Apple Patches Three Actively Exploited Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-41993 | WebKit Code Execution Flaw in Apple iOS, iPadOS, macOS, and Safari Apple's WebKit engine, which renders web content for Safari and for essentially all HTML processing on iOS, iPadOS, and macOS, contains a flaw that leads to code execution when processing maliciously crafted web content. It is triggered when a user's browser or embedded web view loads attacker-controlled web content, so simply visiting a hostile page can be enough. Successful exploitation could allow arbitrary code execution within the affected application's context, a common stepping stone to broader device compromise. All users of Apple iOS, iPadOS, macOS, and Safari are potentially affected, as are users of non-Apple products that rely on WebKit for HTML processing. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-09-25, indicating confirmed in-the-wild exploitation; no public proof-of-concept is known. Do: Apply Apple's latest security updates for iOS, iPadOS, macOS, and Safari that patch WebKit, following the vendor instructions referenced by the CISA KEV entry, and treat unpatched WebKit builds as actively exploited. Until systems are patched, restrict exposure to untrusted web content (e.g., limit browsing and in-app web views to trusted sites for high-risk users). Also inventory any non-Apple applications or HTML-processing components in your environment that bundle WebKit and update them as their maintainers ship fixes. | 8.8 group max | 29% | KEV |
| mass1+ billion devices/users (WebKit ships in Safari and all web-content rendering on iOS, iPadOS, and macOS) |
Full article330 words · extracted from infosecurity-magazine.com · click to collapse
Apple has patched three zero-day vulnerabilities it claims may have been actively exploited in the wild on iOS devices.
CVE-2023-41991 is described as “a certificate validation issue” which has now been fixed in iOS 16.7 and iPadOS 16.7, iOS 17.0.1 and iPadOS 17.0.1, watchOS 9.6.3, macOS Ventura 13.6 and watchOS 10.0.1.
The vulnerability, which affects the Apple Security framework, could enable a malicious app to bypass signature validation, the tech giant revealed.
CVE-2023-41992 impacts the Apple kernel and was addressed with “improved checks” in iOS 16.7 and iPadOS 16.7, iOS 17.0.1 and iPadOS 17.0.1, watchOS 9.6.3, macOS Ventura 13.6, macOS Monterey 12.7 and watchOS 10.0.1.
Apple said “a local attacker may be able to elevate their privileges” by exploiting the vulnerability. Both of these CVEs are listed here.
Finally, CVE-2023-41993 affects the WebKit browser engine and was also fixed with “improved checks” in iOS 16.7 and iPadOS 16.7, iOS 17.0.1 and iPadOS 17.0.1, and Safari 16.6.1.
“Processing web content may lead to arbitrary code execution,” Apple said of the bug.
Read more on Apple zero-days: Apple Patches Two Zero-Days Exploited in the Wild
Interestingly, all three were found by Bill Marczak of the University of Toronto’s Citizen Lab and Maddie Stone of Google’s Threat Analysis Group.
Both have a track record of finding threats developed by commercial spyware makers and targeted at journalists, dissidents, rights groups and others.
Earlier this month, for example, Citizen Lab alerted Apple to two zero-day vulnerabilities being chained in a “BlastPass” exploit to deliver the notorious Pegasus spyware.
The vulnerabilities Citizen Lab in particular finds have often been researched by companies like NSO Group to deliver eavesdropping capabilities to their clients – usually government agencies.
However, their work is controversial. The US government has put several such companies on its entity list and a Presidential executive order earlier this year banned federal agencies from using any commercial spyware that has previously been misused by foreign states to spy on citizens, dissidents, activists and others.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/apple-patches-three-actively/