Released July 24, 2023
Apple Neural Engine
Available for: Apple Watch Series 4 and later
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-34425: pattern-f (@pattern_F_) of Ant Security Light-Year Lab
Entry added July 27, 2023
Apple Neural Engine
Available for: Apple Watch Series 4 and later
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-38136: Mohamed GHANNAM (@_simo36)
CVE-2023-38580: Mohamed GHANNAM (@_simo36)
Find My
Available for: Apple Watch Series 4 and later
Impact: An app may be able to read sensitive location information
Description: A logic issue was addressed with improved restrictions.
CVE-2023-32416: Wojciech Regula of SecuRing (wojciechregula.blog)
Kernel
Available for: Apple Watch Series 4 and later
Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2023-38590: Zweig of Kunlun Lab
Entry added July 27, 2023
Kernel
Available for: Apple Watch Series 4 and later
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A use-after-free issue was addressed with improved memory management.
CVE-2023-38598: Mohamed GHANNAM (@_simo36)
Entry added July 27, 2023
Kernel
Available for: Apple Watch Series 4 and later
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: An integer overflow was addressed with improved input validation.
CVE-2023-36495: 香农的三蹦子 of Pangu Lab
Entry added July 27, 2023
Kernel
Available for: Apple Watch Series 4 and later
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: An out-of-bounds write issue was addressed with improved input validation.
CVE-2023-38604: an anonymous researcher
Entry added July 27, 2023
Kernel
Available for: Apple Watch Series 4 and later
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-32734: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
CVE-2023-32441: Peter Nguyễn Vũ Hoàng (@peternguyen14) of STAR Labs SG Pte. Ltd.
Kernel
Available for: Apple Watch Series 4 and later
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A use-after-free issue was addressed with improved memory management.
CVE-2023-32381: an anonymous researcher
CVE-2023-32433: Zweig of Kunlun Lab
CVE-2023-35993: Kaitao Xie and Xiaolong Bai of Alibaba Group
Kernel
Available for: Apple Watch Series 4 and later
Impact: An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
Description: This issue was addressed with improved state management.
CVE-2023-38606: Valentin Pashkov, Mikhail Vinogradov, Georgy Kucherin (@kucher1n), Leonid Bezvershenko (@bzvr_), and Boris Larin (@oct0xor) of Kaspersky
libxpc
Available for: Apple Watch Series 4 and later
Impact: An app may be able to gain root privileges
Description: A path handling issue was addressed with improved validation.
CVE-2023-38565: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (xlab.tencent.com)
libxpc
Available for: Apple Watch Series 4 and later
Impact: An app may be able to cause a denial-of-service
Description: A logic issue was addressed with improved checks.
CVE-2023-38593: Noah Roskin-Frazee
WebKit
Available for: Apple Watch Series 4 and later
Impact: A website may be able to track sensitive user information
Description: A logic issue was addressed with improved state management.
WebKit Bugzilla: 257822
CVE-2023-38599: Hritvik Taneja, Jason Kim, Jie Jeff Xu, Stephan van Schaik, Daniel Genkin, and Yuval Yarom
Entry added July 27, 2023
WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing a document may lead to a cross site scripting attack
Description: This issue was addressed with improved checks.
WebKit Bugzilla: 257299
CVE-2023-32445: Johan Carlsson (joaxcar)
Entry added July 27, 2023
WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing web content may lead to arbitrary code execution
Description: A logic issue was addressed with improved restrictions.
WebKit Bugzilla: 257331
CVE-2023-38592:Narendra Bhati (twitter.com/imnarendrabhati) of Suma Soft Pvt. Ltd, Pune - India, Valentino Dalla Valle, Pedro Bernardo, Marco Squarcina, and Lorenzo Veronese of TU Wien
Entry added July 27, 2023
WebKit
Available for: Apple Watch Series 4 and later
Impact: A website may be able to bypass Same Origin Policy
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 256549
CVE-2023-38572: Narendra Bhati (twitter.com/imnarendrabhati) of Suma Soft Pvt. Ltd, Pune - India
WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 256865
CVE-2023-38594: Yuhao Hu
WebKit Bugzilla: 256573
CVE-2023-38595: an anonymous researcher, Jiming Wang, Jikai Ren
WebKit Bugzilla: 257387
CVE-2023-38600: Anonymous working with Trend Micro Zero Day Initiative
WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 258058
CVE-2023-38611: Francisco Alonso (@revskills)
WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 259231
CVE-2023-37450: an anonymous researcher
WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 257684
CVE-2023-42866: Francisco Alonso (@revskills) and Junsung Lee
Entry added December 21, 2023
WebKit Web Inspector
Available for: Apple Watch Series 4 and later
Impact: Processing web content may disclose sensitive information
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 256932
CVE-2023-38133: YeongHyeon Choi (@hyeon101010)
