Apple Issues Emergency Patches for 3 New Zero-Day Vulnerabilities

May 19, 2023Ravi LakshmananZero-day/endpoint security

Apple released security updates to iOS, iPadOS, macOS, tvOS, watchOS and the Safari web browser on Thursday to address three new zero-day flaws that are actively being exploited in the wild.

Here are three security shortcomings:

• CVE-2023-32409 – A flaw in WebKit that can be exploited by malicious attackers to break through the web content sandbox. This issue was addressed through improved bounds checking.
• CVE-2023-28204 – WebKit out-of-bounds read issue. It can be exploited to disclose sensitive information when processing web content. This issue was addressed through improved input validation.
• CVE-2023-32373 – Bug after using WebKit free. Arbitrary code may be executed when processing maliciously crafted web content. This issue was addressed through improved memory management.

The iPhone manufacturer has credited Clément Lecigne of the Google Threat Analysis Group (TAG) and Donncha Ó Cearbhaill of the Amnesty International Security Lab for reporting CVE-2023-32409. An anonymous researcher is credited with reporting his two other problems.

It’s worth noting that both CVE-2023-28204 and CVE-2023-32373 were patched as part of the Rapid Security Response updates (iOS 16.4.1 (a) and iPadOS 16.4.1 (a)) . Month.

At this time, we have no additional technical details regarding the flaws, the nature of the attacks, or the identities of the attackers who may be exploiting them.

That said, such weaknesses have historically been used as part of targeted intrusions to introduce mercenary spyware into the devices of dissidents, journalists, human rights activists, among others.

The latest update is available for the following devices –

• iOS 16.5 and iPadOS 16.5 – iPhone 8 or later, iPad Pro (all models), iPad Air 3rd generation or later, iPad 5th generation or later, iPad mini 5th generation or later
• iOS 15.7.6 and iPadOS 15.7.6 – iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), iPod touch (7th generation)
• macOS Ventura 13.4 – Introducing macOS
• TV OS 16.5 – Apple TV 4K (all models) and Apple TV HD
• Watch OS 9.5 – Apple Watch Series 4 or later
• safari 16.5 – macOS Big Sur and macOS Monterey

Apple has remediated a total of six actively exploited zero-days since early 2023 to date. Earlier this February, the company implanted a WebKit flaw (CVE-2023-23529) that could lead to remote code execution.

And last month, patches were released for two vulnerabilities (CVE-2023-28205 and CVE-2023-28206) that allow code execution with elevated privileges. Lecigne and Ó Cearbhaill allegedly reported a security flaw.