Vulnerabilitycritical

Zero-Click Exploit in iPhones

Schneier on Securityby Bruce SchneierSep 15, 2023 · 00:00 UTC (Sep 15, 2023)1 min read4 · 2 reads

Read at schneier.com

Analyze CVE-2023-41064 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2023-41064 CVE-2023-41061

Tags: cve-2023-41064 cve-2023-41061 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-41061	Actively Exploited Wallet Flaw Enables Code Execution on Apple iOS, iPadOS, watchOS	7.8	4%	KEV	Sep 7, 2023 KEV Sep 11, 2023
CVE-2023-41064	ImageIO Buffer Overflow in Apple iOS, iPadOS, and macOS Allows Code Execution	7.8	53%	KEV	Sep 7, 2023 KEV Sep 11, 2023

From the original article

1 min read at schneier.com

Citizen Lab says two zero-days fixed by Apple today in emergency security updates were actively abused as part of a zero-click exploit chain (dubbed BLASTPASS) to deploy NSO Group’s Pegasus commercial spyware onto fully patched iPhones. The two bugs, tracked as CVE-2023-41064 and CVE-2023-41061 , allowed the attackers to infect a fully-patched iPhone running iOS 16.

Schneier on Security

By Bruce Schneier · schneier.com

Read the full article at Schneier on Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.