https://www.bleepingcomputer.com/news/apple/apple-emergency-update-fixes-new-zero-day-used-to-hack-iphones/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers + Microsoft Edge, Teams get fixes for zero-days in open-source libraries Microsoft Edge, Teams get fixes for zero-days in open-source libraries + Microsoft now lets you play a game during Windows 11 installs Microsoft now lets you play a game during Windows 11 installs + Android October security update fixes zero-days exploited in attacks Android October security update fixes zero-days exploited in attacks + Microsoft officially removes Cortana for Windows 11 Insiders Microsoft officially removes Cortana for Windows 11 Insiders + Exploits released for Linux flaw giving root on major distros Exploits released for Linux flaw giving root on major distros + China-linked cyberspies backdoor semiconductor firms with Cobalt Strike China-linked cyberspies backdoor semiconductor firms with Cobalt Strike + NSA and CISA reveal top 10 cybersecurity misconfigurations NSA and CISA reveal top 10 cybersecurity misconfigurations * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Apple * Apple emergency update fixes new zero-day used to hack iPhones * * Apple emergency update fixes new zero-day used to hack iPhones By Sergiu Gatlan * October 4, 2023 * 02:19 PM * 6 Apple Apple released emergency security updates to patch a new zero-day security flaw exploited in attacks targeting iPhone and iPad users. "Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6," the company said in an advisory issued on Wednesday. The zero-day (CVE-2023-42824) is caused by a weakness discovered in the XNU kernel that enables local attackers to escalate privileges on unpatched iPhones and iPads. While Apple said it addressed the security issue in iOS 17.0.3 and iPadOS 17.0.3 with improved checks, it has yet to reveal who found and reported the flaw. The list of impacted devices is quite extensive, and it includes: * iPhone XS and later * iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Apple also addressed a zero-day tracked as CVE-2023-5217 and caused by a heap buffer overflow weakness in the VP8 encoding of the open-source libvpx video codec library, which could allow arbitrary code execution following successful exploitation. The libvpx bug was previously patched by Google in the Chrome web browser and by Microsoft in its Edge, Teams, and Skype products. CVE-2023-5217 was discovered by security researcher Clement Lecigne who is part of Google's Threat Analysis Group (TAG), a team of security experts known for often finding zero-days abused in government-backed targeted spyware attacks targeting high-risk individuals. 17 zero-days exploited in attacks fixed this year CVE-2023-42824 is the 17th zero-day vulnerability exploited in attacks that Apple has fixed since the start of the year. Apple also recently patched three other zero-day bugs ( CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993) reported by Citizen Lab and Google TAG researchers and exploited in spyware attacks to install Cytrox's Predator spyware. Citizen Lab disclosed two other zero-days (CVE-2023-41061 and CVE-2023-41064)--fixed by Apple last month--abused as part of a zero-click exploit chain (dubbed BLASTPASS) to infect fully patched iPhones with NSO Group's Pegasus spyware. Since January 2023, Apple has addressed a total of 17 zero-days exploited to target iPhones and Macs, including: * two zero-days (CVE-2023-37450 and CVE-2023-38606) in July * three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439) in June * three more zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373) in May * two zero-days (CVE-2023-28206 and CVE-2023-28205) in April * and another WebKit zero-day (CVE-2023-23529) in February Today's iOS 17.0.3 release also addresses a known issue causing iPhones running iOS 17.0.2 and lower to overheat. "This update provides important bug fixes, security updates, and addresses an issue that may cause iPhone to run warmer than expected," Apple said. Related Articles: Atlassian patches critical Confluence zero-day exploited in attacks Apple backports BLASTPASS zero-day fix to older iPhones Apple discloses 2 new zero-days exploited to attack iPhones, Macs New 'Looney Tunables' Linux bug gives root on major distros Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers * Actively Exploited * Elevation of Privileges * iOS * iPad * iPhone * Kernel * Privilege Escalation * Zero-Day * * * * * Sergiu Gatlan Sergiu has covered cybersecurity, technology, and other news beats for more than a decade. Email or Twitter DMs for tips. * Previous Article * Next Article Comments * IhateMicroSoft Photo IhateMicroSoft - 1 day ago + + This build also addresses the issue with 15's overheating. * Hmm888 Photo Hmm888 - 20 hours ago + + "This build also addresses the issue with 15's overheating." Nope. It doesn't. If what Apple claims is 100% accurate and the overheating is strictly a software issue then the app developers still have to fix their apps. And if part of the problem is in fact the case, then this won't be fixed (assuming Apple doesn't throttle the iPhone's CPU). * RaunchyButts Photo RaunchyButts - 23 hours ago + + "Zero-days?" No. English has lots of descriptive words. Try some. * deejinoz Photo deejinoz - 21 hours ago + + Zero-day is a perfectly acceptable term, used in the field of cybersecurity . https://www.google.com/gasearch?q=zero-day%20definition&tbm=& source=sh/x/gs/m2/5 * Hmm888 Photo Hmm888 - 20 hours ago + + ""Zero-days?" No. I English has lots of descriptive words. Try some." I like the current buzz words like bolstered, amazing, jaw-dropping or jaw breaking, immersed, and game changer (and their variants). Haha. Actually, I don't, but it seems I'm in the minority and those who can't think independently and critically like to parrot or emulate words and behaviors of others to conform to our wonderful unhinged society. * Hmm888 Photo Hmm888 - 20 hours ago + + Deja vu. Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] [blink-ai-copilot] Popular Stories * SONY Sony confirms data breach impacting thousands in the U.S. * Linux New 'Looney Tunables' Linux bug gives root on major distros Latest Downloads * Malwarebytes Anti-Malware Logo Malwarebytes Anti-Malware Version: 4.6.3.282 5M+ Downloads * Windows Repair (All In One) Logo Windows Repair (All In One) Version: 4.14.1 2M+ Downloads * McAfee Consumer Products Removal tool Logo McAfee Consumer Products Removal tool Version: NA 437,713 Downloads * AdwCleaner Logo AdwCleaner Version: 8.4.0.0 56M+ Downloads * Everything Desktop Search Logo Everything Desktop Search Version: 1.4.1.1017 23,962 Downloads Follow us: * * * * * Main Sections * News * VPN Buyer Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2023 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT