Incomplete disclosures by Apple and Google create “huge blindspot” for 0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-41064 | ImageIO Buffer Overflow in Apple iOS, iPadOS, and macOS Allows Code Execution | 7.8 | 53% | KEV | KEV |
| CVE-2023-4863 | Out-of-Bounds Write in Google Chromium WebP Image Codec Actively Exploited | 8.8 | 100% | KEVPoC ×4 | KEV |
From the original article
7 min read at arstechnica.com
No one mentioned that libwebp, a library found in millions of apps, was a 0-day origin. Incomplete information included in recent disclosures by Apple and Google reporting critical zero-day vulnerabilities under active exploitation in their products has created a “huge blindspot” that’s causing a large number of offerings from other developers to go unpatched, researchers said Thursday.
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.