Apple Safari
Recent Apple Safari Security Advisories
Advisory | Title | Published |
---|---|---|
HT213941 | Safari 17 Security Content | September 26, 2023 |
HT213930 | Safari 16.6.1 Security Content | September 21, 2023 |
HT213847 | Safari 16.6 Security Content | July 24, 2023 |
HT213826 | Safari 16.5.2 Security Content | July 10, 2023 |
HT213816 | Safari 16.5.1 Security Content | June 21, 2023 |
HT213762 | Safari 16.5 Security Content | May 18, 2023 |
HT213722 | Safari 16.4.1 Security Content | April 7, 2023 |
HT213671 | Safari 16.4 Security Content | March 27, 2023 |
HT213638 | Safari 16.3.1 Security Content | February 13, 2023 |
HT213600 | Safari 16.3 Security Content | January 23, 2023 |
Known Exploited Apple Safari Vulnerabilities
The following Apple Safari vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
Title | Description | Added |
---|---|---|
Apple Safari Webkit Browser Engine Buffer Overflow Vulnerability | Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. CVE-2021-30665 | November 3, 2021 |
Apple Safari Webkit Browser Engine Integer Overflow Vulnerability | Integer overflow. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2021-30663 | November 3, 2021 |
By the Year
In 2023 there have been 36 vulnerabilities in Apple Safari with an average score of 7.9 out of ten. Last year Safari had 40 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Safari in 2023 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2023 is greater by 0.12.
Year | Vulnerabilities | Average Score |
---|---|---|
2023 | 36 | 7.91 |
2022 | 40 | 7.79 |
2021 | 35 | 7.66 |
2020 | 59 | 7.23 |
2019 | 166 | 8.13 |
2018 | 41 | 8.11 |
It may take a day or so for new Safari vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apple Safari Security Vulnerabilities
A window management issue was addressed with improved state management
CVE-2023-40417
5.4 - Medium
- September 27, 2023
A window management issue was addressed with improved state management. This issue is fixed in Safari 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Visiting a website that frames malicious content may lead to UI spoofing.
The issue was addressed with improved checks
CVE-2023-41074
8.8 - High
- September 27, 2023
The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
This issue was addressed with improved iframe sandbox enforcement
CVE-2023-40451
8.8 - High
- September 27, 2023
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 17. An attacker with JavaScript execution may be able to execute arbitrary code.
The issue was addressed with improved memory handling
CVE-2023-35074
8.8 - High
- September 27, 2023
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
The issue was addressed with improved checks
CVE-2023-41993
9.8 - Critical
- September 21, 2023
The issue was addressed with improved checks. This issue is fixed in Safari 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Improper Check for Unusual or Exceptional Conditions
The issue was addressed with improved bounds checks
CVE-2022-48503
8.8 - High
- August 14, 2023
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
This issue was addressed with improved checks
CVE-2023-32445
6.1 - Medium
- July 28, 2023
This issue was addressed with improved checks. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. Processing a document may lead to a cross site scripting attack.
XSS
A logic issue was addressed with improved state management
CVE-2023-38599
6.5 - Medium
- July 28, 2023
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A website may be able to track sensitive user information.
The issue was addressed with improved checks
CVE-2023-38572
7.5 - High
- July 27, 2023
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. A website may be able to bypass Same Origin Policy.
The issue was addressed with improved checks
CVE-2023-38595
8.8 - High
- July 27, 2023
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution.
The issue was addressed with improved checks
CVE-2023-38600
8.8 - High
- July 27, 2023
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution.
The issue was addressed with improved memory handling
CVE-2023-38611
8.8 - High
- July 27, 2023
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution.
The issue was addressed with improved checks
CVE-2023-37450
8.8 - High
- July 27, 2023
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
The issue was addressed with improved checks
CVE-2023-38133
6.5 - Medium
- July 27, 2023
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may disclose sensitive information.
The issue was addressed with improved checks
CVE-2023-38594
8.8 - High
- July 27, 2023
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution.
The issue was addressed with improved checks
CVE-2023-38597
8.8 - High
- July 27, 2023
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5, Safari 16.6. Processing web content may lead to arbitrary code execution.
An out-of-bounds read was addressed with improved input validation
CVE-2023-28204
6.5 - Medium
- June 23, 2023
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.
Out-of-bounds Read
An out-of-bounds read was addressed with improved input validation
CVE-2023-32402
6.5 - Medium
- June 23, 2023
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information.
Out-of-bounds Read
The issue was addressed with improved bounds checks
CVE-2023-32409
8.6 - High
- June 23, 2023
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
A buffer overflow issue was addressed with improved memory handling
CVE-2023-32423
6.5 - Medium
- June 23, 2023
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information.
Classic Buffer Overflow
A memory corruption issue was addressed with improved state management
CVE-2023-32435
8.8 - High
- June 23, 2023
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Memory Corruption
A type confusion issue was addressed with improved checks
CVE-2023-32439
8.8 - High
- June 23, 2023
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Object Type Confusion
A use-after-free issue was addressed with improved memory management
CVE-2023-32373
8.8 - High
- June 23, 2023
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Dangling pointer
A memory corruption issue was addressed with improved validation
CVE-2022-32885
8.8 - High
- May 08, 2023
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution
Memory Corruption
This issue was addressed with improved state management
CVE-2023-28201
9.8 - Critical
- May 08, 2023
This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4. A remote user may be able to cause unexpected app termination or arbitrary code execution.
This issue was addressed with improved state management
CVE-2023-27932
5.5 - Medium
- May 08, 2023
This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tvOS 16.4, watchOS 9.4. Processing maliciously crafted web content may bypass Same Origin Policy.
The issue was addressed by removing origin information
CVE-2023-27954
6.5 - Medium
- May 08, 2023
The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information.
A use after free issue was addressed with improved memory management
CVE-2023-28205
8.8 - High
- April 10, 2023
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Dangling pointer
A spoofing issue existed in the handling of URLs
CVE-2022-46705
4.3 - Medium
- February 27, 2023
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, Safari 16.2. Visiting a malicious website may lead to address bar spoofing.
The issue was addressed with improved checks
CVE-2023-23496
8.8 - High
- February 27, 2023
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2, watchOS 9.3, iOS 15.7.2 and iPadOS 15.7.2, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.
The issue was addressed with improved UI handling
CVE-2022-32891
6.1 - Medium
- February 27, 2023
The issue was addressed with improved UI handling. This issue is fixed in Safari 16, tvOS 16, watchOS 9, iOS 16. Visiting a website that frames malicious content may lead to UI spoofing.
Clickjacking
The issue was addressed with improved memory handling
CVE-2023-23517
8.8 - High
- February 27, 2023
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.
The issue was addressed with improved memory handling
CVE-2023-23518
8.8 - High
- February 27, 2023
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.
A type confusion issue was addressed with improved checks
CVE-2023-23529
8.8 - High
- February 27, 2023
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Object Type Confusion
A use after free issue was addressed with improved memory management
CVE-2022-42826
8.8 - High
- February 27, 2023
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1 and iPadOS 16, Safari 16.1. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
The issue was addressed with improved UI handling
CVE-2022-32784
6.5 - Medium
- February 27, 2023
The issue was addressed with improved UI handling. This issue is fixed in Safari 15.6, iOS 15.6 and iPadOS 15.6. Visiting a maliciously crafted website may leak sensitive data.
An issue existed with the file paths used to store website data
CVE-2022-32833
5.3 - Medium
- December 15, 2022
An issue existed with the file paths used to store website data. The issue was resolved by improving how website data is stored. This issue is fixed in iOS 16. An unauthorized user may be able to access browsing history.
A type confusion issue was addressed with improved state handling
CVE-2022-42856
8.8 - High
- December 15, 2022
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
Object Type Confusion
A race condition was addressed with additional validation
CVE-2022-46689
7 - High
- December 15, 2022
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
Race Condition
A memory consumption issue was addressed with improved memory handling
CVE-2022-46691
8.8 - High
- December 15, 2022
A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A memory corruption issue was addressed with improved input validation
CVE-2022-46696
8.8 - High
- December 15, 2022
A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A logic issue was addressed with improved checks
CVE-2022-46698
6.5 - Medium
- December 15, 2022
A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information.
A memory corruption issue was addressed with improved state management
CVE-2022-46699
8.8 - High
- December 15, 2022
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A memory corruption issue was addressed with improved input validation
CVE-2022-46700
8.8 - High
- December 15, 2022
A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
The issue was addressed with improved memory handling
CVE-2022-42852
6.5 - Medium
- December 15, 2022
The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory.
A memory corruption issue was addressed with improved state management
CVE-2022-42863
8.8 - High
- December 15, 2022
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A use after free issue was addressed with improved memory management
CVE-2022-42867
8.8 - High
- December 15, 2022
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A logic issue was addressed with improved state management
CVE-2022-46692
5.5 - Medium
- December 15, 2022
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy.
An access issue was addressed with improvements to the sandbox
CVE-2022-32892
8.6 - High
- November 01, 2022
An access issue was addressed with improvements to the sandbox. This issue is fixed in Safari 16, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13. A sandboxed process may be able to circumvent sandbox restrictions.
A use after free issue was addressed with improved memory management
CVE-2022-26709
8.8 - High
- November 01, 2022
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A memory corruption issue was addressed with improved state management
CVE-2022-26716
8.8 - High
- November 01, 2022
A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A use after free issue was addressed with improved memory management
CVE-2022-26717
8.8 - High
- November 01, 2022
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5, iTunes 12.12.4 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A memory corruption issue was addressed with improved state management
CVE-2022-26719
8.8 - High
- November 01, 2022
A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A type confusion issue was addressed with improved memory handling
CVE-2022-42823
8.8 - High
- November 01, 2022
A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may lead to arbitrary code execution.
Object Type Confusion
A logic issue was addressed with improved state management
CVE-2022-42824
5.5 - Medium
- November 01, 2022
A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose sensitive user information.
The issue was addressed with improved UI handling
CVE-2022-42799
6.1 - Medium
- November 01, 2022
The issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Visiting a malicious website may lead to user interface spoofing.
Clickjacking
A use after free issue was addressed with improved memory management
CVE-2022-32922
8.8 - High
- November 01, 2022
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A correctness issue in the JIT was addressed with improved checks
CVE-2022-32923
6.5 - Medium
- November 01, 2022
A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose internal states of the app.
A buffer overflow issue was addressed with improved memory handling
CVE-2022-22629
8.8 - High
- September 23, 2022
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A use after free issue was addressed with improved memory management
CVE-2022-22624
8.8 - High
- September 23, 2022
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, iOS 15.4 and iPadOS 15.4, tvOS 15.4, Safari 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A use after free issue was addressed with improved memory management
CVE-2022-22628
8.8 - High
- September 23, 2022
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A logic issue was addressed with improved state management
CVE-2022-22637
8.8 - High
- September 23, 2022
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. A malicious website may cause unexpected cross-origin behavior.
A memory corruption issue was addressed with improved state management
CVE-2022-22610
8.8 - High
- September 23, 2022
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to code execution.
Memory Corruption
A memory corruption issue was addressed with improved state management
CVE-2022-26700
8.8 - High
- September 23, 2022
A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to code execution.
Memory Corruption
A buffer overflow issue was addressed with improved memory handling
CVE-2022-32886
8.8 - High
- September 20, 2022
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
An out-of-bounds read was addressed with improved bounds checking
CVE-2022-32912
8.8 - High
- September 20, 2022
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution.
Out-of-bounds Read
A logic issue was addressed with improved state management
CVE-2022-32861
5.3 - Medium
- September 20, 2022
A logic issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. A user may be tracked through their IP address.
A memory corruption issue was addressed with improved state management
CVE-2022-32863
9.8 - Critical
- September 20, 2022
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A logic issue was addressed with improved state management
CVE-2022-32868
4.3 - Medium
- September 20, 2022
A logic issue was addressed with improved state management. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. A website may be able to track users through Safari web extensions.
An out-of-bounds write issue was addressed with improved bounds checking
CVE-2022-32893
8.8 - High
- August 24, 2022
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Memory Corruption
A validation issue was addressed with improved input sanitization
CVE-2022-22589
6.1 - Medium
- March 18, 2022
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript.
A cross-origin issue in the IndexDB API was addressed with improved input validation
CVE-2022-22594
6.5 - Medium
- March 18, 2022
A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.
Origin Validation Error
A use after free issue was addressed with improved memory management
CVE-2022-22620
8.8 - High
- March 18, 2022
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
Dangling pointer
A use after free issue was addressed with improved memory management
CVE-2022-22590
8.8 - High
- March 18, 2022
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A logic issue was addressed with improved state management
CVE-2022-22592
6.5 - Medium
- March 18, 2022
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
A user interface issue was addressed
CVE-2022-22654
4.3 - Medium
- March 18, 2022
A user interface issue was addressed. This issue is fixed in watchOS 8.5, Safari 15.4. Visiting a malicious website may lead to address bar spoofing.
A use after free issue was addressed with improved memory management
CVE-2021-30809
8.8 - High
- October 28, 2021
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A type confusion issue was addressed with improved state handling
CVE-2021-30818
8.8 - High
- October 28, 2021
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.
Object Type Confusion
A logic issue was addressed with improved restrictions
CVE-2021-30823
6.5 - Medium
- October 28, 2021
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS.
An out-of-bounds read was addressed with improved input validation
CVE-2021-30836
5.5 - Medium
- October 28, 2021
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory.
Out-of-bounds Read
A memory corruption issue was addressed with improved memory handling
CVE-2021-30848
7.8 - High
- October 19, 2021
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to code execution.
Memory Corruption
Multiple memory corruption issues were addressed with improved memory handling
CVE-2021-30849
7.8 - High
- October 19, 2021
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A memory corruption issue was addressed with improved memory handling
CVE-2021-30846
7.8 - High
- October 19, 2021
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
An input validation issue was addressed with improved input validation
CVE-2021-1825
6.1 - Medium
- September 08, 2021
An input validation issue was addressed with improved input validation. This issue is fixed in iTunes 12.11.3 for Windows, iCloud for Windows 12.3, macOS Big Sur 11.3, Safari 14.1, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may lead to a cross site scripting attack.
XSS
An integer overflow was addressed with improved input validation
CVE-2021-30663
8.8 - High
- September 08, 2021
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.
Integer Overflow or Wraparound
A logic issue was addressed with improved state management
CVE-2021-30689
6.1 - Medium
- September 08, 2021
A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.
XSS
A logic issue was addressed with improved restrictions
CVE-2021-30682
5.5 - Medium
- September 08, 2021
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak sensitive user information.
A null pointer dereference was addressed with improved input validation
CVE-2021-30698
7.5 - High
- September 08, 2021
A null pointer dereference was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.4, Safari 14.1.1, iOS 14.6 and iPadOS 14.6. A remote attacker may be able to cause a denial of service.
NULL Pointer Dereference
A use after free issue was addressed with improved memory management
CVE-2021-30661
8.8 - High
- September 08, 2021
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
Dangling pointer
A logic issue was addressed with improved restrictions
CVE-2021-30720
5.4 - Medium
- September 08, 2021
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers.
authentification
Multiple memory corruption issues were addressed with improved memory handling
CVE-2021-30734
8.8 - High
- September 08, 2021
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
This issue was addressed with improved checks
CVE-2021-30797
8.8 - High
- September 08, 2021
This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to code execution.
A type confusion issue was addressed with improved state handling
CVE-2021-30758
8.8 - High
- September 08, 2021
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to arbitrary code execution.
Object Type Confusion
Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins
CVE-2021-30744
6.1 - Medium
- September 08, 2021
Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.
XSS
Multiple memory corruption issues were addressed with improved memory handling
CVE-2021-30749
8.8 - High
- September 08, 2021
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Memory Corruption
A use after free issue was addressed with improved memory management
CVE-2021-30795
8.8 - High
- September 08, 2021
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
A use after free issue was addressed with improved memory management
CVE-2021-30951
8.8 - High
- August 24, 2021
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Dangling pointer
An out-of-bounds read was addressed with improved bounds checking
CVE-2021-30953
8.8 - High
- August 24, 2021
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Out-of-bounds Read
An integer overflow was addressed with improved input validation
CVE-2021-30952
7.8 - High
- August 24, 2021
An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
Integer Overflow or Wraparound
A logic issue was addressed with improved state management
CVE-2021-30861
5.5 - Medium
- August 24, 2021
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1. A malicious application may bypass Gatekeeper checks.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apple Safari or by Apple? Click the Watch button to subscribe.
