VulnerableCode Vulnerability Details

Search for vulnerabilities

Vulnerability details: VCID-2t3j-55jy-aaas

Essentials
Severities (98)
References (28)
Severity details (16)
Exploits (1)
EPSS
History (0)

Vulnerability ID	VCID-2t3j-55jy-aaas
Aliases	CVE-2023-32435
Summary	A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Status	Published
Exploitability	2.0
Weighted Severity	7.9
Risk	10.0
Affected and Fixed Packages	Package Details

Weaknesses (2)

CWE-787	Out-of-bounds Write
CWE-94	Improper Control of Generation of Code ('Code Injection')

System	Score	Found at
cvssv3	8.8	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32435.json
epss	0.00168	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00168	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00168	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00168	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00168	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00168	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00168	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00168	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00170	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00187	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00187	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00191	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00443	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00785	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00888	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00888	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.00888	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.01074	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
epss	0.03244	https://api.first.org/data/v1/epss?cve=CVE-2023-32435
cvssv3.1	8.8	https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3	8.8	https://nvd.nist.gov/vuln/detail/CVE-2023-32435
cvssv3.1	8.8	https://nvd.nist.gov/vuln/detail/CVE-2023-32435
cvssv3.1	8.8	https://support.apple.com/en-us/HT213670
ssvc	Attend	https://support.apple.com/en-us/HT213670
ssvc	Track	https://support.apple.com/en-us/HT213670
cvssv3.1	8.8	https://support.apple.com/en-us/HT213671
ssvc	Attend	https://support.apple.com/en-us/HT213671
ssvc	Track	https://support.apple.com/en-us/HT213671
cvssv3.1	8.8	https://support.apple.com/en-us/HT213676
ssvc	Attend	https://support.apple.com/en-us/HT213676
ssvc	Track	https://support.apple.com/en-us/HT213676
cvssv3.1	8.8	https://support.apple.com/en-us/HT213811
ssvc	Attend	https://support.apple.com/en-us/HT213811
ssvc	Track	https://support.apple.com/en-us/HT213811

Reference id	Reference type	URL
		https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32435.json
		https://api.first.org/data/v1/epss?cve=CVE-2023-32435
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0108
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32885
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27932
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27954
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28198
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28205
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32370
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32393
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32435
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35074
		http://seclists.org/fulldisclosure/2023/Jul/5
		https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
		https://support.apple.com/en-us/HT213670
		https://support.apple.com/en-us/HT213671
		https://support.apple.com/en-us/HT213676
		https://support.apple.com/en-us/HT213811
		http://www.openwall.com/lists/oss-security/2023/06/29/1
2218626		https://bugzilla.redhat.com/show_bug.cgi?id=2218626
cpe:2.3:a:apple:safari::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:safari::::::::
cpe:2.3:o:apple:ipados::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:ipados::::::::
cpe:2.3:o:apple:iphone_os::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:iphone_os::::::::
cpe:2.3:o:apple:macos::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:macos::::::::
CVE-2023-32435		https://nvd.nist.gov/vuln/detail/CVE-2023-32435
RHSA-2023:4201		https://access.redhat.com/errata/RHSA-2023:4201
RHSA-2023:4202		https://access.redhat.com/errata/RHSA-2023:4202
USN-6264-1		https://usn.ubuntu.com/6264-1/

Data source	KEV
Date added	June 23, 2023
Description	Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action	Apply updates per vendor instructions.
Due date	July 14, 2023
Note	https://support.apple.com/en-us/HT213670, https://support.apple.com/en-us/HT213671, https://support.apple.com/en-us/HT213676, https://support.apple.com/en-us/HT213811; https://nvd.nist.gov/vuln/detail/CVE-2023-32435
Ransomware campaign use	Unknown

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-32435.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-32435

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-32435

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/en-us/HT213670

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-27T22:13:33Z/ Found at https://support.apple.com/en-us/HT213670

Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-16T19:31:51Z/ Found at https://support.apple.com/en-us/HT213670

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/en-us/HT213671

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-27T22:13:33Z/ Found at https://support.apple.com/en-us/HT213671

Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-16T19:31:51Z/ Found at https://support.apple.com/en-us/HT213671

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/en-us/HT213676

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-27T22:13:33Z/ Found at https://support.apple.com/en-us/HT213676

Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-16T19:31:51Z/ Found at https://support.apple.com/en-us/HT213676

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/en-us/HT213811

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-27T22:13:33Z/ Found at https://support.apple.com/en-us/HT213811

Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-16T19:31:51Z/ Found at https://support.apple.com/en-us/HT213811

Exploit Prediction Scoring System (EPSS)

Percentile	0.54462
EPSS Score	0.00168
Published At	Nov. 1, 2024, midnight

Date	Actor	Action	Source	VulnerableCode Version
There are no relevant records.