{"uuid": "83b4e5df-72c9-48fd-85ac-8ce705714311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28206", "type": "seen", "source": "https://t.me/hacking_Attack/97584", "content": "Black Hat Ethical Hacking\nApple releases emergency security updates to address zero-day vulnerabilities on iPhones, Macs, and iPads\n\nApple releases emergency security updates to address zero-day vulnerabilities on iPhones, Macs, and iPadsPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple Releases Emergency Security Updates to Address Two Zero-Day VulnerabilitiesApple has released emergency security updates to address two new zero-day vulnerabilities that have been exploited to compromise iPhones, Macs, and iPads. In security advisories published on Friday, the company warned of a report that these issues may have been actively exploited.\n\nThe first vulnerability, tracked as CVE-2023-28206, is an IOSurfaceAccelerator out-of-bounds write that can lead to data corruption, a crash, or code execution. Attackers can use a maliciously crafted app to execute arbitrary code with kernel privileges on targeted devices, once they have successfully exploited the flaw.\n\nThe second zero-day vulnerability (CVE-2023-28205) is a WebKit use-after-free weakness, which can result in data corruption or arbitrary code execution when reusing freed memory. Attackers can trick targets into loading malicious web pages under their control, leading to code execution on compromised systems.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Apple responds to in-the-wild exploitation reports with critical security updatesTo address these vulnerabilities, Apple has released iOS 16.4.1, iPadOS 16.4.1, macOS Ventura 13.3.1, and Safari 16.4.1, which include improved input validation and memory management. The list of affected devices is quite extensive, including iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, iPad mini 5th generation and later, and Macs running macOS Ventura.\n\nAlthough Apple has acknowledged reports of exploitation in the wild, it has not published any information regarding these attacks. However, Apple revealed that Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group and Donncha \u00d3 Cearbhaill of Amnesty International\u2019s Security Lab discovered the two flaws exploited in the wild as part of an exploit chain. Both organizations regularly disclose campaigns exploiting zero-day bugs abused by government-sponsored threat actors to deploy commercial spyware on the smartphones and computers of politicians, journalists, dissidents, and other high-risk individuals worldwide.\nSuper proud of our team at @AmnestyTech and everyone who helped in this investigation.\n\nToday, Apple published an emergency update for all iPhones to patch an exploit chain which we, together with @_clem1 (Google TAG)  discovered in the wild. pic.twitter.com/KLMYjqi3lK\n\n\u2014 Donncha \u00d3 Cearbhaill (@DonnchaC) April 7, 2023\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Mythic In February, Apple addressed another WebKit zero-day (CVE-2023-23529), which had been exploited in attacks to trigger OS crashes and gain code execution on vulnerable iPhones, iPads, and Macs. While the zero-days patched recently were most likely used in highly targeted attacks, it is highly recommended to install these emergency updates as soon as possible to block potential attack attempts.\nTrending: 10-Year-Old Windows vulnerability still being exploited in the 3CX attacks\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that[...]", "creation_timestamp": "2026-09-01T20:01:00.237819Z"}