A high-severity vulnerability, identified as CVE-2023-37450, has been discovered in various Apple systems, including iOS, iPadOS, Safari, tvOS, macOS, and watchOS. This vulnerability affects the processing of web content and may lead to arbitrary code execution. Apple has acknowledged reports of active exploitation of this issue. To address the vulnerability, Apple has implemented improved checks in their software updates. Users are advised to update their systems to the latest versions to ensure protection against this security threat.

How do I know if I'm affected?

If you're using an Apple device, you might be affected by the vulnerability. This issue can lead to arbitrary code execution when processing web content. Affected versions include Safari up to 16.5.1, iOS and iPadOS up to 16.5, macOS Ventura from 13.0 to 13.4, TVOS up to 16.5, and watchOS up to 9.5. To check if you're affected, verify your device's software version and compare it to the mentioned affected versions.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your Apple device to the latest software version. For Safari, update to version 16.5.2 or later. For iOS and iPadOS, update to version 16.6 or later. For macOS Ventura, update to version 13.5 or later. Updating your software will help protect your device from potential security threats.

Is CVE-2023-37450 in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, named Apple Multiple Products WebKit Code Execution Vulnerability, was added to the catalog on July 13, 2023, with a due date of August 3, 2023. The required action is to apply updates as per vendor instructions or discontinue use of the product if updates are unavailable.

Weakness enumeration

The Weakness Enumeration section of the NVD page lists the vulnerability as having insufficient information (NVD-CWE-noinfo).

For more details

CVE-2023-37450 is a high-severity vulnerability affecting various Apple systems. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page and the resources listed below.

• WebKitGTK+: Multiple Vulnerabilities (GLSA 202401-04) — Gentoo security

• About the security content of Safari 16.5.2 - Apple Support

• About the security content of iOS 16.6 and iPadOS 16.6 - Apple Support (1)

• About the security content of macOS Ventura 13.5 - Apple Support (2)