VulnerabilityModified
CVE-2023-40385
This issue was addressed by removing the vulnerable code.
MEDIUM 6.5EPSS 0.60%
Does this matter?
Lower severity and a low EPSS score (0.60%). Track it; it rarely justifies an emergency change on its own.
Description
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 0.60% probability · 47th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apple/safari · apple/ipados · apple/iphone os · apple/macos
- Source
- product-security@apple.com
References
- https://support.apple.com/en-us/HT213938Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213940Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213941Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213938Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213940Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT213941Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.