Summary
| Detail | |||
|---|---|---|---|
| Vendor | Apple | First view | 2012-11-03 |
| Product | Safari | Last view | 2023-02-27 |
| Version | 6.0.1 | Type | Application |
| Update | * | ||
| Edition | * | ||
| Language | * | ||
| Sofware Edition | * | ||
| Target Software | * | ||
| Target Hardware | * | ||
| Other | * | ||
| CPE Product | cpe:2.3:a:apple:safari | ||
Activity : Overall
Related : CVE
| Date | Alert | Description | |
|---|---|---|---|
| 8.8 | 2023-02-27 | CVE-2023-23529 | A type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2.1, iOS 16.3.1 and iPadOS 16.3.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.. |
| 8.8 | 2023-02-27 | CVE-2023-23518 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3, tvOS 16.3, Safari 16.3, watchOS 9.3, iOS 16.3 and iPadOS 16.3, macOS Big Sur 11.7.3. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 8.8 | 2023-02-27 | CVE-2023-23517 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3, tvOS 16.3, Safari 16.3, watchOS 9.3, iOS 16.3 and iPadOS 16.3, macOS Big Sur 11.7.3. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 8.8 | 2023-02-27 | CVE-2023-23496 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2, tvOS 16.3, Safari 16.3, watchOS 9.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 4.3 | 2023-02-27 | CVE-2022-46705 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, Safari 16.2. Visiting a malicious website may lead to address bar spoofing. |
| 8.8 | 2023-02-27 | CVE-2022-42826 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1 and iPadOS 16, Safari 16.1. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 6.1 | 2023-02-27 | CVE-2022-32891 | The issue was addressed with improved UI handling. This issue is fixed in Safari 16, tvOS 16, watchOS 9, iOS 16. Visiting a website that frames malicious content may lead to UI spoofing. |
| 6.5 | 2023-02-27 | CVE-2022-32784 | The issue was addressed with improved UI handling. This issue is fixed in Safari 15.6, iOS 15.6 and iPadOS 15.6. Visiting a maliciously crafted website may leak sensitive data. |
| 8.8 | 2022-12-15 | CVE-2022-46700 | A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 8.8 | 2022-12-15 | CVE-2022-46699 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 6.5 | 2022-12-15 | CVE-2022-46698 | A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information. |
| 8.8 | 2022-12-15 | CVE-2022-46696 | A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 5.5 | 2022-12-15 | CVE-2022-46692 | A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy. |
| 8.8 | 2022-12-15 | CVE-2022-46691 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 7 | 2022-12-15 | CVE-2022-46689 | A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges. |
| 8.8 | 2022-12-15 | CVE-2022-42867 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 8.8 | 2022-12-15 | CVE-2022-42863 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 8.8 | 2022-12-15 | CVE-2022-42856 | A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1.. |
| 6.5 | 2022-12-15 | CVE-2022-42852 | The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory. |
| 5.3 | 2022-12-15 | CVE-2022-32833 | An issue existed with the file paths used to store website data. The issue was resolved by improving how website data is stored. This issue is fixed in iOS 16. An unauthorized user may be able to access browsing history. |
| 5.5 | 2022-11-01 | CVE-2022-42824 | A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose sensitive user information. |
| 8.8 | 2022-11-01 | CVE-2022-42823 | A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may lead to arbitrary code execution. |
| 6.1 | 2022-11-01 | CVE-2022-42799 | The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiting a malicious website may lead to user interface spoofing. |
| 6.5 | 2022-11-01 | CVE-2022-32923 | A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose internal states of the app. |
| 8.8 | 2022-11-01 | CVE-2022-32922 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13. Processing maliciously crafted web content may lead to arbitrary code execution. |
CWE : Common Weakness Enumeration
| % | id | Name |
|---|---|---|
| 48% (365) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 14% (108) | CWE-787 | Out-of-bounds Write |
| 7% (55) | CWE-20 | Improper Input Validation |
| 5% (43) | CWE-200 | Information Exposure |
| 5% (42) | CWE-416 | Use After Free |
| 5% (42) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
| 3% (27) | CWE-399 | Resource Management Errors |
| 0% (7) | CWE-362 | Race Condition |
| 0% (7) | CWE-264 | Permissions, Privileges, and Access Controls |
| 0% (7) | CWE-125 | Out-of-bounds Read |
| 0% (6) | CWE-254 | Security Features |
| 0% (4) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
| 0% (4) | CWE-346 | Origin Validation Error |
| 0% (4) | CWE-19 | Data Handling |
| 0% (3) | CWE-284 | Access Control (Authorization) Issues |
| 0% (3) | CWE-190 | Integer Overflow or Wraparound |
| 0% (2) | CWE-704 | Incorrect Type Conversion or Cast |
| 0% (2) | CWE-522 | Insufficiently Protected Credentials |
| 0% (2) | CWE-476 | NULL Pointer Dereference |
| 0% (2) | CWE-129 | Improper Validation of Array Index |
| 0% (2) | CWE-77 | Improper Sanitization of Special Elements used in a Command ('Comma... |
| 0% (2) | CWE-17 | Code |
| 0% (1) | CWE-670 | Always-Incorrect Control Flow Implementation |
| 0% (1) | CWE-668 | Exposure of Resource to Wrong Sphere |
| 0% (1) | CWE-617 | Reachable Assertion |
ExploitDB Exploits
| id | Description |
|---|---|
| 28081 | Apple Safari 6.0.1 for iOS 6.0 and OS X 10.7/8 - Heap Buffer Overflow |
OpenVAS Exploits
| id | Description |
|---|---|
| 2012-11-02 | Name : Apple Safari Multiple Vulnerabilities (APPLE-SA-2012-09-19-3) File : nvt/gb_apple_safari_mult_vuln_nov12_macosx.nasl |
Information Assurance Vulnerability Management (IAVM)
| id | Description |
|---|---|
| 2015-A-0222 | Multiple Security Vulnerabilities in Apple iOS Severity: Category I - VMSKEY: V0061471 |
| 2015-A-0199 | Multiple Vulnerabilities in Apple Mac OS X Severity: Category I - VMSKEY: V0061337 |
| 2014-B-0083 | Multiple Vulnerabilities in Apple iOS Severity: Category I - VMSKEY: V0052903 |
| 2014-B-0048 | Multiple Security Vulnerabilities in Apple iOS Severity: Category I - VMSKEY: V0050015 |
| 2014-B-0024 | Multiple Security Vulnerabilities in Apple iOS Severity: Category I - VMSKEY: V0046157 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2020-11-19 | Apple Safari WebKit Webcore SVGAnimateElementBase use after free attempt RuleID : 56044 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-11-19 | Apple Safari WebKit Webcore SVGAnimateElementBase use after free attempt RuleID : 56043 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-11-18 | Apple Safari WebKit JSPropertyNameEnumeration type confusion attempt RuleID : 56009 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-11-18 | Apple Safari WebKit JSPropertyNameEnumeration type confusion attempt RuleID : 56008 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-10-22 | Apple Safari WebKit HTMLFrameElementBase isURLAllowed Subframe exploit attempt RuleID : 55799 - Type : FILE-OTHER - Revision : 1 |
| 2020-10-22 | Apple Safari WebKit HTMLFrameElementBase isURLAllowed Subframe exploit attempt RuleID : 55798 - Type : FILE-OTHER - Revision : 1 |
| 2020-10-06 | WebKit AudioArray allocate out of bounds access attempt RuleID : 55013 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-10-06 | WebKit AudioArray allocate out of bounds access attempt RuleID : 55012 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-09-02 | WebKit JIT compiler common subexpression elimination out of bounds access att... RuleID : 54666 - Type : BROWSER-WEBKIT - Revision : 2 |
| 2020-09-02 | WebKit JIT compiler common subexpression elimination out of bounds access att... RuleID : 54665 - Type : BROWSER-WEBKIT - Revision : 2 |
| 2020-06-13 | WebKit use-after-free remote code execution attempt RuleID : 53976 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-04-21 | Apple Safari WebKit JavaScript engine type confusion attempt RuleID : 53474 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-04-21 | Apple Safari WebKit JavaScript engine type confusion attempt RuleID : 53473 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-03-19 | Apple Safari WebKit cached page memory corruption attempt RuleID : 53122 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-03-19 | Apple Safari WebKit cached page memory corruption attempt RuleID : 53121 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-03-17 | Apple Safari Webkit WebCore memory corruption attempt RuleID : 53101 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-03-17 | Apple Safari Webkit WebCore memory corruption attempt RuleID : 53100 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-01-21 | Apple Webkit updateMinimumColumnHeight use-after-free attempt RuleID : 52486 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-01-21 | Apple Webkit updateMinimumColumnHeight use-after-free attempt RuleID : 52485 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-01-03 | Apple Safari WebKit out-of-bounds read attempt RuleID : 52342 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2020-01-03 | Apple Safari WebKit out-of-bounds read attempt RuleID : 52341 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2019-12-17 | Apple Safari WebKit handleIntrinsicCall type confusion attempt RuleID : 52245 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2019-12-17 | Apple Safari WebKit handleIntrinsicCall type confusion attempt RuleID : 52244 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2019-11-26 | WebKit WebCore handleMenuItemSelected use after free attempt RuleID : 52003 - Type : BROWSER-WEBKIT - Revision : 1 |
| 2019-11-26 | WebKit WebCore handleMenuItemSelected use after free attempt RuleID : 52002 - Type : BROWSER-WEBKIT - Revision : 1 |
Nessus® Vulnerability Scanner
| id | Description |
|---|---|
| 2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-118b9abf99.nasl - Type: ACT_GATHER_INFO |
| 2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-1a8582a7ee.nasl - Type: ACT_GATHER_INFO |
| 2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-499f2dbc96.nasl - Type: ACT_GATHER_INFO |
| 2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-509fc4a5c8.nasl - Type: ACT_GATHER_INFO |
| 2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-97c58e29e4.nasl - Type: ACT_GATHER_INFO |
| 2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-a1f37d2f08.nasl - Type: ACT_GATHER_INFO |
| 2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-e2e8a07a01.nasl - Type: ACT_GATHER_INFO |
| 2018-12-21 | Name: The remote Apple TV device is affected by multiple vulnerabilities. File: appletv_12_1_1.nasl - Type: ACT_GATHER_INFO |
| 2018-12-19 | Name: An application installed on remote host is affected by multiple vulnerabilities File: itunes_12_9_2.nasl - Type: ACT_GATHER_INFO |
| 2018-12-07 | Name: A web browser installed on the remote macOS or Mac OS X host is affected by m... File: macosx_Safari12_0_2.nasl - Type: ACT_GATHER_INFO |
| 2018-12-03 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201812-04.nasl - Type: ACT_GATHER_INFO |
| 2018-11-02 | Name: The remote Apple TV device is affected by multiple vulnerabilities. File: appletv_12_1.nasl - Type: ACT_GATHER_INFO |
| 2018-11-02 | Name: An application installed on the remote host is affected by multiple vulnerabi... File: itunes_12_9_1.nasl - Type: ACT_GATHER_INFO |
| 2018-11-02 | Name: An application installed on the remote host is affected by multiple vulnerabi... File: itunes_12_9_1_banner.nasl - Type: ACT_GATHER_INFO |
| 2018-10-31 | Name: A web browser installed on the remote macOS or Mac OS X host is affected by m... File: macosx_Safari12_0_1.nasl - Type: ACT_GATHER_INFO |
| 2018-10-02 | Name: An application installed on the remote host is affected by multiple vulnerabi... File: itunes_12_8_banner.nasl - Type: ACT_GATHER_INFO |
| 2018-10-02 | Name: An application installed on the remote host is affected by multiple vulnerabi... File: itunes_12_9.nasl - Type: ACT_GATHER_INFO |
| 2018-10-02 | Name: An application installed on the remote host is affected by multiple vulnerabi... File: itunes_12_9_banner.nasl - Type: ACT_GATHER_INFO |
| 2018-09-24 | Name: The remote Fedora host is missing a security update. File: fedora_2018-4a16e37c81.nasl - Type: ACT_GATHER_INFO |
| 2018-09-20 | Name: A web browser installed on the remote macOS or Mac OS X host is affected by m... File: macosx_safari12.nasl - Type: ACT_GATHER_INFO |
| 2018-08-23 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201808-01.nasl - Type: ACT_GATHER_INFO |
| 2018-08-23 | Name: The remote Gentoo host is missing one or more security-related patches. File: gentoo_GLSA-201808-04.nasl - Type: ACT_GATHER_INFO |
| 2018-07-30 | Name: The remote FreeBSD host is missing a security-related update. File: freebsd_pkg_b9c525d9919811e8beba080027ef1a23.nasl - Type: ACT_GATHER_INFO |
| 2018-07-27 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-4256.nasl - Type: ACT_GATHER_INFO |
| 2018-07-17 | Name: The remote host is missing a macOS update that fixes multiple security vulner... File: macos_10_13_6.nasl - Type: ACT_GATHER_INFO |
