Skip to main content

Apple Issues Urgent Patch for Zero-Day Flaw Targeting iOS, iPadOS, macOS, and Safari

 


Zero-Day / Endpoint Security











Apple has released Rapid Security Response updates for iOS, iPadOS, macOS, and Safari web browser to address a zero-day flaw that it said has been actively exploited in the wild.

The WebKit bug, cataloged as CVE-2023-37450, could allow threat actors to achieve arbitrary code execution when processing specially crafted web content. The iPhone maker said it addressed the issue with improved checks.

Credited with discovering and reporting the flaw is an anonymous researcher. As with most cases like this, there are scant details about the nature and the scale of the attacks and the identity of the threat actor behind them.

But Apple noted in a terse advisory that it's "aware of a report that this issue may have been actively exploited."

The updates, iOS 16.5.1 (a), iPadOS 16.5.1 (a), macOS Ventura 13.4.1 (a), and Safari 16.5.2, are available for devices running the following operating system versions:

Apple has addressed 10 zero-day vulnerabilities in its software since the start of 2023. It also arrives weeks after the company rolled out patches to fix three zero-days, two of which have been weaponized by unidentified actors in connection with an espionage campaign called Operation Triangulation.

Update#

Apple has pulled the software update after reports emerged that installing the patches caused certain websites like Facebook, Instagram, and Zoom to throw an "Unsupported Browser" error on Safari.

In a support document released on July 11, 2023, Cupertino said it's "aware of an issue where recent Rapid Security Responses might prevent some websites from displaying properly," advising customers experiencing problems to remove the update. iOS 16.5.1 (b), iPadOS 16.5.1 (b), and macOS 13.4.1 (b) are expected to be released "soon" to remediate the problem.


Source: https://thehackernews.com/2023/07/apple-issues-urgent-patch-for-zero-day.html

Comments

Post a Comment

Popular posts from this blog

Threat Group Continuously Updates Malware to Evade Antivirus Software

  Julien Maury November 7, 2022 Kaspersky researchers recently found evidence of an  advanced threat  group continuously updating its  malware  to evade security products, similar to a release cycle for developers. Kaspersky  revealed  that APT10, also known as the Cicada hacking group, has successfully deployed the LODEINFO malware in government, media, public sector, and diplomatic organizations in Japan. LODEINFO has been  observed  engaged in a spear- phishing  campaign since December 2019 by JPCERT/CC. The sophisticated malware was hidden in malicious Word file attachments. So far, nothing unusual for a sophisticated threat actor, but JPCERT/CC concluded that LODEINFO was “under development,” as they found the version number “v0.1.2” during their investigation. Kaspersky researchers have been tracking the malware since then, and they’ve discovered evidence revealing “high-confidence attribution to APT10.” They observed another spear-phishing campaign in March 2022. The malicious W
Post a Comment
Read more

Critical Security Flaw in Social Login Plugin for WordPress Exposes Users' Accounts

Website Security / Vulnerability A critical security flaw has been disclosed in miniOrange's  Social Login and Register plugin  for WordPress that could enable a malicious actor to log in as any user-provided information about email address is already known. Tracked as CVE-2023-2982 (CVSS score: 9.8), the authentication bypass flaw impacts all versions of the plugin, including and prior to 7.6.4. It was addressed on June 14, 2023, with the release of version 7.6.5 following responsible disclosure on June 2, 2023. "The vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts used to administer the site, if the attacker knows, or can find, the associated email address," Wordfence researcher István Márton  said . The issue is rooted in the fact that the encryption key used to secure the information during login using social media accounts is hard-coded, thus leading to a scenario where attackers could create a
Read more