Skip to content
Fencer Vulns
medium 6.5

CVE-2023-40403 json

The issue was addressed with improved memory handling.

published 2023-09-26 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44974

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.

Patch / fix

  • Apple iOS and iPadOS 16.7, 17
  • Apple macOS 12.7, 13.6, 14
  • Apple tvOS 17
  • Apple watchOS 10
  • libxslt Debian 12 1.1.35-1+deb12u2
  • libxslt Debian 13 1.1.35-1.2+deb13u1
  • libxslt Debian 14 1.1.35-2

debian advisories DEBIAN-CVE-2023-40403

  • libxslt Ubuntu 22.04 LTS 1.1.34-4ubuntu0.22.04.4
  • libxslt Ubuntu Pro 14.04 LTS 1.1.28-2ubuntu0.2+esm3
  • libxslt Ubuntu Pro 16.04 LTS 1.1.28-2.1ubuntu0.3+esm2
  • libxslt Ubuntu Pro 18.04 LTS 1.1.29-5ubuntu0.3+esm1
  • libxslt Ubuntu Pro 20.04 LTS 1.1.34-4ubuntu0.20.04.3+esm1

ubuntu advisories UBUNTU-CVE-2023-40403

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libxslt RHEL 9 1.1.34-14.el9_7.1
  • libxslt RHEL 8 1.1.32-6.2.el8_10
  • libxslt RHEL 9.2 E4S 1.1.34-12.el9_2
  • libxslt RHEL 9.6 EUS 1.1.34-13.el9_6.1
  • libxslt RHEL 9.4 EUS 1.1.34-14.el9_4

red hat advisories RHSA-2026:29811RHSA-2026:6499RHSA-2026:6266RHSA-2025:9016RHSA-2025:8676

  • libxslt Linux Micro 6.0 1.1.38-4.1
  • libxslt Linux Micro 6.1 1.1.38-slfo.1.1_2.1
  • libxslt SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +13 more 1.1.34-150400.3.6.1
  • libxslt SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 1.1.32-150000.3.17.1
  • libxslt-python openSUSE Leap 15.6 1.1.32-150000.3.17.1
  • libxslt SLES LTSS Extended Security 12 SP5 1.1.28-17.24.1

suse advisories SUSE-SU-2026:2585-1SUSE-SU-2025:20201-1SUSE-SU-2025:20277-1SUSE-SU-2025:1125-1SUSE-SU-2025:1003-1

  • libxslt AlmaLinux 9 1.1.34-14.el9_7.1
  • libxslt AlmaLinux 8 1.1.32-6.2.el8_10

almalinux advisories ALSA-2026:6266ALSA-2025:8676

  • libxslt Rocky Linux 9 1.1.34-14.el9_7.1
  • libxslt Rocky Linux 8 1.1.32-6.2.el8_10

rocky linux advisories RLSA-2026:6266RLSA-2025:8676

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-40403 updated cvss 6.5

libxslt: Processing web content may disclose sensitive information

  • Red Hat Enterprise Linux 6 libxslt, libxslt-python Red Hat Enterprise Linux 7 libxslt, libxslt-python
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat AI Inference Server 3.2 rhaiis 1775740563, rhaiis/model-opt-cuda-rhel9 1780681984
    fixed: vendor fix RHSA-2026:25096
  • Red Hat AI Inference Server 3.3 rhaiis 1775680192, rhaiis 1775680262, rhaiis 1775749857, rhaiis 1778244531, rhaiis 1778244546, rhaiis 1778244559
    fixed: vendor fix RHSA-2026:16008
  • Red Hat Enterprise Linux AppStream (v. 8) libxslt-devel 1.1.32-6.2.el8_10, libxslt-debuginfo 1.1.32-6.2.el8_10, libxslt-debugsource 1.1.32-6.2.el8_10
    fixed: vendor fix RHSA-2025:8676
  • Red Hat Enterprise Linux AppStream (v. 9) libxslt 1.1.34-14.el9_7.1
    fixed: vendor fix RHSA-2026:6266
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libxslt 1.1.34-12.el9_2
    fixed: vendor fix RHSA-2026:29811
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) libxslt 1.1.34-14.el9_4
    fixed: vendor fix RHSA-2025:9016
show 4 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) libxslt 1.1.34-13.el9_6.1
    fixed: vendor fix RHSA-2026:6499
  • Red Hat Enterprise Linux BaseOS (v. 8) libxslt 1.1.32-6.2.el8_10
    fixed: vendor fix RHSA-2025:8676
  • Red Hat Update Infrastructure 5 rhui5 1776868842
    fixed: vendor fix RHSA-2026:10065
  • Red Hat Enterprise Linux 10 libxslt Red Hat Update Infrastructure 5 rhui5 1776868744, rhui5 1776868772, rhui5 1776868774
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.33% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

  • Apple iOS and iPadOS
  • Apple macOS
  • Apple tvOS
  • Apple watchOS

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.