Subj : Update your iPhone and Mac now - Apple has fixed two major securi
To   : All
From : TechnologyDaily
Date : Fri Sep 08 2023 14:15:03

Update your iPhone and Mac now - Apple has fixed two major security bugs

Date:
Fri, 08 Sep 2023 13:03:19 +0000

Description:
Both zero-day bugs can be used to run malicious code remotely against iPhone 
and Mac devices.

FULL STORY
======================================================================

Apple has released a fix for two high-severity vulnerabilities found in 
iPhone and Mac devices, with users urged to update their devices immediately. 

The flaws are tracked as CVE-2023-41064, and CVE-2023-41061. The former is a 
buffer overflow weakness and can enable arbitrary code execution on 
vulnerable endpoints . The latter is a validation issue that threat actors 
can use for the same goal - arbitrary code execution via malicious 
attachments. 

The two flaws were found in a wide array of Apples devices, including all 
phones from iPhone 8 onward, all iPad Pro models, iPad Air 3rd generation and 
newer, iPad 5th generation and newer, and iPad mini 5th generation and newer. 
The flaw also affects Macs powered by macOS Ventura, and Apple Watch Series 4 
and newer. Active exploit 

The patch brings macOS Ventura to version 13.5.2, iOS to version 16.6.1, 
iPadOS to 16.6.1, and watchOS to 9.6.2, so if youre worried about the flaws, 
make sure your OS runs these versions. The flaws are being actively abused in 
the wild, so make sure to apply the patch as soon as you can. 

"Apple is aware of a report that this issue may have been actively 
exploited," the Cupertino giant said in its security advisory. 

While Apple did not detail who used the flaws and in which campaigns, 
BleepingComputer cited Citizen Lab, a cybersecurity company claiming the 
flaws were part of a zero-click iMessage exploit chain named BLASTPASS. The 
goal of this campaign was to deliver Pegasus, an infamous commercial spyware 
developed by the now-blacklisted Israeli-based NSO Group. A zero-click attack 
is just as it sounds - it requires no activity from the victims side, making 
it extremely dangerous. 

Apple has been keeping busy this year, with a total of 13 zero-day 
vulnerabilities having been addressed this year, already. In late July this 
year, Apple urged its users to apply an emergency update that plugged a hole 
made by the CVE-2023-38606. More security news from TechRadar Pro Here's our 
list of the best firewalls around This stalkerware tracked thousands of 
Android and iPhones Apple is rolling out some urgent iPhone and Mac security 
patches, so update now 

Via: BleepingComputer



======================================================================
Link to news story:
https://www.techradar.com/pro/security/update-your-iphone-and-mac-now-apple-ha
s-fixed-two-major-security-bugs


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.