Apple fixes three zero-days exploited in the wild
Apple patched several zero-click vulnerabilities in its iOS, iPadOS, macOS, and watchOS operating systems.
Two of the bugs (CVE-2023-32439, and CVE-2023-32435) reside in the WebKit browser engine and can be exploited to execute arbitrary code on the target system using a specially crafted webpage.
The third zero-day, tracked as CVE-2023-32434, is an integer overflow in the kernel that can allow a local application to escalate privileges on the system.
Apple has not shared additional information on attacks exploiting the above mentioned security flaws, but noted that CVE-2023-32434 and CVE-2023-32435 “may have been actively exploited against versions of iOS released before iOS 15.7.”
The two bugs were reportedly exploited to deliver the TriangleDB spyware implant to iOS devices as part of a campaign called Operation Triangulation.
Last month, Apple fixed three WebKit zero-days that allowed to remotely execute code on the system, or gain access to potentially sensitive information.
Latest Posts
What is Vulnerability Management? A Beginner's Guide
In this article will try to cover basics of vulnerability management process and why it is important to every company.
Cyber Security Week in Review: September 6, 2024
In brief: the US charges Russian GRU hackers for attacks on Ukraine, Apache, Cisco, Zyxel patch high-risk flaws, Google fixes Android zero-day, and more.
Threat actors using MacroPack Red Team framework to deploy Brute Ratel, Havoc and PhantomCore
Some of the documents appeared to be part of legitimate Red Team exercises, while other were intended for malicious purposes.