CVE-2023-38599
MEDIUMSafari < 16.6 - Sensitive Information Tracking via Logic Issue
Title source: llmDescription
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A website may be able to track sensitive user information.
References (11)
Core 11
Core References
Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/08/02/1
Vendor Advisory
https://support.apple.com/en-us/HT213841
Vendor Advisory
https://support.apple.com/en-us/HT213842
Vendor Advisory
https://support.apple.com/en-us/HT213843
Vendor Advisory
https://support.apple.com/en-us/HT213846
Vendor Advisory
https://support.apple.com/en-us/HT213847
Vendor Advisory
https://support.apple.com/en-us/HT213848
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/
Third Party Advisory
https://www.debian.org/security/2023/dsa-5468
Third Party Advisory
https://security.gentoo.org/glsa/202401-04
Scores
CVSS v3
6.5
EPSS
0.0058
EPSS Percentile
69.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
Status
published
Products (6)
apple/ipados
< 15.7.8
apple/iphone_os
< 15.7.8
apple/macos
13.0 - 13.5
apple/safari
< 16.6
apple/tvos
< 16.6
apple/watchos
< 9.6
Published
Jul 28, 2023
Tracked Since
Feb 18, 2026