Message-id: <ECD713A4-E9B9-4123-855B-BCD278327C44@lists.apple.com>
Date: Tue, 26 Sep 2023 14:29:42 -0700
From: Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-09-26-2023-1 Safari 17

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-09-26-2023-1 Safari 17

Safari 17 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213941.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Safari
Available for: macOS Monterey and macOS Ventura
Impact: Visiting a website that frames malicious content may lead to UI
spoofing
Description: A window management issue was addressed with improved state
management.
CVE-2023-40417: Narendra Bhati From Suma Soft Pvt. Ltd, Pune (India)

WebKit
Available for: macOS Monterey and macOS Ventura
Impact: An attacker with JavaScript execution may be able to execute
arbitrary code
Description: This issue was addressed with improved iframe sandbox
enforcement.
WebKit Bugzilla: 251276
CVE-2023-40451: an anonymous researcher

WebKit
Available for: macOS Monterey and macOS Ventura
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 256551
CVE-2023-41074: 이준성(Junsung Lee) of Cross Republic and me Li

WebKit
Available for: macOS Monterey and macOS Ventura
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 239758
CVE-2023-35074: Abysslab Dong Jun Kim(@smlijun) and Jong Seong
Kim(@nevul37)

WebKit
Available for: macOS Ventura
Impact: Processing web content may lead to arbitrary code execution.
Apple is aware of a report that this issue may have been actively
exploited against versions of iOS before iOS 16.7.
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 261544
CVE-2023-41993: Bill Marczak of The Citizen Lab at The University of
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Additional recognition

WebKit
We would like to acknowledge Khiem Tran and Narendra Bhati From Suma
Soft Pvt. Ltd, Pune (India) for their assistance.

WebRTC
We would like to acknowledge an anonymous researcher for their
assistance.

Safari 17 may be obtained from the Mac App Store.
All information is also posted on the Apple Security Updates
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJUACgkQX+5d1TXa
Ivpeow//fqizRQaeQAD5q3p5GVl0iLAkgQxHtnX+tmEBdpGLkXV9nFABMbYQPXew
r8jkqFyCmqU8gUCOIAMO4OW48VYH/U0xDLMRo0jrSPxa5XIQ28Y7IIwREjy0+GZi
zqco7UBulcB+46AP05cXcXbhXEcJsb79qlBwRUvjXDMr8q8yy3tee+iPx+X4z8Iz
AY713psUi7Gay8i05rLlVV5QTqmXa/qXZ+afVGGbvEIFoj83g8p0sHdsc2lIiqSw
ydcgZEbxcOyuGUknOVBioiYxXSgxxNrxlecP2eQzaGJxBAn6xPuA7r1d1ONmIp7E
lVFzwa+9Lzkpg46Snb6n+6q8gRvzue3w11aaEFHfHebqq3tewcDlCaQkuLGyRQx9
0MnCY5cuzZTUqFlQdPcVkcZECqSHE3eS+/LsL9af45QUbRRSz3ZrAnSz1+iSb6mt
KwhyOx/eY8YfYMqkn1xyJ9EuL5TVlwK89CSLsl2MhwfA2IIIYdNcXtYiY1VYL17b
fhgtTwAvLwdVSixrdZUbInyMDfZprjPOHSvWz1tmRDjs/keAoupngVRYEK/HGUFY
yv0BEQXglBKYfadSWZAhoqYMiu/Pp97W3YZ9XCX0o1cKy3plQ0W/ox8hS89Cy7mK
pCaqxMobXyuaH01VRSr0b+M9pjB0IyeYKR4C3fbrrnCsJn15Djk=
=rE6F
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists