https://www.bleepingcomputer.com/news/apple/apple-fixes-recently-disclosed-zero-days-on-older-iphones-and-ipads/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Windows admins warned to patch critical MSMQ QueueJumper bug Windows admins warned to patch critical MSMQ QueueJumper bug + Microsoft April 2023 Patch Tuesday fixes 1 zero-day, 97 flaws Microsoft April 2023 Patch Tuesday fixes 1 zero-day, 97 flaws + Microsoft Bing introduces ChatGPT answers in search results Microsoft Bing introduces ChatGPT answers in search results + iPhones hacked via invisible calendar invites to drop QuaDream spyware iPhones hacked via invisible calendar invites to drop QuaDream spyware + DDoS attacks shifting to VPS infrastructure for increased power DDoS attacks shifting to VPS infrastructure for increased power + Reddit is down, not loading content for mobile app users Reddit is down, not loading content for mobile app users + Kyocera Android app with 1M installs can be abused to drop malware Kyocera Android app with 1M installs can be abused to drop malware + Boost your Amazon Web Services skills with this training bundle deal Boost your Amazon Web Services skills with this training bundle deal * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to make the Start menu full screen in Windows 10 How to make the Start menu full screen in Windows 10 + How to install the Microsoft Visual C++ 2015 Runtime How to install the Microsoft Visual C++ 2015 Runtime + How to open an elevated PowerShell Admin prompt in Windows 10 How to open an elevated PowerShell Admin prompt in Windows 10 + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Apple * Apple fixes recently disclosed zero-days on older iPhones and iPads * * Apple fixes recently disclosed zero-days on older iPhones and iPads By Sergiu Gatlan * April 10, 2023 * 04:16 PM * 0 Apple Apple has released emergency updates to backport security patches released on Friday, addressing two actively exploited zero-day flaws also affecting older iPhones, iPads, and Macs. "Apple is aware of a report that this issue may have been actively exploited," the company said in security advisories published on Monday. The first (tracked as CVE-2023-28206) is an out-of-bounds write weakness in IOSurfaceAccelerator that enables threat actors to execute arbitrary code with kernel privileges on targeted devices via maliciously crafted apps. The second zero-day (CVE-2023-28205) is a WebKit use after free that can let threat actors execute malicious code on compromised iPhones, Macs, or iPads after tricking their targets into loading malicious web pages. Today, Apple addressed the zero-days in iOS 15.7.5 and iPadOS 15.7.5, macOS Monterey 12.6.5, and macOS Big Sur 11.7.6 by improving input validation and memory management. The company says the bugs are now also patched on the following list of devices: * iPhone 6s (all models), * iPhone 7 (all models), * iPhone SE (1st generation), * iPad Air 2, * iPad mini (4th generation), * iPod touch (7th generation), * and Macs running macOS Monterey and Big Sur. The flaws were reported by security researchers with Google's Threat Analysis Group and Amnesty International's Security Lab, who discovered them being exploited in attacks as part of an exploit chain. Both organizations often report on government-backed threat actors who use similar tactics and vulnerabilities to install spyware onto the devices of high-risk individuals worldwide, such as journalists, politicians, and dissidents. For instance, they recently shared details on campaigns abusing two exploit chains targeting Android, iOS, and Chrome bugs to install commercial surveillance malware. CISA also ordered federal agencies to patch their devices against these two security vulnerabilities, known as being actively exploited in the wild to hack iPhones, Macs, and iPads. In mid-February, Apple patched another WebKit zero-day (CVE-2023-23529) that was in attacks to trigger crashes and gain code execution on vulnerable iOS, iPadOS, and macOS devices. Related Articles: Apple fixes new WebKit zero-day exploited to hack iPhones, Macs Apple fixes recently disclosed WebKit zero-day on older iPhones Apple fixes two zero-days exploited to hack iPhones and Macs CISA orders govt agencies to update iPhones, Macs by May 1st CISA warns of Windows and iOS bugs exploited as zero-days * Apple * iOS * iPad * iPadOS * iPhone * Mac * macOS * Zero-Day * * * * * Sergiu Gatlan Sergiu Gatlan has covered cybersecurity, technology, and other news beats for more than a decade. Email or Twitter DMs for tips. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Popular Stories * Windows Windows zero-day vulnerability exploited in ransomware attacks * Patch Tuesday Microsoft April 2023 Patch Tuesday fixes 1 zero-day, 97 flaws Follow us: * * * * * Main Sections * News * VPN Buyer Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2023 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT