Apple's Swift Response: 3 New Zero-Day Flaws Discovered Across iOS, macOS, Safari, and Beyond
Apple has taken swift action by releasing security patches to counter three zero-day vulnerabilities that were actively exploited across iOS, iPadOS, macOS, watchOS, and Safari. These patches bring the tally of zero-day vulnerabilities discovered in Apple's software this year to a staggering 16.
The vulnerabilities include issues with certificate validation, a kernel security flaw, and a vulnerability in WebKit, all of which pose the risk of arbitrary code execution. Notably, these vulnerabilities may have been employed in targeted cyber-espionage campaigns against individuals in civil society who face heightened cybersecurity threats.
This development comes on the heels of Apple recently addressing two other zero-day vulnerabilities, part of a sophisticated zero-click iMessage exploit chain named BLASTPASS, which facilitated the deployment of the notorious Pegasus spyware. Additionally, there's growing evidence that two of the newly discovered vulnerabilities, specifically CVE-2023-41064 and CVE-2023-4863, might be related, possibly sharing a common bug.
Of particular concern is CVE-2023-4863's impact, as it affects the widely used libwebp library, found in various operating systems, software packages, Linux applications, and container images. While patches are being rolled out, the comprehensive mitigation of this issue across diverse systems could take some time to achieve.
Source: https://thehackernews.com/2023/09/apple-rushes-to-patch-3-new-zero-day.html