CVE-2022-32893 is a high-severity vulnerability affecting multiple Apple software configurations, including Safari, iPadOS, iPhone OS, and macOS. This out-of-bounds write issue, which has been addressed with improved bounds checking, can lead to arbitrary code execution when processing maliciously crafted web content. Apple is aware of reports that this vulnerability may have been actively exploited. The issue also impacts certain versions of WebKitGTK, WPE WebKit, and specific Fedora and Debian Linux distributions.

How do I know if I'm affected?

If you're using Apple Safari, iPadOS, or iPhone OS, you may be affected by this vulnerability if your software version is below 15.6.1. macOS users are at risk if their version is between 12.0 and 12.5.0. WebKitGTK and WPE WebKit users should update if their version is below 2.36.7. Fedora users with versions 35 and 36, and Debian Linux users with versions 10.0 and 11.0 are also affected. This vulnerability can lead to arbitrary code execution when processing malicious web content, and there are reports of it being actively exploited.

What should I do if I'm affected?

If you're affected by this vulnerability, it's crucial to update your software. For Apple users, update to iOS 15.6.1, iPadOS 15.6.1, or macOS Monterey 12.5.1. WebKitGTK and WPE WebKit users should update to version 2.36.7. Fedora and Debian Linux users should also update their systems. Updating helps prevent arbitrary code execution from malicious web content.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability named as "Apple iOS and macOS Out-of-Bounds Write Vulnerability” was added on August 18, 2022, with a due date of September 8, 2022. The required action is to apply updates according to vendor instructions. This vulnerability can lead to arbitrary code execution when processing malicious web content, and there are reports of it being actively exploited.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787, is an out-of-bounds write issue related to processing malicious web content, which may lead to arbitrary code execution. It affects WebKit, WebKitGTK, and WPE WebKit components in various software configurations.

For more details

CVE-2022-32893 is a high-severity vulnerability affecting various software configurations, including Apple, WebKitGTK, and WPE WebKit. It's crucial to update your software to mitigate the risk of arbitrary code execution when processing malicious web content. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• Full Disclosure: APPLE-SA-2022-08-31-1 iOS 12.5.6

• oss-security - WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008

• oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008

• oss-security - Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008