdian

Summary

Important: webkit2gtk3 security update

Details

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)
webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)
webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)
webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2025:22790	ADVISORY
	https://access.redhat.com/security/cve/CVE-2023-43000	REPORT
	https://access.redhat.com/security/cve/CVE-2025-13502	REPORT
	https://access.redhat.com/security/cve/CVE-2025-13947	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43392	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43419	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43421	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43425	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43427	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43429	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43430	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43431	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43432	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43434	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43440	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43443	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43458	REPORT
	https://access.redhat.com/security/cve/CVE-2025-43480	REPORT
	https://access.redhat.com/security/cve/CVE-2025-66287	REPORT
	https://bugzilla.redhat.com/2416300	REPORT
	https://bugzilla.redhat.com/2416324	REPORT
	https://bugzilla.redhat.com/2416325	REPORT
	https://bugzilla.redhat.com/2416326	REPORT
	https://bugzilla.redhat.com/2416327	REPORT
	https://bugzilla.redhat.com/2416329	REPORT
	https://bugzilla.redhat.com/2416330	REPORT
	https://bugzilla.redhat.com/2416331	REPORT
	https://bugzilla.redhat.com/2416332	REPORT
	https://bugzilla.redhat.com/2416334	REPORT
	https://bugzilla.redhat.com/2416335	REPORT
	https://bugzilla.redhat.com/2416336	REPORT
	https://bugzilla.redhat.com/2416337	REPORT
	https://bugzilla.redhat.com/2416338	REPORT
	https://bugzilla.redhat.com/2416355	REPORT
	https://bugzilla.redhat.com/2418576	REPORT
	https://bugzilla.redhat.com/2418855	REPORT
	https://bugzilla.redhat.com/2418857	REPORT
	https://errata.almalinux.org/9/ALSA-2025-22790.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "webkit2gtk3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.3-1.el9_7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "webkit2gtk3-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.3-1.el9_7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "webkit2gtk3-jsc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.3-1.el9_7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "webkit2gtk3-jsc-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.50.3-1.el9_7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.  \n\nSecurity Fix(es):  \n\n  * webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)\n  * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)\n  * webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)\n  * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43427)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43429)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43430)\n  * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43431)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43432)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43434)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43440)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43443)\n  * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-43480)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43421)\n  * webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop (CVE-2025-13947)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43458)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-66287)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2025:22790",
  "modified": "2025-12-08T14:01:28Z",
  "published": "2025-12-08T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2025:22790"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2023-43000"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-13502"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-13947"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43392"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43419"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43421"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43425"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43427"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43429"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43430"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43431"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43432"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43434"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43440"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43443"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43458"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-43480"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-66287"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416300"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416324"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416325"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416326"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416327"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416330"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416331"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416332"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416334"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416335"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416336"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416337"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416338"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416355"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2418576"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2418855"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2418857"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2025-22790.html"
    }
  ],
  "related": [
    "CVE-2025-13502",
    "CVE-2023-43000",
    "CVE-2025-43392",
    "CVE-2025-43419",
    "CVE-2025-43425",
    "CVE-2025-43427",
    "CVE-2025-43429",
    "CVE-2025-43430",
    "CVE-2025-43431",
    "CVE-2025-43432",
    "CVE-2025-43434",
    "CVE-2025-43440",
    "CVE-2025-43443",
    "CVE-2025-43480",
    "CVE-2025-43421",
    "CVE-2025-13947",
    "CVE-2025-43458",
    "CVE-2025-66287"
  ],
  "summary": "Important: webkit2gtk3 security update"
}

CERTFR-2026-AVI-0280

Vulnerability from certfr_avis - Published: 2026-03-12 - Updated: 2026-03-12

De multiples vulnérabilités ont été découvertes dans les produits Apple. Elles permettent à un attaquant de provoquer une exécution de code arbitraire et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Apple	iPadOS	iPadOS versions antérieures à 15.8.7
Apple	iOS	iOS versions antérieures à 15.8.7
Apple	iOS	iOS versions antérieures à 16.7.15
Apple	iPadOS	iPadOS versions antérieures à 16.7.15

References

Title

Publication Time

EUVD-2026-373161

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:39

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:39:30.079326+00:00",
  "id": "EUVD-2026-373161"
}

FKIE_CVE-2023-43000

Vulnerability from fkie_nvd - Published: 2025-11-05 19:15 - Updated: 2026-09-21 18:17

CISA Previdian

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
product-security@apple.com	https://support.apple.com/en-us/120324	Release Notes, Vendor Advisory
product-security@apple.com	https://support.apple.com/en-us/120331	Release Notes, Vendor Advisory
product-security@apple.com	https://support.apple.com/en-us/120338	Release Notes, Vendor Advisory
product-security@apple.com	https://support.apple.com/en-us/126632	Release Notes, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit	Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000	US Government Resource

Impacted products

Vendor	Product	Version
apple	safari	*
apple	ipados	*
apple	ipados	*
apple	iphone_os	*
apple	iphone_os	*
apple	macos	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "13.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "15.8.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "product-security@apple.com"
    }
  ],
  "cisaActionDue": "2026-03-26",
  "cisaExploitAdd": "2026-03-05",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Apple Multiple products Use-After-Free Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB91291B-DB98-4E2A-BDA6-F9B5C48CDC6F",
              "versionEndExcluding": "16.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E574928-4E49-45B0-AE6E-DF4D38897F67",
              "versionEndExcluding": "15.8.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33013784-1828-4402-81CF-2794D94A7C48",
              "versionEndExcluding": "16.6",
              "versionStartIncluding": "16.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1E9DC1A-618A-4CAF-96C7-EC5BA2C1F617",
              "versionEndExcluding": "15.8.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C67BFEB-764A-4C07-A02A-117C6AFAAC6A",
              "versionEndExcluding": "16.6",
              "versionStartIncluding": "16.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FB2CB0B-A635-4057-98B8-AF71F9CB0171",
              "versionEndExcluding": "13.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption."
    }
  ],
  "id": "CVE-2023-43000",
  "lastModified": "2026-09-21T18:17:03.620",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-43000",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-06T05:01:14.932410Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-05T19:15:47.937",
  "references": [
    {
      "source": "product-security@apple.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/120324"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/120331"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/120338"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://support.apple.com/en-us/126632"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-96FF-3RWM-724G

Vulnerability from github – Published: 2025-11-05 21:31 – Updated: 2026-03-12 03:31

Details

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6. Processing maliciously crafted web content may lead to memory corruption.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-43000"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-05T19:15:47Z",
    "severity": "HIGH"
  },
  "details": "A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6. Processing maliciously crafted web content may lead to memory corruption.",
  "id": "GHSA-96ff-3rwm-724g",
  "modified": "2026-03-12T03:31:05Z",
  "published": "2025-11-05T21:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43000"
    },
    {
      "type": "WEB",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120324"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120331"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/120338"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/126632"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-43000

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2023-43000

Aliases

CVE-2023-43000

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-43000",
    "id": "GSD-2023-43000"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-43000"
      ],
      "id": "GSD-2023-43000",
      "modified": "2023-12-13T01:20:44.505508Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-43000",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

NCSC-2026-0098

Vulnerability from csaf_ncscnl - Published: 2026-03-13 08:41 - Updated: 2026-03-13 08:41

Summary

Kwetsbaarheden verholpen in Apple iOS en iPadOS

Scope

4 vulnerabilities in this advisory, including CVE-2023-43000.

CVE-2023-43000

A use-after-free vulnerability causing potential memory corruption was fixed in Apple’s macOS, iOS, iPadOS, Safari 16.6, and WebKitGTK by improving memory management when processing malicious web content.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Known affected: 2 products

Open the full advisory

OPENSUSE-SU-2026:20065-1

Vulnerability from csaf_opensuse - Published: 2026-01-20 12:08 - Updated: 2026-09-17 17:25

Summary

Security update for webkit2gtk3

Severity

Important

Scope

30 vulnerabilities in this advisory, including CVE-2023-43000.

CVE-2023-43000

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 111 products

Open the full advisory

RHSA-2024:2126

Vulnerability from csaf_opensuse - Published: 2024-04-30 10:37 - Updated: 2026-08-26 22:08

Summary

Red Hat Security Advisory: webkit2gtk3 security update

Severity

Important

Scope

13 vulnerabilities in this advisory, including CVE-2023-43000.

CVE-2023-43000

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in memory corruption.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fixed: 46 products

https://access.redhat.com/errata/RHSA-2024:2126

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-43000 (GCVE-0-2023-43000)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

Solutions

Tags

Sightings

Nomenclature

Related by attack behaviour