Apple on Thursday released security updates for its operating systems to patch dozens of vulnerabilities that could expose iPhones and Macs to hacker attacks, including three zero-days affecting the WebKit browser engine.
Two of the actively exploited vulnerabilities, CVE-2023-28204 and CVE-2023-32373, have been reported to the tech giant by an anonymous researcher. Their exploitation can lead to sensitive information disclosure and arbitrary code execution if the attacker can trick the targeted user into processing specially crafted web content — this includes luring them to a malicious site.
By infosecbulletin
/ Monday , May 12 2025
Google will pay about $1.4 billion to Texas to settle two lawsuits regarding location tracking and biometric data storage without...
Read More
By infosecbulletin
/ Friday , May 9 2025
YouTube has restricted access to at least four Bangladeshi television channels in India following a takedown request from the Indian...
Read More
By infosecbulletin
/ Friday , May 9 2025
Microsoft has fixed critical vulnerabilities in its core cloud services, including Azure Automation, Azure Storage, Azure DevOps, and Microsoft Power...
Read More
By infosecbulletin
/ Thursday , May 8 2025
The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the...
Read More
By infosecbulletin
/ Thursday , May 8 2025
SonicWall has released patches for three security flaws in SMA 100 Secure Mobile Access appliances that could allow remote code...
Read More
By infosecbulletin
/ Thursday , May 8 2025
From April 2024 to April 2025, Flashpoint analysts noted that the financial sector was a major target for threat actors,...
Read More
By infosecbulletin
/ Thursday , May 8 2025
Cisco has issued a security advisory for a critical vulnerability in its IOS XE Software for Wireless LAN Controllers (WLCs)....
Read More
By infosecbulletin
/ Wednesday , May 7 2025
Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization...
Read More
By infosecbulletin
/ Wednesday , May 7 2025
Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices...
Read More
By infosecbulletin
/ Tuesday , May 6 2025
CISA added the Langflow vulnerability, CVE-2025-3248 (CVSS score 9.8), to its Known Exploited Vulnerabilities catalog. Langflow is a popular tool...
Read More
No information is available on the attacks exploiting these zero-day flaws.
Apple revealed in its advisories that these were the vulnerabilities that it patched with its first Rapid Security Response updates, specifically iOS 16.4.1(a), iPadOS 16.4.1(a), and macOS 13.3.1(a).
Now, iOS 16.5 and iPadOS 16.5 fix CVE-2023-28204 and CVE-2023-32373, as well as CVE-2023-32409, a WebKit zero-day that can be exploited to escape the Web Content sandbox.
CVE-2023-32409 was reported to Apple by Google’s Threat Analysis Group and Amnesty International, which indicates that it has likely been exploited by the products of a commercial spyware vendor.
Google recently detailed several iOS and Android exploits that the company has linked to various spyware vendors.
The latest
iOS and iPadOS updates patch over 30 other vulnerabilities, including ones that can lead to a security bypass, sandbox escape, arbitrary code execution, exposure of location and other user data, privilege escalation, termination of an app, recovery of deleted photos, retaining access to system configuration files, contact information exposure from the lock screen, and modifications of protected parts of the file system.
CVE-2023-28204 and CVE-2023-32373 have also been fixed with the release of iOS and iPadOS 15.7.6
The exploited WebKit vulnerabilities have also been resolved in Apple TV, Apple Watch and Safari.
The latest macOS Ventura update fixes the three zero-days, along with nearly 50 other vulnerabilities that can lead to sensitive information disclosure, arbitrary code execution, DoS attacks, a security feature bypass, and privilege escalation.
Apple has also updated macOS Monterey to version 12.6.6 and Big Sur to version 11.7.7 to patch more than two dozen vulnerabilities, but none of the zero-days.