About Apple security updates
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Safari 17
Released September 26, 2023
Safari
Available for: macOS Monterey and macOS Ventura
Impact: Visiting a website that frames malicious content may lead to UI spoofing
Description: A window management issue was addressed with improved state management.
CVE-2023-40417: Narendra Bhati (twitter.com/imnarendrabhati) of Suma Soft Pvt. Ltd, Pune (India)
Entry updated January 2, 2024
WebKit
Available for: macOS Monterey and macOS Ventura
Impact: A remote attacker may be able to view leaked DNS queries with Private Relay turned on
Description: This issue was addressed by removing the vulnerable code.
WebKit Bugzilla: 257303
CVE-2023-40385: Anonymous
Entry added January 2, 2024
WebKit
Available for: macOS Monterey and macOS Ventura
Impact: Processing web content may lead to arbitrary code execution
Description: A correctness issue was addressed with improved checks.
WebKit Bugzilla: 258592
CVE-2023-42833: Dong Jun Kim (@smlijun) and Jong Seong Kim (@nevul37) of AbyssLab
Entry added January 2, 2024
WebKit
Available for: macOS Monterey and macOS Ventura
Impact: Processing web content may lead to arbitrary code execution
Description: A use-after-free issue was addressed with improved memory management.
WebKit Bugzilla: 258992
CVE-2023-40414: Francisco Alonso (@revskills)
Entry added January 2, 2024
WebKit
Available for: macOS Monterey and macOS Ventura
Impact: An attacker with JavaScript execution may be able to execute arbitrary code
Description: This issue was addressed with improved iframe sandbox enforcement.
WebKit Bugzilla: 251276
CVE-2023-40451: an anonymous researcher
WebKit
Available for: macOS Monterey and macOS Ventura
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 256551
CVE-2023-41074: 이준성(Junsung Lee) of Cross Republic and Jie Ding(@Lime) from HKUS3 Lab
Entry updated January 2, 2024
WebKit
Available for: macOS Monterey and macOS Ventura
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 239758
CVE-2023-35074: Ajou University Abysslab Dong Jun Kim(@smlijun) and Jong Seong Kim(@nevul37)
Entry updated January 2, 2024
WebKit
Available for: macOS Ventura
Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 261544
CVE-2023-41993: Bill Marczak of The Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group
Additional recognition
WebKit
We would like to acknowledge Khiem Tran and Narendra Bhati From Suma Soft Pvt. Ltd, Pune (India) for their assistance.
WebRTC
We would like to acknowledge an anonymous researcher for their assistance.