{"vulnerability": "CVE-2023-32435", "sightings": [{"uuid": "70dac68f-ebab-4587-92b9-feadd9d1c0c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-23T18:10:03.000000Z"}, {"uuid": "d1c232f4-914d-4926-be66-8e77748a8e67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971840", "content": "", "creation_timestamp": "2024-12-24T20:34:42.171239Z"}, {"uuid": "6ce67427-64d0-4f2a-a91f-295048e9332f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:43.000000Z"}, {"uuid": "89e6ff46-bcb0-4f07-8cc3-a070c8346547", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1049", "content": "", "creation_timestamp": "2023-06-23T04:00:00.000000Z"}, {"uuid": "96fb7a63-2b50-4b24-a4bf-c0be8ea1d8d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/41a7ac4f-266e-408d-8d7f-592cb11a873d", "content": "", "creation_timestamp": "2026-02-02T12:26:56.588709Z"}, {"uuid": "c157658b-a047-42d0-a427-a75bf39a2ac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://t.me/itsec_news/2936", "content": "\u200b\u26a1\ufe0fApple \u043f\u0440\u043e\u0442\u0438\u0432 \u043a\u0438\u0431\u0435\u0440\u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430: \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b iPhone \u0438 Mac \u043e\u0442 \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f.\n\n\ud83d\udcac Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 iPhone, Mac \u0438 iPad.\n\n\u0412 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Apple \u043e\u043f\u0438\u0441\u0430\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f WebKit, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0443\u044e \u043a\u0430\u043a CVE-2023-37450 , \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043d\u043e\u0432\u043e\u043c \u0440\u0430\u0443\u043d\u0434\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 Rapid Security Response (RSR) \u0440\u0430\u043d\u0435\u0435 \u0432 \u0438\u044e\u043b\u0435. \u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434, \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0436\u0435\u0440\u0442\u0432 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b.\n\n\u0415\u0449\u0435 \u043e\u0434\u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0441\u0435\u0433\u043e\u0434\u043d\u044f 0day-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u2014 \u044d\u0442\u043e \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044f\u0434\u0440\u0430 CVE-2023-38606 , \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 iOS, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0434\u043e iOS 15.7.1. \u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0432\u0430\u0436\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0439 \u044f\u0434\u0440\u0430. Apple \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0443\u043b\u0443\u0447\u0448\u0438\u0432 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kaspersky GReAT, \u043e\u0448\u0438\u0431\u043a\u0430 CVE-2023-38606 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0430\u0441\u0442\u044c\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 Zero-Click \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0432 \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 Triangulation \u043d\u0430 iPhone .\n\n\u0421 \u043d\u0430\u0447\u0430\u043b\u0430 2023 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0443\u0436\u0435 \u0434\u0435\u0441\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 iPhone, Mac \u0438\u043b\u0438 iPad:\n\n\u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u0434\u043d\u0451\u043c ( CVE-2023-32434 , CVE-2023-32435 \u0438 CVE-2023-32439 ) \u0432 \u0438\u044e\u043d\u0435;\n\u0435\u0449\u0451 \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u0434\u043d\u0451\u043c ( CVE-2023-32409 , CVE-2023-28204 \u0438 CVE-2023-32373 ) \u0432 \u043c\u0430\u0435;\n\u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u0434\u043d\u0451\u043c ( CVE-2023-28206 \u0438 CVE-2023-28205 ) \u0432 \u0430\u043f\u0440\u0435\u043b\u0435;\n\u0438 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c WebKit \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u0434\u043d\u0451\u043c ( CVE-2023-23529 ) \u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435.\n\u0421\u043f\u0438\u0441\u043e\u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0434\u0432\u0443\u043c\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043d\u0443\u043b\u0435\u0432\u044b\u043c\u0438 \u0434\u043d\u044f\u043c\u0438, \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043e\u0431\u0448\u0438\u0440\u0435\u043d \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 iPhone \u0438 iPad, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b Mac \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c macOS Big Sur, Monterey \u0438 Ventura.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2023-07-27T04:50:00.000000Z"}, {"uuid": "729b794d-4647-431e-9b16-f2e5f1a3881e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/itsec_news/3601", "content": "\u200b\u26a1\ufe0f\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0440\u044b\u0432 \u0432 \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f: \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u043e\u0431\u043e\u0448\u043b\u0430 \u0437\u0430\u0449\u0438\u0442\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432\n\n\ud83d\udcac \u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 \u0413\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0446\u0435\u043d\u0442\u0440\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u0433\u0440\u043e\u0437 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb (GReAT) \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Security Analyst Summit (SAS) \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f . \u041e\u043d\u0438 \u043e\u043f\u0438\u0441\u0430\u043b\u0438 \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 iOS \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b, \u043b\u0435\u0436\u0430\u0449\u0438\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0438\u0441\u044c \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u043e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043c\u043e\u0433\u043b\u0438 \u0438\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u043a\u0440\u044b\u0442\u0443\u044e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438 \u043f\u0440\u0435\u043e\u0434\u043e\u043b\u0435\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u043d\u044b\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043f\u0440\u043e\u0442\u0438\u0432\u043d\u0438\u043a\u043e\u0432, \u0434\u0430\u0431\u044b \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u044d\u0442\u0430\u043f\u044b \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438.\n\n\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043b\u0435\u0442\u043e\u043c \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 APT-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 iOS. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 iMessage, \u0447\u0442\u043e \u043d\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043b\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438. \u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0435 GReAT, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0431\u044b\u043b \u0448\u043f\u0438\u043e\u043d\u0430\u0436.\n\n\u041d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 SAS \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e\u043c\u0435\u0441\u044f\u0447\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430, \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0448\u0435\u0433\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0430\u0442\u0430\u043a\u0438 \u0441 \u043f\u044f\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438, \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u044b\u043b\u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f. \u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0432\u0445\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0448\u0440\u0438\u0444\u0442\u043e\u0432, \u0432\u0442\u043e\u0440\u0430\u044f - \u0432 \u043a\u043e\u0434\u0435 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 (\u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\n\u0415\u0449\u0451 \u0434\u0432\u0443\u043c\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u043d\u043e\u0432\u0435\u0439\u0448\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430 Apple. \u0422\u0430\u043a\u0436\u0435 \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c, \u0447\u0442\u043e, \u043f\u043e\u043c\u0438\u043c\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0437\u0430\u0440\u0430\u0436\u0430\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c iOS \u0447\u0435\u0440\u0435\u0437 iMessage, \u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0431\u044b\u043b\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440 Safari. \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u044f\u0442\u0443\u044e \u0438\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u041f\u043e\u0441\u043b\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0442 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb, Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 GReAT (CVE-2023-32434, CVE-2023-32435, CVE-2023-38606, CVE-2023-41990). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Apple, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 iPhone, iPod, iPad, \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0430 Mac OS, Apple TV \u0438 Apple Watch.\n\n\u0414\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u043f\u0440\u043e\u044f\u0432\u0438\u0442\u044c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u043c\u0435\u0442\u043e\u0434\u044b \u043e\u0431\u0445\u043e\u0434\u0430 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u0417\u0430\u0434\u0430\u0447\u0443 \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u043b\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0441\u0442\u044c iOS. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438\u0437 iMessage \u2014 \u043d\u0430\u0447\u0430\u043b\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u2014 \u043d\u0443\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0437\u0430\u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0435\u043a\u0441\u0442 \u0438 \u043a\u043b\u044e\u0447 \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f AES. \u041f\u0435\u0440\u0432\u044b\u0439 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u044b\u0442\u044c, \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0432 \u0442\u0440\u0430\u0444\u0438\u043a \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c iCloud \u0447\u0435\u0440\u0435\u0437 mitmproxy. \u041f\u0440\u043e\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435 \u0441 \u043a\u043b\u044e\u0447\u043e\u043c \u0431\u044b\u043b\u043e \u043d\u0435\u043b\u044c\u0437\u044f, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u043d \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 iMessage. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0447\u0442\u043e\u0431\u044b \u043a\u043b\u044e\u0447 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043b\u0441\u044f \u0432 \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 SMS.db. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043e\u043d\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0431\u0430\u0439\u0442 \u0432 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0442\u0435\u043a\u0441\u0442\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0434\u043b\u044f mitmproxy, \u0430 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b\u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u0443\u044e \u043a\u043e\u043f\u0438\u044e iTunes \u0441 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u043e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432) \u0438 \u0438\u0437\u0432\u043b\u0435\u043a\u043b\u0438 \u043a\u043b\u044e\u0447 \u0438\u0437 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0439\u0441\u044f \u0432 \u043d\u0435\u0439 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0412 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u043e\u0432\u044b\u0445 \u0447\u0438\u043f\u0430\u0445 Apple \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u043b\u0443\u0447\u0448\u0430\u044e\u0442 \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043a \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430\u043c, \u043d\u043e \u043d\u0435 \u0434\u0435\u043b\u0430\u044e\u0442 \u0438\u0445 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435\u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438. \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f \u0441\u043b\u0443\u0436\u0438\u0442 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435\u043c \u043e \u0432\u0430\u0436\u043d\u043e\u0441\u0442\u0438 \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 iMessage \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0432\u044b\u0432\u043e\u0434\u044b \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u044b \u0434\u043b\u044f \u043f\u0440\u043e\u0442\u0438\u0432\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c \u0430\u0442\u0430\u043a\u0430\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0431\u0430\u043b\u0430\u043d\u0441\u0430 \u043c\u0435\u0436\u0434\u0443 \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0441\u0442\u044c\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c\u044e \u0434\u043b\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2023-11-03T20:09:36.000000Z"}, {"uuid": "0007658c-499e-4d90-b47b-8c94dadae1a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://t.me/itsec_news/3916", "content": "\u200b\u26a1\ufe0f\u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u043e\u0431\u043b\u0430\u0447\u0438\u043b \u00ab\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044e \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb: \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439 \u043a\u0438\u0431\u0435\u0440\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438\n\n\ud83d\udcac \u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u043b\u0435\u0442\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u0443\u044e \u043a\u0438\u0431\u0435\u0440\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044e, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u0435 iPhone \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u042d\u0442\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u00ab\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb. \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043e\u0431\u0432\u0438\u043d\u0438\u043b\u0438 \u0432 \u0435\u0451 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u0438\u0435 \u0441\u043f\u0435\u0446\u0441\u043b\u0443\u0436\u0431\u044b.\n\nApple \u0437\u0430\u044f\u0432\u0438\u043b\u0430 \u043e \u0441\u0432\u043e\u0435\u043c \u043d\u0435\u043f\u0440\u0438\u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043a \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u043c \u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430.\n\n\u041c\u043d\u043e\u0433\u0438\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0435\u0448\u0438\u043b\u0438 \u043e\u0442\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f iPhone. \u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u043b\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438.\n\n27 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2023 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043d\u0433\u0440\u0435\u0441\u0441\u0435 Chaos Communication Congress (37C3) \u0432 \u0413\u0430\u043c\u0431\u0443\u0440\u0433\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u00ab\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb, \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u043b\u043e\u0436\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 Apple.\n\n\u0410\u0442\u0430\u043a\u0430, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 iMessage, \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u041e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0435\u0435 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u00ab\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f\u00bb \u0432 iOS \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 16.2.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 iMessage \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u0431\u0435\u0437 \u0432\u0435\u0434\u043e\u043c\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0414\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2023-41990 \u0432 \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 ADJUST, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0448\u0440\u0438\u0444\u0442\u043e\u0432 TrueType, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Apple. \u042d\u0442\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 90-\u0445 \u0433\u043e\u0434\u043e\u0432 \u0438 \u0431\u044b\u043b\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0430 \u0432 \u0432\u044b\u0448\u0435\u0434\u0448\u0435\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438.\n\n\u0412 \u0430\u0442\u0430\u043a\u0435 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0432\u043e\u0437\u0432\u0440\u0430\u0442\u043d\u043e- \u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u043d\u043e-\u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u041f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u043b\u043e \u0432 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0442\u0430\u043f\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044f\u0437\u044b\u043a\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 NSExpression/NSPredicate, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432 \u0441\u0440\u0435\u0434\u0443 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 JavaScriptCore \u0432\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430 JavaScript \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0435\u0433\u043e \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435\u0447\u0438\u0442\u0430\u0435\u043c\u044b\u043c \u0438 \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440. \u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0432 \u043d\u0435\u043c \u043e\u043a\u043e\u043b\u043e 11 000 \u0441\u0442\u0440\u043e\u043a \u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u044b \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f\u043c \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e JavaScriptCore \u0438 \u043f\u0430\u043c\u044f\u0442\u044c\u044e \u044f\u0434\u0440\u0430.\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 DollarVM ($vm), \u043e\u0442\u043b\u0430\u0434\u043e\u0447\u043d\u044b\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b JavaScriptCore, \u0447\u0442\u043e\u0431\u044b \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c\u044e JavaScriptCore \u0438\u0437 \u0441\u043a\u0440\u0438\u043f\u0442\u0430 \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043d\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 API.\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0431\u044b\u043b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043a\u0430\u043a \u043d\u0430 \u0441\u0442\u0430\u0440\u044b\u0445, \u0442\u0430\u043a \u0438 \u043d\u043e\u0432\u044b\u0445 iPhone \u0438 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u043b \u043e\u0431\u0445\u043e\u0434 Pointer Authentication Code (PAC) \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u043d\u043e\u0432\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u044f\u0445.\n\n\u0412 \u043d\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2023-32434 , \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u0430\u0445 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u043f\u0430\u043c\u044f\u0442\u044c\u044e \u044f\u0434\u0440\u0430 XNU (machmakememoryentry \u0438 vmmap). \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435-\u0437\u0430\u043f\u0438\u0441\u044c \u043a\u043e \u0432\u0441\u0435\u0439 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0414\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 Page Protection Layer (PPL) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b \u0432\u0432\u043e\u0434\u0430-\u0432\u044b\u0432\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u043c\u044f\u0442\u044c (MMIO). \u042d\u0442\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 CVE-2023-38606 .\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432\u0441\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 JavaScript-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0438 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u0448\u043b\u0438 \u0438\u043d\u044b\u043c \u043f\u0443\u0442\u0435\u043c: \u0430) \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 IMAgent \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0432 \u043d\u0435\u0433\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443, \u0441\u0442\u0438\u0440\u0430\u044e\u0449\u0443\u044e \u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441\u043b\u0435\u0434\u044b \u0430\u0442\u0430\u043a\u0438; b) \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 Safari \u0432 \u0444\u043e\u043d\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0435\u0433\u043e \u043d\u0430 \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043a \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c\u0443 \u044d\u0442\u0430\u043f\u0443.\n\n\u0412\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0441\u043a\u0440\u0438\u043f\u0442, \u0432\u0435\u0440\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0436\u0435\u0440\u0442\u0432\u0443, \u0438, \u0435\u0441\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u0440\u043e\u0439\u0434\u0435\u043d\u0430, \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0435\u0440\u0435\u0445\u043e\u0434 \u043a \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c\u0443 \u044d\u0442\u0430\u043f\u0443 \u2014 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0434\u043b\u044f Safari.\n\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f Safari \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2023-32435 , \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430.\n\n\u0428\u0435\u043b\u043b-\u043a\u043e\u0434 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0435\u0449\u0435 \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u044f\u0434\u0440\u0430 \u0432 \u0432\u0438\u0434\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 Mach. \u041e\u043d \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u0435 \u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2023-32434 \u0438 CVE-2023-38606 , \u0442\u0430\u043a\u0436\u0435 \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u044f\u0435\u0442 \u0441\u0432\u043e\u0438\u043c\u0438 \u0440\u0430\u0437\u043c\u0435\u0440\u0430\u043c\u0438 \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e, \u043d\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u043d\u0435 \u043f\u043e\u0445\u043e\u0436 \u043d\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 JavaScript. \u0421\u043e\u0432\u043f\u0430\u0434\u0430\u044e\u0442 \u043b\u0438\u0448\u044c \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0447\u0430\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0432\u044b\u0448\u0435\u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0430 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0438 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0441 \u043d\u0435\u0439. \u0412 \u043d\u0435\u043c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0443\u0436\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f.", "creation_timestamp": "2023-12-28T10:08:15.000000Z"}, {"uuid": "f24058de-20a6-4d0b-b5ea-f0f9dc41b0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://t.me/alexmakus/5221", "content": "\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u041b\u041a \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0431 \u00ab\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0442\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb, \u0433\u0434\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438\u0437 4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 iOS \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043d\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0432\u0448\u0438\u0439 \u0443\u0447\u0430\u0441\u0442\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f:\n\n \u2022 Attackers send a malicious iMessage attachment, which the application processes without showing any signs to the user.\n \u2022 This attachment exploits the remote code execution vulnerability\u00a0CVE-2023-41990\u00a0in the undocumented, Apple-only ADJUST TrueType font instruction. This instruction had existed since the early nineties before a patch removed it.\n \u2022 It uses return/jump oriented programming and multiple stages written in the NSExpression/NSPredicate query language, patching the JavaScriptCore library environment to execute a privilege escalation exploit written in JavaScript.\n \u2022 This JavaScript exploit is obfuscated to make it completely unreadable and to minimize its size. Still, it has around 11,000 lines of code, which are mainly dedicated to JavaScriptCore and kernel memory parsing and manipulation.\n \u2022 It exploits the JavaScriptCore debugging feature DollarVM ($vm) to gain the ability to manipulate JavaScriptCore\u2019s memory from the script and execute native API functions.\n \u2022 It was designed to support both old and new iPhones and included a Pointer Authentication Code (PAC) bypass for exploitation of recent models.\n \u2022 It uses the integer overflow vulnerability\u00a0CVE-2023-32434\u00a0in XNU\u2019s memory mapping syscalls (mach_make_memory_entry and vm_map) to obtain read/write access to the entire physical memory of the device at user level.\n \u2022 It uses hardware memory-mapped I/O (MMIO) registers to bypass the Page Protection Layer (PPL). This was mitigated as\u00a0CVE-2023-38606.\n \u2022 After exploiting all the vulnerabilities, the JavaScript exploit can do whatever it wants to the device including running spyware, but the attackers chose to: (a) launch the IMAgent process and inject a payload that clears the exploitation artefacts from the device; (b) run a Safari process in invisible mode and forward it to a web page with the next stage.\n \u2022 The web page has a script that verifies the victim and, if the checks pass, receives the next stage: the Safari exploit.\n \u2022 The Safari exploit uses\u00a0CVE-2023-32435\u00a0to execute a shellcode.\n \u2022 The shellcode executes another kernel exploit in the form of a Mach object file. It uses the same vulnerabilities:\u00a0CVE-2023-32434\u00a0and\u00a0CVE-2023-38606. It is also massive in terms of size and functionality, but completely different from the kernel exploit written in JavaScript. Certain parts related to exploitation of the above-mentioned vulnerabilities are all that the two share. Still, most of its code is also dedicated to parsing and manipulation of the kernel memory. It contains various post-exploitation utilities, which are mostly unused.\n \u2022 The exploit obtains root privileges and proceeds to execute other stages, which load spyware. We covered these stages in our previous posts.\n\nhttps://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/", "creation_timestamp": "2023-12-28T03:17:18.000000Z"}, {"uuid": "679fcd22-26d5-4f37-af35-ed6e094a259c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://t.me/kasperskyb2b/710", "content": "\ud83c\udf4f Apple \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u0434\u044b\u0440\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432 \u0430\u0442\u0430\u043a\u0435 Triangulation\n\n\u0412\u0447\u0435\u0440\u0430 \u0432\u0435\u0447\u0435\u0440\u043e\u043c Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f iOS 15 \u0438 iOS 16, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2023-32434 \u0432 \u044f\u0434\u0440\u0435 \u0438 CVE-2023-32435 \u0438 -32439 \u0432 Webkit.  \u041e\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0438  \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430  (\u0438 \u0432\u0447\u0435\u0440\u0430 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043f\u0440\u043e \u044d\u0442\u043e\u0442 \u043a\u043e\u0434 \ud83d\ude0e).  \u041e\u0431\u043d\u043e\u0432\u043b\u044f\u0439\u0442\u0435\u0441\u044c \u0441\u043a\u043e\u0440\u0435\u0435!\n\n#iOSTriangulation #\u043d\u043e\u0432\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2023-06-22T10:55:50.000000Z"}, {"uuid": "67bf636e-4e50-4f9c-9c89-3d2a64b26326", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/ctinow/119705", "content": "https://ift.tt/Ti04r5V\nApple fixes zero-day vulnerabilities used to covertly deliver spyware (CVE-2023-32435)", "creation_timestamp": "2023-06-22T13:26:16.000000Z"}, {"uuid": "29b7eded-d0fc-4305-b35a-50802b25c0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/CyberBulletin/2154", "content": "\u26a1One year later, there is still no public details of this 0-Day RCE bug in Safari. CVE-2023-32435.\n\n#CyberBulletin", "creation_timestamp": "2025-01-24T13:32:14.000000Z"}, {"uuid": "356abf80-c534-4fe7-b311-c75952428c0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "Telegram/7dSlb-0czcdIF1tYEj56BREFSMbL2JYuk8jyNafYi4m26A", "content": "", "creation_timestamp": "2023-06-24T19:06:17.000000Z"}, {"uuid": "34562cc7-81cd-4e50-b532-4186141f2c7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://t.me/KomunitiSiber/404", "content": "U.S. Cybersecurity Agency Adds 6 Flaws to Known Exploited Vulnerabilities Catalog\nhttps://thehackernews.com/2023/06/us-cybersecurity-agency-adds-6-flaws-to.html\n\nThe U.S. Cybersecurity and Infrastructure Security Agency has\u00a0added\u00a0a batch of six flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.\nThis comprises three vulnerabilities that Apple patched this week (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439), two flaws in VMware (CVE-2023-20867\u00a0and\u00a0CVE-2023-20887), and one shortcoming impacting Zyxel", "creation_timestamp": "2023-06-24T19:03:28.000000Z"}, {"uuid": "8438184c-b953-4776-b2ff-45ebea471147", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://t.me/true_secator/4529", "content": "\u041e\u0431\u0435\u0441\u043f\u043e\u043a\u043e\u0435\u043d\u043d\u044b\u0435 \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u044b \u043c\u043e\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0433\u0430\u0434\u0436\u0435\u0442\u043e\u0432 Apple, \u0432 \u0447\u0438\u0441\u043b\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0434\u0430\u0436\u0435 \u0441\u0430\u043c \u0418\u043b\u043e\u043d \u041c\u0430\u0441\u043a, \u043d\u0430\u043a\u043e\u043d\u0435\u0446-\u0442\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0437\u0430\u0432\u0435\u0442\u043d\u043e\u0435  \u043f\u043b\u0430\u0446\u0435\u0431\u043e  \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\nApple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430\u00a0\u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439\u00a0\u0434\u043b\u044f iOS, iPadOS, macOS, watchOS \u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Safari \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0440\u044f\u0434\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u043f\u043e \u0435\u0435 \u0441\u043b\u043e\u0432\u0430\u043c, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n\n\u0412 \u0446\u0435\u043d\u0442\u0440\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 - \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u0436\u0435, \u0434\u0432\u0430 0-day, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441\u043e. \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0435\u0439, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 CVE-2023-32434\u00a0\u2014 \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0446\u0435\u043b\u044b\u0445 \u0447\u0438\u0441\u0435\u043b \u0432 \u044f\u0434\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043b\u044f RCE \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u044f\u0434\u0440\u0430.\n\n\u0414\u0440\u0443\u0433\u0430\u044f CVE-2023-32435\u00a0\u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0432 WebKit, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 RCE \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0435\u0431-\u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430.\n\nApple \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f WebKit (CVE-2023-32439), \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u0442\u0438\u043f\u043e\u0432.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u0441\u043f\u0438\u0441\u043e\u043a \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043e\u0431\u0448\u0438\u0440\u0435\u043d, \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0441\u0442\u0430\u0440\u044b\u0435 \u0438 \u043d\u043e\u0432\u044b\u0435 \u043c\u043e\u0434\u0435\u043b\u0438, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0435\u043f\u0435\u0440\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f: macOS Ventura 13.4.1, macOS Monterey 12.6.7, macOS Big Sur 11.7.8, iOS 16.5.1 \u0438 iPadOS 16.5.1, iOS 15.7.7 \u0438 iPadOS 15.7.7, watchOS 9.5.2 \u0438 watchOS 8.8.1 \u0441 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430\u043c\u0438, \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0430 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c.\n\n\u0412\u043e\u043e\u0431\u0449\u0435 \u0436\u0435 \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0433\u043e\u0434\u0430 Apple \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u0432 iPhone, Mac \u0438 iPad.\n\n\u041d\u043e \u044d\u0442\u043e \u043d\u0438\u0447\u0435\u0433\u043e, \u0432\u0435\u0434\u044c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044c Apple \u0437\u0430\u0432\u0435\u0440\u0438\u043b, \u0447\u0442\u043e  \"We have never worked with any government to insert a backdoor into any Apple product and never will\".\n\n\u0418, \u043a\u043e\u043d\u0435\u0447\u043d\u043e, \u0434\u043e\u0431\u0430\u0432\u0438\u043b \"\u0411\u043b\u044f \u0431\u0443\u0434\u0443!\".", "creation_timestamp": "2023-06-22T16:22:04.000000Z"}, {"uuid": "c3a9ce53-202f-4ce1-8f92-b6c7be0cb8ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "published-proof-of-concept", "source": "https://t.me/kasraone_com/626", "content": "\u00ab\u067e\u06cc\u0686\u06cc\u062f\u0647\u200c\u062a\u0631\u06cc\u0646\u00bb \u0632\u0646\u062c\u06cc\u0631\u0647 \u062d\u0645\u0644\u0647 \u0622\u06cc\u0641\u0648\u0646 \u06a9\u0647 \u062a\u0627 \u0628\u0647 \u062d\u0627\u0644 \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0627\u0633\u062a - \u0627\u0632 \u0686\u0647\u0627\u0631 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632 \u0635\u0641\u0631 \u0628\u0631\u0627\u06cc \u0627\u06cc\u062c\u0627\u062f \u06cc\u06a9 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0627 \u06a9\u0644\u06cc\u06a9 \u0635\u0641\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n \u0628\u06cc\u0646 \u0633\u0627\u0644\u200c\u0647\u0627\u06cc 2019 \u0648 \u062f\u0633\u0627\u0645\u0628\u0631 2022\u060c \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0633\u06cc\u0627\u0631 \u067e\u06cc\u0634\u0631\u0641\u062a\u0647 iMessage \u0638\u0627\u0647\u0631 \u0634\u062f \u06a9\u0647 \u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc Kaspersky \u06a9\u0647 \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u0622\u0646 \u0631\u0627 \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0646\u062f\u060c \u0622\u0646 \u0631\u0627 Operation Triangulation \u0646\u0627\u0645\u06cc\u062f\u0646\u062f. \u0627\u06a9\u0646\u0648\u0646\u060c \u0622\u0646\u200c\u0647\u0627 \u0622\u0646\u0686\u0647 \u0631\u0627 \u06a9\u0647 \u062f\u0631\u0628\u0627\u0631\u0647 \u00ab\u067e\u06cc\u0686\u06cc\u062f\u0647\u200c\u062a\u0631\u06cc\u0646 \u0632\u0646\u062c\u06cc\u0631\u0647 \u062d\u0645\u0644\u0647\u200c\u0627\u06cc \u06a9\u0647 \u062a\u0627 \u0628\u0647 \u062d\u0627\u0644 \u062f\u06cc\u062f\u0647\u200c\u0627\u0646\u062f\u00bb \u0628\u0647 \u0627\u0634\u062a\u0631\u0627\u06a9 \u0645\u06cc\u200c\u06af\u0630\u0627\u0631\u0646\u062f.\n\n\u0627\u0645\u0631\u0648\u0632 \u062f\u0631 \u06a9\u0646\u0641\u0631\u0627\u0646\u0633 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0622\u0634\u0648\u0628\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0633\u067e\u0631\u0633\u06a9\u06cc \u0628\u0648\u0631\u06cc\u0633 \u0644\u0627\u0631\u06cc\u0646\u060c \u0644\u0626\u0648\u0646\u06cc\u062f \u0628\u0632\u0648\u06cc\u0686\u0646\u06a9\u0648 \u0648 \u06af\u0626\u0648\u0631\u06af\u06cc \u06a9\u0648\u0686\u0631\u06cc\u0646 \u062f\u0631 \u0645\u0648\u0631\u062f \"\u0639\u0645\u0644\u06cc\u0627\u062a \u0645\u062b\u0644\u062b\" \u0633\u062e\u0646\u0631\u0627\u0646\u06cc \u06a9\u0631\u062f\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0648\u0644\u06cc\u0646 \u0628\u0627\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0627\u06cc\u0646 \u0633\u0647 \u0646\u0641\u0631 \u00ab\u062a\u0645\u0627\u0645 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0648 \u062c\u0632\u0626\u06cc\u0627\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u067e\u06cc\u0634\u0631\u0641\u062a\u0647 iMessage \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u0627\u0641\u0634\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f\u00bb.\n\n\u0645\u062d\u0642\u0642\u0627\u0646 \u0647\u0645\u0686\u0646\u06cc\u0646 \u062a\u0645\u0627\u0645 \u06a9\u0627\u0631\u0647\u0627\u06cc \u062e\u0648\u062f \u0631\u0627 \u0627\u0645\u0631\u0648\u0632 \u062f\u0631 \u0648\u0628\u0644\u0627\u06af Kaspersky SecureList \u0628\u0647 \u0627\u0634\u062a\u0631\u0627\u06a9 \u06af\u0630\u0627\u0634\u062a\u0646\u062f.\n\n\u062f\u0631 \u0632\u06cc\u0631 \u0632\u0646\u062c\u06cc\u0631\u0647 \u062d\u0645\u0644\u0647 \u06a9\u0627\u0645\u0644 \u0648 \u067e\u06cc\u0686\u06cc\u062f\u0647 \u0634\u0627\u0645\u0644 \u0686\u0647\u0627\u0631 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0648\u0632 \u0635\u0641\u0631 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u06cc\u0634\u0647 \u0628\u0647 \u062f\u0633\u062a\u06af\u0627\u0647 \u0642\u0631\u0628\u0627\u0646\u06cc \u0627\u0633\u062a:\n\u2022 \u0645\u0647\u0627\u062c\u0645 \u06cc\u06a9 \u067e\u06cc\u0648\u0633\u062a iMessage \u0645\u062e\u0631\u0628 \u0627\u0631\u0633\u0627\u0644 \u0645\u06cc \u06a9\u0646\u062f\u060c \u06a9\u0647 \u0628\u0631\u0646\u0627\u0645\u0647 \u0628\u062f\u0648\u0646 \u0646\u0634\u0627\u0646 \u062f\u0627\u062f\u0646 \u0647\u06cc\u0686 \u0646\u0634\u0627\u0646\u0647 \u0627\u06cc \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u060c \u0622\u0646 \u0631\u0627 \u067e\u0631\u062f\u0627\u0632\u0634 \u0645\u06cc \u06a9\u0646\u062f.\n\n\u2022 \u0627\u06cc\u0646 \u067e\u06cc\u0648\u0633\u062a \u0627\u0632 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0641\u0642\u0637 \u0628\u0631\u0627\u06cc \u0627\u067e\u0644\u060c CVE-2023-41990 \u062f\u0631 \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644 \u0641\u0648\u0646\u062a ADJUST TrueType \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644 \u0627\u0632 \u0627\u0648\u0627\u06cc\u0644 \u062f\u0647\u0647 \u0646\u0648\u062f \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u06cc\u06a9 \u067e\u0686 \u0622\u0646 \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0631\u062f.\n\n\u2022 \u0627\u0632 \u0628\u0631\u0646\u0627\u0645\u0647 \u0646\u0648\u06cc\u0633\u06cc \u0628\u0627\u0632\u06af\u0634\u062a\u06cc/\u067e\u0631\u0634 \u06af\u0631\u0627 \u0648 \u0686\u0646\u062f\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647 \u0646\u0648\u0634\u062a\u0647 \u0634\u062f\u0647 \u062f\u0631 \u0632\u0628\u0627\u0646 \u067e\u0631\u0633 \u0648 \u062c\u0648 NSExpression/NSPredicate \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0627\u0641\u0632\u0627\u06cc\u0634 \u0627\u0645\u062a\u06cc\u0627\u0632 \u0646\u0648\u0634\u062a\u0647 \u0634\u062f\u0647 \u062f\u0631 \u062c\u0627\u0648\u0627 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0628\u0627 \u0648\u0635\u0644\u0647 \u0645\u062d\u06cc\u0637 \u06a9\u062a\u0627\u0628\u062e\u0627\u0646\u0647 JavaScriptCore \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f.\n\n\u2022 \u0627\u06cc\u0646 \u06a9\u062f \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u062c\u0627\u0648\u0627 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0645\u0628\u0647\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a \u062a\u0627 \u06a9\u0627\u0645\u0644\u0627\u064b \u0646\u0627\u062e\u0648\u0627\u0646\u0627 \u0634\u0648\u062f \u0648 \u0627\u0646\u062f\u0627\u0632\u0647 \u0622\u0646 \u062a\u0627 \u062d\u062f \u0627\u0645\u06a9\u0627\u0646 \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0628\u062f. \u0628\u0627 \u0627\u06cc\u0646 \u0648\u062c\u0648\u062f\u060c \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u0634\u0627\u0645\u0644 11000 \u062e\u0637 \u06a9\u062f \u0627\u0633\u062a \u06a9\u0647 \u0639\u0645\u062f\u062a\u0627\u064b \u0628\u0631\u0627\u06cc \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u062d\u0627\u0641\u0638\u0647 JavaScriptCore \u0648 \u0647\u0633\u062a\u0647 \u0627\u0633\u062a.\n\n\u2022 \u0627\u0632 \u0648\u06cc\u0698\u06af\u06cc \u0627\u0634\u06a9\u0627\u0644 \u0632\u062f\u0627\u06cc\u06cc DollarVM ($vm) JavaScriptCore \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f \u062a\u0627 \u062a\u0648\u0627\u0646\u0627\u06cc\u06cc \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u062d\u0627\u0641\u0638\u0647 JavaScriptCore \u0648 \u0627\u062c\u0631\u0627\u06cc \u062a\u0648\u0627\u0628\u0639 API \u0628\u0648\u0645\u06cc \u0631\u0627 \u0627\u0632 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0647\u0627 \u0628\u0647 \u062f\u0633\u062a \u0622\u0648\u0631\u062f.\n\n\u2022 \u0627\u06cc\u0646 \u0628\u0631\u0646\u0627\u0645\u0647 \u0628\u0631\u0627\u06cc \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0627\u0632 \u0622\u06cc\u0641\u0648\u0646 \u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc \u0648 \u062c\u062f\u06cc\u062f \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a \u0648 \u062f\u0627\u0631\u0627\u06cc \u0648\u06cc\u0698\u06af\u06cc \u062f\u0648\u0631 \u0632\u062f\u0646 \u06a9\u062f \u062a\u0623\u06cc\u06cc\u062f \u0647\u0648\u06cc\u062a \u0627\u0634\u0627\u0631\u0647 \u06af\u0631 (PAC) \u0628\u0631\u0627\u06cc \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 \u0645\u062f\u0644 \u0647\u0627\u06cc \u0627\u062e\u06cc\u0631 \u0627\u0633\u062a.\n\n\u2022 \u0627\u0632 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0633\u0631\u0631\u06cc\u0632 \u0627\u0639\u062f\u0627\u062f \u0635\u062d\u06cc\u062d CVE-2023-32434 \u062f\u0631 \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc \u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0646\u0642\u0634\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u062d\u0627\u0641\u0638\u0647 XNU (mach_make_memory_entry \u0648 vm_map) \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u062e\u0648\u0627\u0646\u062f\u0646/\u0646\u0648\u0634\u062a\u0646 \u0628\u0647 \u06a9\u0644 \u062d\u0627\u0641\u0638\u0647 \u0641\u06cc\u0632\u06cc\u06a9\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u062f\u0631 \u0633\u0637\u062d \u06a9\u0627\u0631\u0628\u0631 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f.\n\n\u2022 \u0627\u0632 \u0631\u062c\u06cc\u0633\u062a\u0631\u0647\u0627\u06cc I/O (MMIO) \u0646\u06af\u0627\u0634\u062a \u0634\u062f\u0647 \u062d\u0627\u0641\u0638\u0647 \u0633\u062e\u062a \u0627\u0641\u0632\u0627\u0631\u06cc \u0628\u0631\u0627\u06cc \u062f\u0648\u0631 \u0632\u062f\u0646 \u0644\u0627\u06cc\u0647 \u062d\u0641\u0627\u0638\u062a\u06cc \u0635\u0641\u062d\u0647 (PPL) \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 CVE-2023-38606 \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0641\u062a\u0647 \u0627\u0633\u062a.\n\n\u2022 \u067e\u0633 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u062a\u0645\u0627\u0645 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0645\u0648\u0631\u062f \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0646\u062f\u060c \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u062c\u0627\u0648\u0627 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0647\u0631 \u06a9\u0627\u0631\u06cc \u0631\u0627 \u06a9\u0647 \u0645\u06cc\u200c\u062e\u0648\u0627\u0647\u062f \u0628\u0627 \u062f\u0633\u062a\u06af\u0627\u0647 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647 \u0627\u062c\u0631\u0627\u06cc \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc \u062c\u0627\u0633\u0648\u0633\u06cc\u060c \u0627\u0645\u0627 \u0645\u0647\u0627\u062c\u0645 \u062a\u0635\u0645\u06cc\u0645 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f: (\u0627\u0644\u0641) \u0641\u0631\u0622\u06cc\u0646\u062f IMAgent \u0631\u0627 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u06a9\u0646\u062f \u0648 \u0627\u0628\u0632\u0627\u0631 \u0645\u0624\u062b\u0631\u06cc \u0631\u0627 \u062a\u0632\u0631\u06cc\u0642 \u06a9\u0646\u062f \u06a9\u0647 \u0622\u062b\u0627\u0631 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0631\u0627 \u0628\u0631 \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u067e\u0627\u06a9 \u06a9\u0646\u062f. \u0628\u0627\u0631 \u062f\u0633\u062a\u06af\u0627\u0647\u061b (\u0628) \u0641\u0631\u0622\u06cc\u0646\u062f \u0633\u0627\u0641\u0627\u0631\u06cc \u0631\u0627 \u062f\u0631 \u062d\u0627\u0644\u062a \u0645\u062e\u0641\u06cc \u0627\u062c\u0631\u0627 \u0645\u06cc \u06a9\u0646\u062f \u0648 \u0622\u0646 \u0631\u0627 \u0628\u0647 \u06cc\u06a9 \u0635\u0641\u062d\u0647 \u0648\u0628 \u0628\u0627 \u0645\u062d\u062a\u0648\u0627\u06cc \u0645\u0631\u062d\u0644\u0647 \u0628\u0639\u062f\u06cc \u0627\u0631\u0633\u0627\u0644 \u0645\u06cc \u06a9\u0646\u062f.\n\n\u2022 \u06cc\u06a9 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u062f\u0631 \u0635\u0641\u062d\u0647 \u0648\u0628 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f \u06a9\u0647 \u0642\u0631\u0628\u0627\u0646\u06cc \u0631\u0627 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0645\u06cc \u06a9\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u0628\u0648\u0631 \u0627\u0632 \u0686\u06a9\u060c \u0645\u0631\u062d\u0644\u0647 \u0628\u0639\u062f\u06cc \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u0645\u06cc \u06a9\u0646\u062f: Safari exploit.\n\n\u2022 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0633\u0627\u0641\u0627\u0631\u06cc \u0627\u0632 CVE-2023-32435 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u067e\u0648\u0633\u062a\u0647 \u0633\u0648\u0621 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f.\n\n\u2022 Shellcode \u06cc\u06a9 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0647\u0633\u062a\u0647 \u062f\u06cc\u06af\u0631\u06cc \u0631\u0627 \u062f\u0631 \u0642\u0627\u0644\u0628 \u06cc\u06a9 \u0641\u0627\u06cc\u0644 \u0634\u06cc Mach \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f. \u0627\u0632 \u0647\u0645\u0627\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u06a9\u0646\u062f: CVE-2023-32434 \u0648 CVE-2023-38606. \u0647\u0645\u0686\u0646\u06cc\u0646 \u0627\u0632 \u0646\u0638\u0631 \u0627\u0646\u062f\u0627\u0632\u0647 \u0648 \u0639\u0645\u0644\u06a9\u0631\u062f \u0628\u0633\u06cc\u0627\u0631 \u0628\u0632\u0631\u06af \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0686\u06cc\u0632\u06cc \u0634\u0628\u06cc\u0647 \u06cc\u06a9 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0647\u0633\u062a\u0647 \u0646\u0648\u0634\u062a\u0647 \u0634\u062f\u0647 \u062f\u0631 \u062c\u0627\u0648\u0627 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u0646\u06cc\u0633\u062a. \u0628\u0631\u062e\u06cc \u0627\u0632 \u0628\u062e\u0634 \u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0641\u0648\u0642 \u0628\u0631\u0627\u06cc \u0647\u0631 \u062f\u0648 \u0645\u0634\u062a\u0631\u06a9 \u0627\u0633\u062a. \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u06a9\u062f \u0622\u0646 \u0646\u06cc\u0632 \u0628\u0647 \u062a\u062c\u0632\u06cc\u0647 \u0648 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u062d\u0627\u0641\u0638\u0647 \u0647\u0633\u062a\u0647 \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u0631\u062f. \u0627\u06cc\u0646 \u0634\u0627\u0645\u0644 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u067e\u0633 \u0627\u0632 \u0628\u0647\u0631\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0639\u0645\u062f\u062a\u0627\u064b \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0646\u0645\u06cc \u0634\u0648\u0646\u062f.\n\n\u2022 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0645\u062a\u06cc\u0627\u0632\u0627\u062a \u0631\u06cc\u0634\u0647 \u0631\u0627 \u0628\u0647 \u062f\u0633\u062a \u0645\u06cc\u200c\u0622\u0648\u0631\u062f \u0648 \u0628\u0647 \u0645\u0631\u0627\u062d\u0644 \u062f\u06cc\u06af\u0631\u06cc \u06a9\u0647 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc \u062c\u0627\u0633\u0648\u0633\u06cc \u0628\u0627\u0631\u06af\u06cc\u0631\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u0627\u062f\u0627\u0645\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f. \u062f\u0631 \u067e\u0633\u062a \u0642\u0628\u0644\u06cc \u0628\u0647 \u0627\u06cc\u0646 \u0645\u0631\u0627\u062d\u0644 \u067e\u0631\u062f\u0627\u062e\u062a\u06cc\u0645.\n\nLINK \n\nhttps://9to5mac.com/2023/12/27/most-sophisticated-iphone-attack-chain-ever-seen/\n\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2661 \u2800\u2800 \u3007\u2800\u00a0 \u2800 \u2399\u2800\u200c \u200c \u2332\u2063 \n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u02e1\u2071\u1d4f\u1d49\u00a0 \u1d9c\u1d52\u1d50\u1d50\u1d49\u207f\u1d57\u00a0 \u02e2\u1d43\u1d5b\u1d49\u00a0 \u02e2\u02b0\u1d43\u02b3\u1d49\n\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 K1\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 kasraone", "creation_timestamp": "2023-12-28T04:41:42.000000Z"}, {"uuid": "c560b142-e2b2-4bc2-a7fe-5db9af2a47d7", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e110d163-95f5-42ad-acdc-d067b7c6f4fb", "content": "", "creation_timestamp": "2026-06-19T12:46:53.216004Z"}, {"uuid": "de33b12b-0fb1-4d22-add0-6521ec87311b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cf522392-4057-4f0b-ac98-9a72aa744a46", "content": "", "creation_timestamp": "2026-06-23T14:05:42.290852Z"}, {"uuid": "0fb0d4be-71b1-4bab-b155-c10070761679", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/EchelonEyes/2329", "content": "\u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u00ab\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb, \u0440\u0430\u0441\u043a\u0440\u044b\u0432 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Apple.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0440\u0435\u0432\u0435\u0440\u0441-\u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u0431\u044b\u043b\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e, \u0447\u0442\u043e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0435 \u0430\u0442\u0430\u043a\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 iPhone \u0441 2019 \u0433\u043e\u0434\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0447\u0438\u043f\u043e\u0432 Apple \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0434\u0430\u043d\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0434\u043b\u044f \u043e\u0442\u043b\u0430\u0434\u043a\u0438 \u0438 \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0445 \u0438\u0441\u043f\u044b\u0442\u0430\u043d\u0438\u0439. \u0422\u043e\u0442 \u0444\u0430\u043a\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0446\u0435\u043b\u044f\u0445 \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b \u043e\u043f\u044b\u0442\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u043e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442, \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043f\u0430\u0441\u043d\u043e \u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u043f\u0440\u0438\u043d\u0446\u0438\u043f \u00ab\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u044f\u0441\u043d\u043e\u0441\u0442\u044c\u00bb, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0438\u043a\u0442\u043e \u043d\u0435 \u043f\u043e\u0439\u043c\u0435\u0442, \u043a\u0430\u043a \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043a \u043d\u0435\u0439 \u043d\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439.\n\n\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb \u2014 \u044d\u0442\u043e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 Apple iPhone \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0427\u0435\u0442\u044b\u0440\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u0430 \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 iOS \u0434\u043e iOS 16.2:\n\n- CVE-2023-41990: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0448\u0440\u0438\u0444\u0442\u0430 ADJUST TrueType, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435 iMessage;\n\n- CVE-2023-32434: \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u0430\u0445 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 XNU, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430;\n\n- CVE-2023-32435: \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0435 Safari \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438;\n\n- CVE-2023-38606: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b MMIO \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0442\u0440\u0430\u043d\u0438\u0446 (PPL), \u043f\u0435\u0440\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.\n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0441 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f iMessage \u0432 \u0446\u0435\u043b\u044c, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0418\u0437 \u0432\u044b\u0448\u0435\u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0440\u0438\u0433\u0443\u0435\u0442 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u043e\u0432 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb CVE-2023-38606. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 \u0447\u0438\u043f\u043e\u0432 Apple, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438 \u0437\u0430\u043f\u0438\u0441\u044c \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0438\u0433\u043d\u0443\u0442\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2023-32434.\n\n\u0412 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0438 \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u0442\u0441\u044f, \u0447\u0442\u043e CVE-2023-38606 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b MMIO (\u0432\u0432\u043e\u0434-\u0432\u044b\u0432\u043e\u0434 \u0441 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\u043c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Apple A12-A16 Bionic, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0441\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430 \u0447\u0438\u043f\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u044b \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 DeviceTree. \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u0442\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b \u0434\u043b\u044f \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u043c\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u044f\u043c\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0430\u0442\u0430\u043a\u0438.\n\nApple \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0435 \u0432 \u0438\u044e\u043d\u0435 2023 \u0433\u043e\u0434\u0430, \u043e\u0434\u043d\u0430\u043a\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u044f\u0441\u043d\u043e, \u043a\u0442\u043e \u0438 \u0441 \u043a\u0430\u043a\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b \u0430\u0442\u0430\u043a\u0438. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0436\u0435 \u0437\u0430\u0433\u0430\u0434\u043a\u0430 \u2013 \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u0443\u0437\u043d\u0430\u043b\u0438 \u043e \u0441\u043a\u0440\u044b\u0442\u043e\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0431\u044b\u043b\u0430 \u043d\u0435\u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://securelist.ru/operation-triangulation-the-last-hardware-mystery/108683/ \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0448\u043f\u0438\u043e\u043d\u0430\u0436 #\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442", "creation_timestamp": "2026-07-26T02:02:16.786739Z"}, {"uuid": "3aaca2cf-12ec-49f0-81b2-abf05ac3c0f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/EchelonEyes/2329", "content": "\u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u00ab\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb, \u0440\u0430\u0441\u043a\u0440\u044b\u0432 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Apple.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0440\u0435\u0432\u0435\u0440\u0441-\u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u0431\u044b\u043b\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e, \u0447\u0442\u043e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0435 \u0430\u0442\u0430\u043a\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 iPhone \u0441 2019 \u0433\u043e\u0434\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0447\u0438\u043f\u043e\u0432 Apple \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0434\u0430\u043d\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0434\u043b\u044f \u043e\u0442\u043b\u0430\u0434\u043a\u0438 \u0438 \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0445 \u0438\u0441\u043f\u044b\u0442\u0430\u043d\u0438\u0439. \u0422\u043e\u0442 \u0444\u0430\u043a\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0446\u0435\u043b\u044f\u0445 \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b \u043e\u043f\u044b\u0442\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u043e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442, \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043f\u0430\u0441\u043d\u043e \u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u043f\u0440\u0438\u043d\u0446\u0438\u043f \u00ab\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u044f\u0441\u043d\u043e\u0441\u0442\u044c\u00bb, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0438\u043a\u0442\u043e \u043d\u0435 \u043f\u043e\u0439\u043c\u0435\u0442, \u043a\u0430\u043a \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043a \u043d\u0435\u0439 \u043d\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439.\n\n\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb \u2014 \u044d\u0442\u043e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 Apple iPhone \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0427\u0435\u0442\u044b\u0440\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u0430 \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 iOS \u0434\u043e iOS 16.2:\n\n- CVE-2023-41990: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0448\u0440\u0438\u0444\u0442\u0430 ADJUST TrueType, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435 iMessage;\n\n- CVE-2023-32434: \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u0430\u0445 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 XNU, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430;\n\n- CVE-2023-32435: \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0435 Safari \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438;\n\n- CVE-2023-38606: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b MMIO \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0442\u0440\u0430\u043d\u0438\u0446 (PPL), \u043f\u0435\u0440\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.\n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0441 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f iMessage \u0432 \u0446\u0435\u043b\u044c, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0418\u0437 \u0432\u044b\u0448\u0435\u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0440\u0438\u0433\u0443\u0435\u0442 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u043e\u0432 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb CVE-2023-38606. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 \u0447\u0438\u043f\u043e\u0432 Apple, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438 \u0437\u0430\u043f\u0438\u0441\u044c \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0438\u0433\u043d\u0443\u0442\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2023-32434.\n\n\u0412 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0438 \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u0442\u0441\u044f, \u0447\u0442\u043e CVE-2023-38606 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b MMIO (\u0432\u0432\u043e\u0434-\u0432\u044b\u0432\u043e\u0434 \u0441 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\u043c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Apple A12-A16 Bionic, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0441\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430 \u0447\u0438\u043f\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u044b \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 DeviceTree. \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u0442\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b \u0434\u043b\u044f \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u043c\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u044f\u043c\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0430\u0442\u0430\u043a\u0438.\n\nApple \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0435 \u0432 \u0438\u044e\u043d\u0435 2023 \u0433\u043e\u0434\u0430, \u043e\u0434\u043d\u0430\u043a\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u044f\u0441\u043d\u043e, \u043a\u0442\u043e \u0438 \u0441 \u043a\u0430\u043a\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b \u0430\u0442\u0430\u043a\u0438. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0436\u0435 \u0437\u0430\u0433\u0430\u0434\u043a\u0430 \u2013 \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u0443\u0437\u043d\u0430\u043b\u0438 \u043e \u0441\u043a\u0440\u044b\u0442\u043e\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0431\u044b\u043b\u0430 \u043d\u0435\u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://securelist.ru/operation-triangulation-the-last-hardware-mystery/108683/ \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0448\u043f\u0438\u043e\u043d\u0430\u0436 #\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442", "creation_timestamp": "2026-07-27T00:00:53.562725Z"}, {"uuid": "3227f920-23a0-4a5f-abff-64e637ba1350", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/2329", "content": "\u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044f \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u0441\u0432\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u00ab\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb, \u0440\u0430\u0441\u043a\u0440\u044b\u0432 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Apple.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0440\u0435\u0432\u0435\u0440\u0441-\u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u0431\u044b\u043b\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e, \u0447\u0442\u043e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0435 \u0430\u0442\u0430\u043a\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 iPhone \u0441 2019 \u0433\u043e\u0434\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0447\u0438\u043f\u043e\u0432 Apple \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0434\u0430\u043d\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u0434\u043b\u044f \u043e\u0442\u043b\u0430\u0434\u043a\u0438 \u0438 \u0437\u0430\u0432\u043e\u0434\u0441\u043a\u0438\u0445 \u0438\u0441\u043f\u044b\u0442\u0430\u043d\u0438\u0439. \u0422\u043e\u0442 \u0444\u0430\u043a\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0446\u0435\u043b\u044f\u0445 \u0448\u043f\u0438\u043e\u043d\u0430\u0436\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b \u043e\u043f\u044b\u0442\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u043e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442, \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043f\u0430\u0441\u043d\u043e \u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u043f\u0440\u0438\u043d\u0446\u0438\u043f \u00ab\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u044f\u0441\u043d\u043e\u0441\u0442\u044c\u00bb, \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043d\u0438\u043a\u0442\u043e \u043d\u0435 \u043f\u043e\u0439\u043c\u0435\u0442, \u043a\u0430\u043a \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441\u043a\u0440\u044b\u0442\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u043a \u043d\u0435\u0439 \u043d\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439.\n\n\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb \u2014 \u044d\u0442\u043e \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 Apple iPhone \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0427\u0435\u0442\u044b\u0440\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043d\u0430 \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 iOS \u0434\u043e iOS 16.2:\n\n- CVE-2023-41990: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 \u0448\u0440\u0438\u0444\u0442\u0430 ADJUST TrueType, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435 iMessage;\n\n- CVE-2023-32434: \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u0430\u0445 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 XNU, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043a \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430;\n\n- CVE-2023-32435: \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0435 Safari \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043c\u043d\u043e\u0433\u043e\u044d\u0442\u0430\u043f\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438;\n\n- CVE-2023-38606: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b MMIO \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0442\u0440\u0430\u043d\u0438\u0446 (PPL), \u043f\u0435\u0440\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b.\n\n\u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0441 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u044f iMessage \u0432 \u0446\u0435\u043b\u044c, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u0418\u0437 \u0432\u044b\u0448\u0435\u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u043e\u0432 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0440\u0438\u0433\u0443\u0435\u0442 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u043e\u0432 \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e\u00bb CVE-2023-38606. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0443 \u0447\u0438\u043f\u043e\u0432 Apple, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438 \u0437\u0430\u043f\u0438\u0441\u044c \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0438\u0433\u043d\u0443\u0442\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2023-32434.\n\n\u0412 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0438 \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u0442\u0441\u044f, \u0447\u0442\u043e CVE-2023-38606 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b MMIO (\u0432\u0432\u043e\u0434-\u0432\u044b\u0432\u043e\u0434 \u0441 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435\u043c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u0445 Apple A12-A16 Bionic, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0441\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430 \u0447\u0438\u043f\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u043d\u044b \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 DeviceTree. \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u00ab\u0422\u0440\u0438\u0430\u043d\u0433\u0443\u043b\u044f\u0446\u0438\u044f\u00bb \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u0442\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u044b \u0434\u043b\u044f \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u043c\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u044f\u043c\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0430\u0442\u0430\u043a\u0438.\n\nApple \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0435 \u0432 \u0438\u044e\u043d\u0435 2023 \u0433\u043e\u0434\u0430, \u043e\u0434\u043d\u0430\u043a\u043e \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435\u044f\u0441\u043d\u043e, \u043a\u0442\u043e \u0438 \u0441 \u043a\u0430\u043a\u043e\u0439 \u0446\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b \u0430\u0442\u0430\u043a\u0438. \u0413\u043b\u0430\u0432\u043d\u0430\u044f \u0436\u0435 \u0437\u0430\u0433\u0430\u0434\u043a\u0430 \u2013 \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u0443\u0437\u043d\u0430\u043b\u0438 \u043e \u0441\u043a\u0440\u044b\u0442\u043e\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043d\u0435\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0431\u044b\u043b\u0430 \u043d\u0435\u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://securelist.ru/operation-triangulation-the-last-hardware-mystery/108683/ \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0448\u043f\u0438\u043e\u043d\u0430\u0436 #\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442", "creation_timestamp": "2026-07-28T00:00:34.324946Z"}, {"uuid": "f8f8d78b-a60e-4667-bbdc-4711ecadc674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/hacking_Attack/118038", "content": "Black Hat Ethical Hacking\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\n\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\nPost Views: 407 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nApple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group\u2019s Pegasus commercial spyware onto fully patched iPhones.\n\nThe two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.\n\nCitizen Lab, a prominent research organization, has named this exploit chain \u201cBLASTPASS.\u201d The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker\u2019s iMessage account to the victim\u2019s device.\n\nIn response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.\nWe refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's \"BlastDoor\" framework for iMessage security.\n\n\u2014 Bill Marczak (@billmarczak) September 7, 2023\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThese two zero-day vulnerabilities were discovered by both Apple and security researchers at Citizen Lab. They were found to exist within the Image I/O and Wallet frameworks.\n\nCVE-2023-41064 is characterized as a buffer overflow vulnerability, triggered during the processing of maliciously crafted images. On the other hand, CVE-2023-41061 is a validation issue that can be exploited via malicious attachments. Both of these vulnerabilities allowed threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.\n\nApple has promptly addressed these flaws through updates, including macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. These updates incorporate improved logic and memory handling to mitigate the vulnerabilities.\n\nA range of Apple devices were affected, including iPhone 8 and later models, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt This marks the 13th zero-day vulnerability that Apple has addressed since the beginning of the year. \nThese vulnerabilities have been exploited to target devices running iOS, macOS, iPadOS, and watchOS. Apple\u2019s commitment to swiftly patching such vulnerabilities underscores its dedication to user security.\n\n* In July, two zero-days (CVE-2023-37450 and CVE-2023-38606) were addressed\n* June saw the fixing of three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439).\n* May brought three additional zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373)\n* April saw the resolution of two zero-days (CVE-2023-28206 and CVE-2023-28205).\n* In February, another We[...]", "creation_timestamp": "2026-09-01T20:00:48.186931Z"}, {"uuid": "23097fa6-2c7e-4900-9602-4e893d5655ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/hacking_Attack/117671", "content": "Black Hat Ethical Hacking\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\n\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\nPost Views: 1 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nApple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group\u2019s Pegasus commercial spyware onto fully patched iPhones.\n\nThe two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.\n\nCitizen Lab, a prominent research organization, has named this exploit chain \u201cBLASTPASS.\u201d The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker\u2019s iMessage account to the victim\u2019s device.\n\nIn response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.\nWe refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's \"BlastDoor\" framework for iMessage security.\n\n\u2014 Bill Marczak (@billmarczak) September 7, 2023\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThese two zero-day vulnerabilities were discovered by both Apple and security researchers at Citizen Lab. They were found to exist within the Image I/O and Wallet frameworks.\n\nCVE-2023-41064 is characterized as a buffer overflow vulnerability, triggered during the processing of maliciously crafted images. On the other hand, CVE-2023-41061 is a validation issue that can be exploited via malicious attachments. Both of these vulnerabilities allowed threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.\n\nApple has promptly addressed these flaws through updates, including macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. These updates incorporate improved logic and memory handling to mitigate the vulnerabilities.\n\nA range of Apple devices were affected, including iPhone 8 and later models, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt This marks the 13th zero-day vulnerability that Apple has addressed since the beginning of the year. \nThese vulnerabilities have been exploited to target devices running iOS, macOS, iPadOS, and watchOS. Apple\u2019s commitment to swiftly patching such vulnerabilities underscores its dedication to user security.\n\n* In July, two zero-days (CVE-2023-37450 and CVE-2023-38606) were addressed\n* June saw the fixing of three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439).\n* May brought three additional zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373)\n* April saw the resolution of two zero-days (CVE-2023-28206 and CVE-2023-28205).\n* In February, another WebKit z[...]", "creation_timestamp": "2026-09-01T20:00:51.475972Z"}, {"uuid": "a71a658e-eba4-49ce-b2ef-40fb18148ce3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/hacking_Attack/118038", "content": "Black Hat Ethical Hacking\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\n\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\nPost Views: 407 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nApple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group\u2019s Pegasus commercial spyware onto fully patched iPhones.\n\nThe two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.\n\nCitizen Lab, a prominent research organization, has named this exploit chain \u201cBLASTPASS.\u201d The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker\u2019s iMessage account to the victim\u2019s device.\n\nIn response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.\nWe refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's \"BlastDoor\" framework for iMessage security.\n\n\u2014 Bill Marczak (@billmarczak) September 7, 2023\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThese two zero-day vulnerabilities were discovered by both Apple and security researchers at Citizen Lab. They were found to exist within the Image I/O and Wallet frameworks.\n\nCVE-2023-41064 is characterized as a buffer overflow vulnerability, triggered during the processing of maliciously crafted images. On the other hand, CVE-2023-41061 is a validation issue that can be exploited via malicious attachments. Both of these vulnerabilities allowed threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.\n\nApple has promptly addressed these flaws through updates, including macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. These updates incorporate improved logic and memory handling to mitigate the vulnerabilities.\n\nA range of Apple devices were affected, including iPhone 8 and later models, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt This marks the 13th zero-day vulnerability that Apple has addressed since the beginning of the year. \nThese vulnerabilities have been exploited to target devices running iOS, macOS, iPadOS, and watchOS. Apple\u2019s commitment to swiftly patching such vulnerabilities underscores its dedication to user security.\n\n* In July, two zero-days (CVE-2023-37450 and CVE-2023-38606) were addressed\n* June saw the fixing of three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439).\n* May brought three additional zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373)\n* April saw the resolution of two zero-days (CVE-2023-28206 and CVE-2023-28205).\n* In February, another We[...]", "creation_timestamp": "2026-09-02T01:01:09.799691Z"}, {"uuid": "33d51ddb-b90f-4295-98d3-df173a6d7216", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/hacking_Attack/117671", "content": "Black Hat Ethical Hacking\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\n\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\nPost Views: 1 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nApple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group\u2019s Pegasus commercial spyware onto fully patched iPhones.\n\nThe two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.\n\nCitizen Lab, a prominent research organization, has named this exploit chain \u201cBLASTPASS.\u201d The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker\u2019s iMessage account to the victim\u2019s device.\n\nIn response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.\nWe refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's \"BlastDoor\" framework for iMessage security.\n\n\u2014 Bill Marczak (@billmarczak) September 7, 2023\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThese two zero-day vulnerabilities were discovered by both Apple and security researchers at Citizen Lab. They were found to exist within the Image I/O and Wallet frameworks.\n\nCVE-2023-41064 is characterized as a buffer overflow vulnerability, triggered during the processing of maliciously crafted images. On the other hand, CVE-2023-41061 is a validation issue that can be exploited via malicious attachments. Both of these vulnerabilities allowed threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.\n\nApple has promptly addressed these flaws through updates, including macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. These updates incorporate improved logic and memory handling to mitigate the vulnerabilities.\n\nA range of Apple devices were affected, including iPhone 8 and later models, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt This marks the 13th zero-day vulnerability that Apple has addressed since the beginning of the year. \nThese vulnerabilities have been exploited to target devices running iOS, macOS, iPadOS, and watchOS. Apple\u2019s commitment to swiftly patching such vulnerabilities underscores its dedication to user security.\n\n* In July, two zero-days (CVE-2023-37450 and CVE-2023-38606) were addressed\n* June saw the fixing of three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439).\n* May brought three additional zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373)\n* April saw the resolution of two zero-days (CVE-2023-28206 and CVE-2023-28205).\n* In February, another WebKit z[...]", "creation_timestamp": "2026-09-02T01:01:10.956608Z"}, {"uuid": "55c7a5cc-4c80-43f4-ab81-171fe78ae316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/hacking_Attack/118038", "content": "Black Hat Ethical Hacking\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\n\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\nPost Views: 407 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nApple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group\u2019s Pegasus commercial spyware onto fully patched iPhones.\n\nThe two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.\n\nCitizen Lab, a prominent research organization, has named this exploit chain \u201cBLASTPASS.\u201d The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker\u2019s iMessage account to the victim\u2019s device.\n\nIn response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.\nWe refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's \"BlastDoor\" framework for iMessage security.\n\n\u2014 Bill Marczak (@billmarczak) September 7, 2023\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThese two zero-day vulnerabilities were discovered by both Apple and security researchers at Citizen Lab. They were found to exist within the Image I/O and Wallet frameworks.\n\nCVE-2023-41064 is characterized as a buffer overflow vulnerability, triggered during the processing of maliciously crafted images. On the other hand, CVE-2023-41061 is a validation issue that can be exploited via malicious attachments. Both of these vulnerabilities allowed threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.\n\nApple has promptly addressed these flaws through updates, including macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. These updates incorporate improved logic and memory handling to mitigate the vulnerabilities.\n\nA range of Apple devices were affected, including iPhone 8 and later models, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt This marks the 13th zero-day vulnerability that Apple has addressed since the beginning of the year. \nThese vulnerabilities have been exploited to target devices running iOS, macOS, iPadOS, and watchOS. Apple\u2019s commitment to swiftly patching such vulnerabilities underscores its dedication to user security.\n\n* In July, two zero-days (CVE-2023-37450 and CVE-2023-38606) were addressed\n* June saw the fixing of three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439).\n* May brought three additional zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373)\n* April saw the resolution of two zero-days (CVE-2023-28206 and CVE-2023-28205).\n* In February, another We[...]", "creation_timestamp": "2026-09-04T05:00:06.657601Z"}, {"uuid": "8dac2078-732b-44d3-b2b2-6e1b1ff5c15f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/hacking_Attack/117671", "content": "Black Hat Ethical Hacking\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\n\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\nPost Views: 1 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nApple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group\u2019s Pegasus commercial spyware onto fully patched iPhones.\n\nThe two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.\n\nCitizen Lab, a prominent research organization, has named this exploit chain \u201cBLASTPASS.\u201d The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker\u2019s iMessage account to the victim\u2019s device.\n\nIn response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.\nWe refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's \"BlastDoor\" framework for iMessage security.\n\n\u2014 Bill Marczak (@billmarczak) September 7, 2023\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThese two zero-day vulnerabilities were discovered by both Apple and security researchers at Citizen Lab. They were found to exist within the Image I/O and Wallet frameworks.\n\nCVE-2023-41064 is characterized as a buffer overflow vulnerability, triggered during the processing of maliciously crafted images. On the other hand, CVE-2023-41061 is a validation issue that can be exploited via malicious attachments. Both of these vulnerabilities allowed threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.\n\nApple has promptly addressed these flaws through updates, including macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. These updates incorporate improved logic and memory handling to mitigate the vulnerabilities.\n\nA range of Apple devices were affected, including iPhone 8 and later models, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt This marks the 13th zero-day vulnerability that Apple has addressed since the beginning of the year. \nThese vulnerabilities have been exploited to target devices running iOS, macOS, iPadOS, and watchOS. Apple\u2019s commitment to swiftly patching such vulnerabilities underscores its dedication to user security.\n\n* In July, two zero-days (CVE-2023-37450 and CVE-2023-38606) were addressed\n* June saw the fixing of three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439).\n* May brought three additional zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373)\n* April saw the resolution of two zero-days (CVE-2023-28206 and CVE-2023-28205).\n* In February, another WebKit z[...]", "creation_timestamp": "2026-09-04T07:00:04.605247Z"}, {"uuid": "bded3d79-9854-4268-b6c2-8a347f1e41f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/hacking_Attack/117671", "content": "Black Hat Ethical Hacking\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\n\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\nPost Views: 1 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nApple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group\u2019s Pegasus commercial spyware onto fully patched iPhones.\n\nThe two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.\n\nCitizen Lab, a prominent research organization, has named this exploit chain \u201cBLASTPASS.\u201d The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker\u2019s iMessage account to the victim\u2019s device.\n\nIn response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.\nWe refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's \"BlastDoor\" framework for iMessage security.\n\n\u2014 Bill Marczak (@billmarczak) September 7, 2023\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThese two zero-day vulnerabilities were discovered by both Apple and security researchers at Citizen Lab. They were found to exist within the Image I/O and Wallet frameworks.\n\nCVE-2023-41064 is characterized as a buffer overflow vulnerability, triggered during the processing of maliciously crafted images. On the other hand, CVE-2023-41061 is a validation issue that can be exploited via malicious attachments. Both of these vulnerabilities allowed threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.\n\nApple has promptly addressed these flaws through updates, including macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. These updates incorporate improved logic and memory handling to mitigate the vulnerabilities.\n\nA range of Apple devices were affected, including iPhone 8 and later models, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt This marks the 13th zero-day vulnerability that Apple has addressed since the beginning of the year. \nThese vulnerabilities have been exploited to target devices running iOS, macOS, iPadOS, and watchOS. Apple\u2019s commitment to swiftly patching such vulnerabilities underscores its dedication to user security.\n\n* In July, two zero-days (CVE-2023-37450 and CVE-2023-38606) were addressed\n* June saw the fixing of three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439).\n* May brought three additional zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373)\n* April saw the resolution of two zero-days (CVE-2023-28206 and CVE-2023-28205).\n* In February, another WebKit z[...]", "creation_timestamp": "2026-09-05T01:00:37.303015Z"}, {"uuid": "d1a425d4-83e8-470a-bb7f-c80cd135114d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32435", "type": "seen", "source": "https://t.me/hacking_Attack/118038", "content": "Black Hat Ethical Hacking\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\n\nEmergency Apple Updates: Zero-Days Exploited to Deploy Spyware on iPhones\nPost Views: 407 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nApple issued emergency security updates to address two zero-day vulnerabilities that were actively exploited in a sophisticated zero-click exploit chain. These vulnerabilities served as entry points for deploying NSO Group\u2019s Pegasus commercial spyware onto fully patched iPhones.\n\nThe two identified vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061, allowed attackers to compromise iPhones running iOS 16.6, even if they were fully patched. This alarming breach occurred within a Washington DC-based civil society organization through PassKit attachments containing malicious images.\n\nCitizen Lab, a prominent research organization, has named this exploit chain \u201cBLASTPASS.\u201d The concerning aspect of this attack is that it could compromise iPhones running the latest version of iOS (16.6) without requiring any interaction from the victim. The attack method involved PassKit attachments, containing malicious images, sent from the attacker\u2019s iMessage account to the victim\u2019s device.\n\nIn response to these critical security breaches, Citizen Lab strongly advises all Apple customers to update their devices immediately. Furthermore, individuals who may be at risk of targeted attacks due to their identity or profession are encouraged to activate Lockdown Mode on their devices.\nWe refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's \"BlastDoor\" framework for iMessage security.\n\n\u2014 Bill Marczak (@billmarczak) September 7, 2023\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThese two zero-day vulnerabilities were discovered by both Apple and security researchers at Citizen Lab. They were found to exist within the Image I/O and Wallet frameworks.\n\nCVE-2023-41064 is characterized as a buffer overflow vulnerability, triggered during the processing of maliciously crafted images. On the other hand, CVE-2023-41061 is a validation issue that can be exploited via malicious attachments. Both of these vulnerabilities allowed threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.\n\nApple has promptly addressed these flaws through updates, including macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. These updates incorporate improved logic and memory handling to mitigate the vulnerabilities.\n\nA range of Apple devices were affected, including iPhone 8 and later models, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt This marks the 13th zero-day vulnerability that Apple has addressed since the beginning of the year. \nThese vulnerabilities have been exploited to target devices running iOS, macOS, iPadOS, and watchOS. Apple\u2019s commitment to swiftly patching such vulnerabilities underscores its dedication to user security.\n\n* In July, two zero-days (CVE-2023-37450 and CVE-2023-38606) were addressed\n* June saw the fixing of three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439).\n* May brought three additional zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373)\n* April saw the resolution of two zero-days (CVE-2023-28206 and CVE-2023-28205).\n* In February, another We[...]", "creation_timestamp": "2026-09-05T01:00:40.252888Z"}]}