Researchers have spotted and alerted about several bug including an Apple zero-day vulnerability. Apple took swift action to protect its users by deploying crucial security updates across various platforms.
These updates cover iOS, iPadOS, macOS, tvOS, watchOS, and Safari, addressing multiple zero day Apple vulnerabilities, including a zero-day bug that has been actively exploited.
Among them is an Apple zero-day vulnerability, tracked as CVE-2023-38606, was found in the kernel. It could allow malicious apps to potentially manipulate sensitive kernel state.
The tech giant promptly addressed this issue with improved state management to bolster user protection.
What is the new Apple zero-day vulnerability?
The tech giant acknowledged that this specific Apple zero-day vulnerability flaw might have already been exploited on iOS versions released before iOS 15.7.1.
To counter these Apple vulnerabilities, the company introduced the necessary patches to fortify its ecosystem against potential attacks.
Interestingly, this is the third Apple vulnerability linked to “Operation Triangulation,” a highly sophisticated mobile cyber espionage campaign targeting iOS devices since 2019, utilizing a zero-click exploit chain.
Previous zero day Apple vulnerabilities, CVE-2023-32434 and CVE-2023-32435, were successfully patched by Apple in the preceding month, highlighting the company’s commitment to security and timely response to emerging threats.
Additionally, Apple’s “Rapid Response” approach has proven important in mitigating risks associated with spyware attacks.
Recently, the company rolled out an emergency bug fix to address a web-browsing security hole that had already been exploited.
The patch was designed to prevent arbitrary code execution when processing web content.
This prompt action aimed at protecting users from potential zero day Apple vulnerabilities in the WebKit component, thanks to the efforts of an anonymous researcher who discovered and reported the issue.
Apple zero-day vulnerability and more: Fixing the bugs
Apple’s recent security updates encompass various components, covering macOS Big Sur and macOS Monterey.
These updates resolve issues related to bypassing the Same Origin Policy, improved memory handling, and checks to prevent arbitrary code execution and sensitive information disclosure when processing web content.
Safari 16.6 includes several updates and security patches for macOS Big Sur and macOS Monterey.
Among these updates are fixes for zero day Apple vulnerabilities that could affect the security of web content processing and interactions with the Same Origin Policy. Below are the details of the addressed issues:
- CVE-2023-38572: A vulnerability that allowed a website to bypass the Same Origin Policy. This issue was responsibly disclosed by Narendra Bhati from Suma Soft Pvt. Ltd, Pune – India, and it has been rectified with improved checks. (WebKit Bugzilla: 256549)
- CVE-2023-38594: A vulnerability related to web content processing that could lead to arbitrary code execution. This issue was identified and reported by Yuhao Hu. Additionally, an anonymous researcher, Jiming Wang, and Jikai Ren were credited for their involvement in the disclosure. The issue has been addressed with improved checks. (WebKit Bugzilla: 256865, 256573)
- CVE-2023-38600: Another vulnerability affecting web content processing that could lead to arbitrary code execution. This issue was discovered by an anonymous individual working with Trend Micro Zero Day Initiative. The problem has been resolved, and the necessary improvements in memory handling have been implemented. (WebKit Bugzilla: 257387)
- CVE-2023-38611: A vulnerability in the WebKit Process Model that could also result in arbitrary code execution when processing web content. This issue was responsibly reported by Francisco Alonso (@revskills), and the necessary checks have been put in place to address it. (WebKit Bugzilla: 258058)
- CVE-2023-38597: A vulnerability in the Web Inspector for macOS Big Sur and macOS Monterey, which could potentially disclose sensitive information during web content processing. The issue was identified and responsibly disclosed by 이준성 (Junsung Lee) of Cross Republic, and it has been addressed with improved checks. (WebKit Bugzilla: 258100)
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.
