Уязвимость выхода за пределы песочницы веб-контента в watchOS, tvOS, macOS, iOS, iPadOS и Safari из-за недостаточных проверок границ
Описание
Проблема решена путём улучшенных проверок границ. Злоумышленник, находясь удалённо, способен выйти за пределы песочницы веб-контента. Apple знает о сообщениях, что эта уязвимость может быть активно эксплуатирована.
Затронутые версии ПО
- watchOS < 9.5
- tvOS < 16.5
- macOS Ventura < 13.4
- iOS < 15.7.8
- iPadOS < 15.7.8
- Safari < 16.5
- iOS < 16.5
- iPadOS < 16.5
Тип уязвимости
Компрометация песочницы
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- US Government Resource
Уязвимые конфигурации
Одно из
EPSS
8.6 High
CVSS3
Дефекты
Связанные уязвимости
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
The issue was addressed with improved bounds checks. This issue is fix ...
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, Safari 16.5, tvOS 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
Уязвимость модуля отображения веб-страниц WebKit операционных систем iOS, iPadOS, watchOS, tvOS, браузера Safari, позволяющая нарушителю выполнить произвольный код
EPSS
8.6 High
CVSS3