What is CVE-2023-32439?

CVE-2023-32439 is a high-severity vulnerability in Apple systems, including Safari, iOS, iPadOS, and macOS Ventura. Caused by processing maliciously crafted web content, this vulnerability may lead to arbitrary code execution. Apple is aware of reports of active exploitation. Users are advised to update their devices to the latest software versions to mitigate the risk.

Who is impacted by CVE-2023-32439?

CVE-2023-32439 affects users of Apple software, including Safari, iOS, iPadOS, and macOS. Impacted versions include Safari up to 16.5.0, iPadOS up to 15.7.6 and from 16.0 to 16.5.0, iPhone OS up to 15.7.6 and from 16.0 to 16.5.0, and macOS from 13.0 to 13.4.0. Users of the net-libs/webkit-gtk package on all architectures with versions below 2.42.3 are also affected. This vulnerability may lead to arbitrary code execution when processing maliciously crafted web content.

What to do if CVE-2023-32439 affected you

If you're affected by the CVE-2023-32439 vulnerability, it's crucial to update your devices to the latest software versions. Here are the steps to follow:

1. Update your Apple device to the latest iOS, iPadOS, or macOS version.

2. For WebKitGTK+ users, upgrade to the latest version (>=net-libs/webkit-gtk-2.42.3).

3. Avoid visiting untrusted websites or downloading files from unknown sources.

4. Keep all software and applications up-to-date with the latest security patches.

Is in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-32439 vulnerability, known as Apple Multiple Products WebKit Type Confusion Vulnerability, is indeed present in CISA's Known Exploited Vulnerabilities Catalog. It was added on June 23, 2023, with a due date of July 14, 2023. To address this vulnerability, users must apply updates as per vendor instructions. In simple terms, this vulnerability may allow an attacker to execute arbitrary code on a victim's system by processing malicious web content.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-843, which involves accessing resources using incompatible types, also known as 'Type Confusion'.

Learn More

For a comprehensive understanding of this vulnerability, consult the NVD page and the resources listed below.

• Gentoo Security: WebKitGTK+ Multiple Vulnerabilities

• Apple Support: Security Content of macOS Ventura 13.4.1

• Apple Support: Security Content of iOS 16.5.1 and iPadOS 16.5.1