CVE-2023-40456

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10. An app may be able to access edited photos saved to a temporary directory.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Apple	iOS and iPadOS	>= unspecified, < 17
Apple	tvOS	>= unspecified, < 17
Apple	watchOS	>= unspecified, < 10

References

http://seclists.org/fulldisclosure/2023/Oct/10Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/8
http://seclists.org/fulldisclosure/2023/Oct/9
https://support.apple.com/en-us/HT213936Vendor Advisory
https://support.apple.com/en-us/HT213937Vendor Advisory
https://support.apple.com/en-us/HT213938Vendor Advisory
http://seclists.org/fulldisclosure/2023/Oct/10Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Oct/8
http://seclists.org/fulldisclosure/2023/Oct/9
https://support.apple.com/en-us/HT213936Vendor Advisory
https://support.apple.com/en-us/HT213937Vendor Advisory
https://support.apple.com/en-us/HT213938Vendor Advisory
https://support.apple.com/kb/HT213936
https://support.apple.com/kb/HT213937
https://support.apple.com/kb/HT213938

Timeline

Published: Sep 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-40457The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a CVE-2023-404587.5Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker CVE-2023-404597.5The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potenti CVE-2023-40465.3In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation CVE-2023-404605.4The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an a CVE-2023-404614.8The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload CVE-2023-404627.5The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially CVE-2023-404637.2When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 has CVE-2023-404646.8Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these item CVE-2023-404655.5Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local a CVE-2023-404685.5PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to d CVE-2023-404695.5PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to d