{"uuid": "baa0107c-30c5-42f0-bbb1-4e77847431f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-42824", "type": "seen", "source": "https://t.me/hacking_Attack/121484", "content": "Black Hat Ethical Hacking\nApple\u2019s Emergency Fix: Zero-Day Exploit Puts iPhone and iPad Security at Risk\n\nApple\u2019s Emergency Fix: Zero-Day Exploit Puts iPhone and iPad Security at Risk\nPost Views: 17 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple Rushes to Patch Zero-Day Threat Targeting iPhones and iPads\n\nIn a swift response to a newfound zero-day security vulnerability, Apple has released emergency security updates, signaling a race against time to protect iPhone and iPad users from potential cyber threats. The exploit (CVE-2023-42824) in question, discovered in the XNU kernel, poses a risk of local attackers escalating privileges on unpatched iOS devices.\n\nApple, in its official advisory, acknowledged the severity of the issue, stating, \u201cApple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.\u201d The company has taken decisive action by addressing the security concern in the latest updates, iOS 17.0.3 and iPadOS 17.0.3, reinforcing checks and defenses.\n\nThe scope of this vulnerability encompasses a wide range of Apple devices, including the iPhone XS and subsequent models, as well as various iPad iterations, such as the iPad Pro 12.9-inch 2nd generation and beyond, iPad Pro 10.5-inch, and more.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nAdditionally, Apple has tackled another zero-day concern, denoted as CVE-2023-5217. This issue stems from a heap buffer overflow weakness found in the VP8 encoding of the open-source libvpx video codec library. Successful exploitation could potentially allow arbitrary code execution. Notably, Google had previously addressed this libvpx bug in its Chrome web browser, while Microsoft applied patches in its Edge, Teams, and Skype products.\n\nRemarkably, CVE-2023-5217 was pinpointed by Cl\u00e9ment Lecigne, a security researcher affiliated with Google\u2019s Threat Analysis Group (TAG). TAG is renowned for its consistent identification of zero-days employed in government-backed targeted spyware assaults, typically targeting high-risk individuals.\n\nThis latest security concern, CVE-2023-42824, marks the 17th zero-day vulnerability that Apple has confronted and resolved since the commencement of the year. Among these, several were reported by prominent security researchers, including Citizen Lab and Google TAG, and were leveraged in espionage attempts.\nTrending: Maximizing IDOR Detection with Burp Suite\u2019s Autorize Trending: Recon Tool: Mantra\nThe gravity of these vulnerabilities necessitated immediate attention, as they were exploited to facilitate the installation of sophisticated spyware, such as Cytrox\u2019s Predator and NSO Group\u2019s Pegasus, on iOS devices.\n\nIn the ongoing effort to safeguard Apple users, the company continues to demonstrate its commitment to patching vulnerabilities and enhancing the security of its ecosystem. As iOS 17.0.3 debuts, it not only addresses critical security issues but also resolves an overheating problem reported on iPhones running iOS 17.0.2 and earlier versions. Apple users are strongly advised to promptly apply these crucial updates to bolster their device\u2019s security and overall performance.\nTrending: Hackers Employ ZeroFont Trick in Phishing Emails to Bypass Security Checks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleeping[...]", "creation_timestamp": "2026-09-01T20:00:46.935919Z"}