Mitigation Instructions for CVE-2023- 41990

SUBJECT: CVE-2023-41990: Apple Multiple Products Code Execution Vulnerability - Detailed Mitigation Guide

Tech Stack (Affected Software)

Apple products including iPhone, iPad, iPod touch, Apple Watch, Apple TV, and Mac computers running versions:

• iOS versions before 16.3
• iPadOS versions before 16.3
• macOS versions before 12.6.8 (Monterey) or 11.7.9 (Big Sur)
• tvOS versions before 16.3
• watchOS versions before 9.3

DATE(S) ISSUED: 09/11/2023

NVD Last Modified: 02/16/2024

CRITICALITY: CVSS v3 Score: 7.8 (HIGH)

OVERVIEW: 

This vulnerability template details the mitigation strategies for CVE-2023-41990, a high-severity vulnerability affecting various Apple products, including iOS, iPadOS, macOS, tvOS, and watchOS. This vulnerability allows attackers to execute arbitrary code on vulnerable devices when processing a font file.

IMPACT

Successful exploitation of this vulnerability could allow attackers to:

• Take complete control of the affected device.

• Steal sensitive information, such as passwords and financial data.

• Install malware.
• Disrupt device operations.

MITIGATION/SOLUTIONS

Here are the recommended mitigation strategies:

1. Apply security updates:

• The most critical mitigation strategy is to install the latest security updates provided by Apple for your affected devices. These updates address the vulnerability and significantly reduce the risk of exploitation.
• You can find instructions on updating your devices on the Apple website

2. Avoid untrusted font sources:

• Do not download or install font files from untrusted sources. Only install fonts from reputable sources to minimize the risk of encountering malicious font files.

3. Disable font previews:

• Consider disabling font previews in applications like email and web browsers. This can help reduce the attack surface, as attackers might exploit font previews to trigger the vulnerability.

ADDITIONAL RESOURCES

• watchOS 9.3 Security Advisory

• tvOS 16.3 Security Advisory

• macOS Ventura 13.2 Security Advisory

•  iOS 16.3 and iPadOS 16.3 Security Advisory

•  iOS 15.7.8 and iPadOS 15.7.8 Security Advisory

• macOS Monterey 12.6.8 Security Advisory
• macOS Big Sur 11.7.9 Security Advisory

CONCLUSION

• Applying the recommended mitigation strategies, especially installing the latest security updates, is crucial to protect your Apple devices from exploitation of CVE-2023-41990. Remember to prioritize patching vulnerabilities promptly and implement additional security measures to enhance your overall device security posture.