Apple Patches Actively Exploited iOS Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-42917 +1 in the same advisory: …42916 | WebKit Memory Corruption in Apple iOS, macOS, and Safari Enables Arbitrary Code Execution CVE-2023-42917 is a memory corruption flaw (CWE-787, out-of-bounds write class) in Apple's WebKit browser engine, addressed with improved locking. It is triggered when a device processes maliciously crafted web content, meaning an attacker can reach vulnerable code simply by getting a user to load attacker-controlled web content. Successful exploitation may lead to arbitrary code execution with the privileges of the affected application. All users of the affected Apple platforms — iPhone, iPad, Mac (Sonoma), and Safari — are exposed, and the CPE data also indicates WebKitGTK as shipped by Debian and Fedora is in scope. The flaw is being actively exploited: Apple reported it was exploited in the wild against versions of iOS before 16.7.1, it was added to CISA KEV on 2023-12-04, and EPSS assigns a 9.4% probability of exploitation in the next 30 days (95th percentile). Do: Upgrade to iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2; organizations with devices on the older iOS 16 line should check Apple's advisories for backported fixes, since the in-the-wild exploitation was reported against iOS versions before 16.7.1. Linux defenders running Debian or Fedora should apply the latest WebKitGTK security updates from their distribution. As a KEV entry (added 2023-12-04), remediation is mandatory for federal agencies per CISA's required action; verify device versions via MDM or inventory and prioritize internet-facing and high-risk users. | 8.8 group max | 9% | KEV |
| masson the order of 1 billion+ devices/users (Apple's active iPhone/iPad/Mac/Safari installed base) | |
| CVE-2023-6345 | Integer Overflow in Google Chrome's Skia Enables Sandbox Escape (Actively Exploited) CVE-2023-6345 is an integer overflow (CWE-190) in Skia, the 2D graphics rendering library used by Google Chrome and other Chromium-based browsers. It is triggered when a compromised renderer processes a malicious file, allowing a remote attacker who has already gained code execution in the renderer process to escape the Chrome sandbox and run code with broader privileges. Users of Google Chrome prior to 119.0.6045.199 are affected, as are Chromium-based derivatives including Microsoft Edge (Chromium) and Chromium packages shipped by Debian and Fedora. The flaw was rated High by Chromium, carries a CVSS 3.1 score of 9.6, and was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-30. Google has patched the bug in Chrome 119.0.6045.199, and news reporting confirms it was being actively exploited in the wild at the time of the fix. Do: Update Google Chrome to 119.0.6045.199 or later and restart the browser to fully apply the fix; on Debian and Fedora, apply the updated chromium packages from the distro repositories, and allow Microsoft's Chromium fix to flow into Edge before trusting affected builds. Verify browser versions (chrome://version or equivalent) across managed fleets, and note that because this is CISA KEV-listed (added 2023-11-30), US federal agencies must patch per vendor instructions or discontinue use by the required deadline. | 9.6 | 16% | KEV |
| masshundreds of millions to billions of Chrome and Chromium-based browser installations |
Full article328 words · extracted from infosecurity-magazine.com · click to collapse
Apple has been forced to patch yet another pair of zero-day vulnerabilities, bringing the total for the year to 20.
The tech giant said that the two bugs in its WebKit browser engine were being actively exploited in the wild.
The first vulnerability, CVE-2023-42916, is found in a range of Apple products: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later.
The flaw is described as an “out-of-bounds read” which Apple addressed with improved input validation.
“Processing web content may disclose sensitive information,” Apple said of its impact.
Read more on Apple zero-days: Apple Issues Emergency Patches for More Zero-Day Bugs
The second vulnerability, CVE-2023-42917, is a memory corruption flaw in WebKit which was addressed with “improved locking.”
It is present in the same list of products as the first vulnerability.
“Processing web content may lead to arbitrary code execution,” Apple said of the flaw.
Both bugs were discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG), a researcher and an organization known for finding vulnerabilities and exploits used in commercial spyware operations.
Just this week, he was cited by Google in a Chrome update for finding CVE-2023-6345, an integer overflow issue in open source 2D graphics library Skia, linked to similar state-sponsored activity.
The continued discovery of zero-day vulnerabilities in Apple kit, frequently researched by commercial spyware organizations to deliver eavesdropping capabilities to targeted devices, hint that such operations are still very much alive and well despite Western pressure.
The US has placed organizations like NSO Group on trade blacklists in an attempt to stifle their business, and in March President Biden approved an executive order (EO) banning government use of any commercial spyware that has previously been misused by foreign states to spy on citizens, dissidents, activists and others.
Image credit: NYC Russ / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/apple-patches-actively-exploited/