Apple fixes trio of Zeroday Exploits

Apple has released an emergency patch fixes for a trio of iOS vulernabilities that hackers may already be exploiting.

These patches identified by researchers from Citizens lab and Google TAG are applicable for iOS 16 and the newly launched iOS 17, as well as iPadOS, Safari, watchOS, and macOS Ventura and Monterey.

The first vulnerability, CVE-2023-41993, involves Webkit, the browser engine for Safari. The researchers discovered the engine can be manipulated to execute rogue computer code if it processes certain web content. Hence, the vulnerability could be paired with a malicious message or website to potentially trigger an iPhone to download malware.

The second vulnerability, CVE-2023-41992, can affect iOS’s kernel, the core part of the operating system. Exploiting this bug can help an attacker elevate their privileges over the OS, enabling them to install programs or gain access to sensitive data.

The third vulnerability, CVE-2023-41991, can allow a malicious app to potentially “bypass signature validation,” enabling an attacker to circumvent the security check Apple uses to verify an iOS app is safe and legitimate.

All three vulnerabilities also affect macOS Ventura, with Apple warning, “additional CVE entries coming soon,” a sign that other exploits have been found.