Apple patches iOS and macOS zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30858 +1 in the same advisory: …30869 | Use-After-Free in WebKit on Apple iOS, iPadOS, and macOS Allows Arbitrary Code Execution CVE-2021-30858 is a use-after-free memory corruption flaw (CWE-416) in the web content processing component (WebKit) of Apple iOS, iPadOS, and macOS, which Apple addressed with improved memory management. An attacker triggers it by getting a victim to process maliciously crafted web content, typically by visiting or being redirected to an attacker-controlled site, and successful exploitation leads to arbitrary code execution on the victim's device (CVSS 3.1: 8.8 High, network vector with user interaction required). Anyone running affected builds of iOS, iPadOS, or macOS, or the affected component on Fedora or Debian Linux per the CPE data, is exposed, since virtually all Apple devices process web content by default. Apple acknowledged that the flaw was being actively exploited, reportedly as part of NSO Group's 'ForcedEntry' targeted zero-day espionage chain, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. No public proof-of-concept is known, but the confirmed in-the-wild use makes rapid patching urgent. Do: Update iPhones and iPads to iOS/iPadOS 14.8 and Macs to macOS Big Sur 11.6 immediately, and on Fedora or Debian apply the distribution's updated WebKit packages. Use MDM or inventory data to confirm no managed devices remain on pre-patch builds, since the flaw was exploited as a zero-day in targeted espionage operations. This is a CISA KEV entry (added 2021-11-03), so the catalog's required action of applying vendor updates is mandatory for federal agencies and strongly recommended for everyone else. | 8.8 group max | 13% | KEV |
| mass>1 billion users/devices (Apple's 1B+ active device base, all of which carry the vulnerable web-content code path) | |
| CVE-2021-30860 | Integer Overflow in Apple PDF Processing Enables Arbitrary Code Execution (CVE-2021-30860) CVE-2021-30860 is an integer overflow (CWE-190) in PDF processing across Apple's platforms that was addressed with improved input validation. It is triggered when a device processes a maliciously crafted PDF — notably when a PDF is rendered after being received via messaging — and successful exploitation allows arbitrary code execution in the context of the PDF renderer. Affected products include iOS/iPadOS, macOS (Big Sur and Catalina), and watchOS, as well as the Xpdf and Poppler PDF libraries, which share lineage with the vulnerable code. Apple confirmed the issue was being actively exploited in the wild, and public reporting ties it to NSO Group's 'ForcedEntry' exploit chain used to deliver Pegasus spyware; CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. Given the very high EPSS score (76%, 99th percentile) and confirmed active exploitation, defenders should treat this as a high-priority patch. Do: Update iPhones/iPads to iOS/iPadOS 14.8, Macs to macOS Big Sur 11.6 (or apply Security Update 2021-005 Catalina), and Apple Watch to watchOS 7.6.2 immediately, and patch Poppler/Xpdf through distribution or vendor updates. Because the flaw was exploited via crafted PDFs delivered through messaging (ForcedEntry/Pegasus), organizations and individuals at risk of targeted spyware should also review devices for signs of compromise. CISA KEV requires applying updates per vendor instructions; prioritize internet-connected and high-value user endpoints. | 7.8 | 76% | KEV |
| mass>1 billion active Apple devices (iPhones, iPads, Macs, Apple Watches), plus Poppler present by default on most Linux desktops and servers |
Full article278 words · extracted from therecord.media · click to collapse
Apple has released security updates today to patch a new zero-day vulnerability that Google's security team said has been exploited in the wild to compromise user devices. Tracked as CVE-2021-30869, the vulnerability resides in XNU, the kernel component that ships with modern Apple systems. According to Shane Huntley, head of the Google Threat Analysis Group, the XNU zero-day was part of a two-part exploit chain. Huntley said attackers used the zero-day in conjunction with an already known WebKit vulnerability to execute malicious code inside a user's browser and escalate privileges for their code to take over affected devices. 0day privilege escalation for macOS Catalina discovered in the wild by @eryeh https://t.co/yvCWPo45fL We saw this used in conjunction with a N-day remote code execution targeting webkit. Thanks to Apple for getting patch out so quickly. Huntley said his team plans to reveal more details about the attack after 30 days, giving users more time to apply patches before technical details are available online, something that may help other threat actors develop their own exploits as well. Patches for the zero-day have been made available for macOS Catalina and iOS 12.5.5, suggesting that the exploit doesn't work in recent iOS versions such as iOS 14 and 15. macOS Catalina security updates are here. iOS 12.5.5 security updates are here. In addition, Apple has also backported patches for two other zero-days that it patched on September 13. Initially patched for iOS 14, patches for CVE-2021-30860 and CVE-2021-30858 are now also available for old-gen iPhones running iOS 12. The XNU zero-day marks the sixteenth zero-day Apple has patched in 2021.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/apple-patches-ios-and-macos-zero-day-exploited-in-the-wild