Article Details
Scrape Timestamp (UTC): 2023-09-22 16:44:49.938
Original Article Text
Click to Toggle View
Apple emergency updates fix 3 new zero-days exploited in attacks. Apple released emergency security updates to patch three new zero-day vulnerabilities exploited in attacks targeting iPhone and Mac users, for a total of 16 zero-days fixed this year. Two bugs were found in the WebKit browser engine (CVE-2023-41993) and the Security framework (CVE-2023-41991), enabling attackers to bypass signature validation using malicious apps or gain arbitrary code execution via maliciously crafted webpages. The third one was found in the Kernel Framework, which provides APIs and support for kernel extensions and kernel-resident device drivers. Local attackers can exploit this flaw (CVE-2023-41992) to escalate privileges. Apple fixed the three zero-day bugs in macOS 12.7/13.6, iOS 16.7/17.0.1, iPadOS 16.7/17.0.1, and watchOS 9.6.3/10.0.1 by addressing a certificate validation issue and through improved checks. "Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7," the company revealed in security advisories describing the security flaws. The list of impacted devices encompasses older and newer device models, and it includes: All three zero-days were found and reported by Bill Marczak of the Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group. While Apple has yet to provide additional details regarding the flaws' exploitation in the wild, Citizen Lab and Google Threat Analysis Group security researchers have often disclosed zero-day bugs abused in targeted spyware attacks targeting high-risk individuals, including journalists, opposition politicians, and dissidents. Citizen Lab disclosed two other zero-days (CVE-2023-41061 and CVE-2023-41064), also fixed by Apple in emergency security updates earlier this month and abused as part of a zero-click exploit chain (dubbed BLASTPASS) to infect fully patched iPhones with NSO Group's Pegasus commercial spyware. Since the start of the year, Apple has also patched:
Daily Brief Summary
Apple has released emergency security updates to tackle three zero-day vulnerabilities that have been exploited in attacks against iPhone and Mac users.
Two of the identified bugs were found in the WebKit browser engine and the Security framework. These allowed for arbitrary code execution via maliciously crafted webpages and signature validation bypass using harmful apps.
The third vulnerability was spotted in the Kernel Framework and could potentially enable local attackers to escalate privileges.
Apple addressed the flaws in several operating systems, including macOS, iOS, iPadOS, and watchOS. The company confirmed it was aware of previous exploitation against older versions of iOS.
These zero-day vulnerabilities were discovered and reported by researchers from the Citizen Lab at The University of Toronto's Munk School and Google's Threat Analysis Group. In the past, similar flaws have been abused in spyware attacks on high-risk individuals.
Citizen Lab disclosed two other zero-days that had also been abused previously to infect fully patched iPhones with NSO Group's Pegasus spyware. These vulnerabilities were patched by Apple earlier in the month.
So far this year, Apple has also addressed a total of 16 zero-day vulnerabilities.