site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-09-26-2023-1 Safari 17 Safari 17 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213941. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Safari Available for: macOS Monterey and macOS Ventura Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: A window management issue was addressed with improved state management. CVE-2023-40417: Narendra Bhati From Suma Soft Pvt. Ltd, Pune (India) WebKit Available for: macOS Monterey and macOS Ventura Impact: An attacker with JavaScript execution may be able to execute arbitrary code Description: This issue was addressed with improved iframe sandbox enforcement. WebKit Bugzilla: 251276 CVE-2023-40451: an anonymous researcher WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved checks. WebKit Bugzilla: 256551 CVE-2023-41074: 이준성(Junsung Lee) of Cross Republic and me Li WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 239758 CVE-2023-35074: Abysslab Dong Jun Kim(@smlijun) and Jong Seong Kim(@nevul37) WebKit Available for: macOS Ventura Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7. Description: The issue was addressed with improved checks. WebKit Bugzilla: 261544 CVE-2023-41993: Bill Marczak of The Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group Additional recognition WebKit We would like to acknowledge Khiem Tran and Narendra Bhati From Suma Soft Pvt. Ltd, Pune (India) for their assistance. WebRTC We would like to acknowledge an anonymous researcher for their assistance. Safari 17 may be obtained from the Mac App Store. All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJUACgkQX+5d1TXa Ivpeow//fqizRQaeQAD5q3p5GVl0iLAkgQxHtnX+tmEBdpGLkXV9nFABMbYQPXew r8jkqFyCmqU8gUCOIAMO4OW48VYH/U0xDLMRo0jrSPxa5XIQ28Y7IIwREjy0+GZi zqco7UBulcB+46AP05cXcXbhXEcJsb79qlBwRUvjXDMr8q8yy3tee+iPx+X4z8Iz AY713psUi7Gay8i05rLlVV5QTqmXa/qXZ+afVGGbvEIFoj83g8p0sHdsc2lIiqSw ydcgZEbxcOyuGUknOVBioiYxXSgxxNrxlecP2eQzaGJxBAn6xPuA7r1d1ONmIp7E lVFzwa+9Lzkpg46Snb6n+6q8gRvzue3w11aaEFHfHebqq3tewcDlCaQkuLGyRQx9 0MnCY5cuzZTUqFlQdPcVkcZECqSHE3eS+/LsL9af45QUbRRSz3ZrAnSz1+iSb6mt KwhyOx/eY8YfYMqkn1xyJ9EuL5TVlwK89CSLsl2MhwfA2IIIYdNcXtYiY1VYL17b fhgtTwAvLwdVSixrdZUbInyMDfZprjPOHSvWz1tmRDjs/keAoupngVRYEK/HGUFY yv0BEQXglBKYfadSWZAhoqYMiu/Pp97W3YZ9XCX0o1cKy3plQ0W/ox8hS89Cy7mK pCaqxMobXyuaH01VRSr0b+M9pjB0IyeYKR4C3fbrrnCsJn15Djk= =rE6F -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com