Apple Multiple Products — Apple Multiple Products WebKit Use-After-Free Vulnerability

Weakness classes (CWE)

• CWE-416Variant

  Use After Free

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

  cwe.mitre.org →

• CWE-416Variant

  Use After Free

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

  cwe.mitre.org →

Description

Affected operating systems

• macos

  apple / macos

• mobile

  apple / iphone_os

• other

  apple / ipados

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

• CISA KEV Catalogactively exploited (KEV)
  CISA Known Exploited Vulnerabilityhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog#CVE-2023-282052023-04-10 00:00 UTC

References & sources

• https://support.apple.com/en-us/HT213723
• https://support.apple.com/en-us/HT213722
• https://support.apple.com/en-us/HT213721
• https://support.apple.com/en-us/HT213720