CISA adds recently discovered Apple zero-days to Known Exploited Vulnerabilities Catalog
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-23529 | WebKit Type Confusion RCE in Apple iOS, iPadOS, macOS, and Safari | 8.8 | 9% | KEV | KEV |
| CVE-2023-32439 | Type Confusion in Apple WebKit (Safari, iOS, iPadOS, macOS) Enables Code Execution | 8.8 group max | 24% | KEV | KEV |
| CVE-2023-28205 | Use-After-Free in Apple WebKit (iOS, iPadOS, macOS, Safari) Enables Code Execution | 8.8 | 27% | KEV | KEV |
| CVE-2023-28206 | Out-of-Bounds Write in Apple IOSurfaceAccelerator Allows Kernel-Level Code Execution | 8.6 | 23% | KEV | KEV |
CVE-2023-37450+1 related CVE | Arbitrary Code Execution in Apple WebKit (iOS, iPadOS, macOS, Safari, tvOS, watchOS) | 8.8 group max | 19% | KEV | KEV |
| CVE-2023-41061 | Actively Exploited Wallet Flaw Enables Code Execution on Apple iOS, iPadOS, watchOS | 7.8 | 4% | KEV | KEV |
| CVE-2023-41064 | ImageIO Buffer Overflow in Apple iOS, iPadOS, and macOS Allows Code Execution | 7.8 | 53% | KEV | KEV |
From the original article
3 min read at securityaffairs.com
U. S. CISA adds vulnerabilities in Apple devices exploited to install NSO Group’s Pegasus spyware on iPhones to Known Exploited Vulnerabilities Catalog US Cybersecurity and Infrastructure Security Agency (CISA) added the security vulnerabilities chained in the zero-click iMessage exploit BLASTPASS to its Known Exploited Vulnerabilities Catalog .
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.