CVE-2023-28205
published 2023-04-10CVE-2023-28205: A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS…
PriorityP188high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-05-01
Exploited in the wild
EPSS
27.08%
97.8th percentile
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_15.7.5_and_ipados | — | — |
| apple | ios_16.4.1_and_ipados | — | — |
| apple | ios_and_ipados | >= unspecified < 15.7 | 15.7 |
| apple | ios_and_ipados | >= unspecified < 16.4 | 16.4 |
| apple | ipados | < 15.7.5 | 15.7.5 |
| apple | ipados | >= 16.0 < 16.4.1 | 16.4.1 |
| apple | iphone_os | < 15.7.5 | 15.7.5 |
| apple | iphone_os | >= 16.0 < 16.4.1 | 16.4.1 |
| apple | macos | < 13.3.1 | 13.3.1 |
| apple | macos | >= unspecified < 13.3 | 13.3 |
| apple | macos_ventura | — | — |
| apple | safari | < 16.4.1 | 16.4.1 |
| apple | safari | — | — |
| apple | safari | >= unspecified < 16.4 | 16.4 |
| debian | webkit2gtk | < webkit2gtk 2.40.1-1 (bookworm) | webkit2gtk 2.40.1-1 (bookworm) |
| debian | webkit2gtk | — | — |
| debian | wpewebkit | < webkit2gtk 2.40.1-1 (bookworm) | webkit2gtk 2.40.1-1 (bookworm) |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| webkitgtk | webkit2gtk3 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2023-28205 is a WebKit use-after-free triggered by processing maliciously crafted web content; monitor for exploitation attempts via web browsers (Safari, WebKitGTK) on iOS, iPadOS, and macOS Ventura ↗
- →CVE-2023-28205 was exploited in the wild chained with CVE-2023-28206 (IOSurfaceAccelerator kernel privilege escalation); detections should consider both vulnerabilities being used together for full compromise ↗
- →Affected component is WebKit (webkitgtk3 on RHEL 7); monitor webkitgtk3 package on Linux for exploitation attempts via specially crafted web content files delivered over the network ↗
- →Patch baseline for detection: unpatched Safari < 16.4.1, iOS/iPadOS < 15.7.5 or < 16.4.1, macOS Ventura < 13.3.1 are vulnerable; flag devices running these versions in asset inventory ↗
- ·Red Hat states no known exploitation of CVE-2023-28205 on Linux platforms at time of advisory; Linux/WebKitGTK risk is lower priority than Apple platforms ↗
- ·webkitgtk (RHEL 6) is out of support scope and will not receive a patch; webkitgtk3 (RHEL 7) is the affected and patchable package on Red Hat ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p2w5-xch3-v6pv: A flaw was found in the WebKitGTK package
ghsa_unreviewed·2023-05-18·CVSS 8.8
CVE-2023-2203 [HIGH] CWE-416 GHSA-p2w5-xch3-v6pv: A flaw was found in the WebKitGTK package
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
OSV
CVE-2023-2203: A flaw was found in the WebKitGTK package
osv·2023-05-17·CVSS 8.8
CVE-2023-2203 [HIGH] CVE-2023-2203: A flaw was found in the WebKitGTK package
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
GHSA
GHSA-6qjh-p74q-89mv: A use after free issue was addressed with improved memory management
ghsa_unreviewed·2023-04-10
CVE-2023-28205 [HIGH] CWE-416 GHSA-6qjh-p74q-89mv: A use after free issue was addressed with improved memory management
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.7.5 and iPadOS 15.7.5, Safari 16.4.1, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
OSV
CVE-2023-28205: A use after free issue was addressed with improved memory management
osv·2023-04-10·CVSS 8.8
CVE-2023-28205 [HIGH] CVE-2023-28205: A use after free issue was addressed with improved memory management
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
VulnCheck
Apple Multiple Products WebKit Use-After-Free Vulnerability
vulncheck·2023·CVSS 8.8
CVE-2023-28205 [HIGH] CWE-416 Apple Multiple Products WebKit Use-After-Free Vulnerability
Apple Multiple Products WebKit Use-After-Free Vulnerability
Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Affected: Apple Multiple Products
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://support.apple.com/kb/HT213720; https://support.apple.com/kb/HT213721; https://support.apple.com/kb/HT213722; https://support.apple.com/kb/HT213723; https://www.cisa.gov/sites/default/files/feed
Red Hat
webkitgtk: Regression of CVE-2023-28205 fixes in the Red Hat Enterprise Linux
vendor_redhat·2023-05-09·CVSS 8.8
CVE-2023-2203 [HIGH] CWE-416 webkitgtk: Regression of CVE-2023-28205 fixes in the Red Hat Enterprise Linux
webkitgtk: Regression of CVE-2023-28205 fixes in the Red Hat Enterprise Linux
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists becaus
Ubuntu
WebKitGTK vulnerabilities
vendor_ubuntu·2023-05-08
CVE-2023-27932 WebKitGTK vulnerabilities
Title: WebKitGTK vulnerabilities
Summary: Several security issues were fixed in WebKitGTK.
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.
Apple
CVE-2023-28205: iOS 15.7.5 and iPadOS 15.7.5
vendor_apple·2023-04-10·CVSS 8.8
CVE-2023-28205 [HIGH] CVE-2023-28205: iOS 15.7.5 and iPadOS 15.7.5
Apple Security Update: About the security content of iOS 15.7.5 and iPadOS 15.7.5
Product: iOS 15.7.5 and iPadOS
Version: 15.7.5
CVE: CVE-2023-28205
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A use after free issue was addressed with improved memory management.
CISA
Apple Multiple Products WebKit Use-After-Free Vulnerability
cisa·2023-04-10·CVSS 8.8
CVE-2023-28205 [HIGH] CWE-416 Apple Multiple Products WebKit Use-After-Free Vulnerability
Vulnerability: Apple Multiple Products WebKit Use-After-Free Vulnerability
Affected: Apple Multiple Products
Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required Action: Apply updates per vendor instructions.
Notes: https://support.apple.com/en-us/HT213720,https://support.apple.com/en-us/HT213721,https://support.apple.com/en-us/HT213722,https://support.apple.com/en-us/HT213723; https://nvd.nist.gov/vuln/detail/CVE-2023-28205
Remediation Due Date: 2023-05-01
Red Hat
WebKitGTK: use-after-free leads to arbitrary code execution
vendor_redhat·2023-04-07·CVSS 8.8
CVE-2023-28205 [HIGH] CWE-416 WebKitGTK: use-after-free leads to arbitrary code execution
WebKitGTK: use-after-free leads to arbitrary code execution
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
A flaw was found in the webkitgtk package. An improper input validation issue may lead to a use-after-free vulnerability. This vulnerability allows attackers with network access to pass specially crafted web content files, causing Denial of Service or Arbitrary Code Execution.
Statement: Red Hat is not aware of any exploitation of this flaw in Linux platforms at this time.
Package: web
Apple
CVE-2023-28205: Safari 16.4.1
vendor_apple·2023-04-07·CVSS 8.8
CVE-2023-28205 [HIGH] CVE-2023-28205: Safari 16.4.1
Apple Security Update: About the security content of Safari 16.4.1
Product: Safari
Version: 16.4.1
CVE: CVE-2023-28205
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A use after free issue was addressed with improved memory management.
Apple
CVE-2023-28205: iOS 16.4.1 and iPadOS 16.4.1
vendor_apple·2023-04-07·CVSS 8.8
CVE-2023-28205 [HIGH] CVE-2023-28205: iOS 16.4.1 and iPadOS 16.4.1
Apple Security Update: About the security content of iOS 16.4.1 and iPadOS 16.4.1
Product: iOS 16.4.1 and iPadOS
Version: 16.4.1
CVE: CVE-2023-28205
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A use after free issue was addressed with improved memory management.
Apple
CVE-2023-28205: macOS Ventura 13.3.1
vendor_apple·2023-04-07·CVSS 8.8
CVE-2023-28205 [HIGH] CVE-2023-28205: macOS Ventura 13.3.1
Apple Security Update: About the security content of macOS Ventura 13.3.1
Product: macOS Ventura
Version: 13.3.1
CVE: CVE-2023-28205
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A use after free issue was addressed with improved memory management.
Debian
CVE-2023-2203: webkit2gtk - A flaw was found in the WebKitGTK package. An improper input validation issue ma...
vendor_debian·2023·CVSS 8.8
CVE-2023-2203 [HIGH] CVE-2023-2203: webkit2gtk - A flaw was found in the WebKitGTK package. An improper input validation issue ma...
A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Debian
CVE-2023-28205: webkit2gtk - A use after free issue was addressed with improved memory management. This issue...
vendor_debian·2023·CVSS 8.8
CVE-2023-28205 [HIGH] CVE-2023-28205: webkit2gtk - A use after free issue was addressed with improved memory management. This issue...
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Scope: local
bookworm: resolved (fixed in 2.40.1-1)
bullseye: resolved (fixed in 2.40.1-1~deb11u1)
forky: resolved (fixed in 2.40.1-1)
sid: resolved (fixed in 2.40.1-1)
trixie: resolved (fixed in 2.40.1-1)
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks
blogs_bleepingcomputer·2025-03-11·CVSS 7.8
CVE-2025-24201 [HIGH] Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks
## Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks
## Sergiu Gatlan
Apple said attackers can exploit the CVE-2025-24201 vulnerability using maliciously crafted web content to break out of the Web Content sandbox.
The company has fixed this out-of-bounds write issue with improved checks to prevent unauthorized actions in iOS 18.3.2, iPadOS 18.3.2 , macOS Sequoia 15.3.2 , visionOS 2.3.2 , and Safari 18.3.1 .
The list of devices impacted by this zero-day is quite extensive, as the bug affects older and newer models, including:
iPhone XS and later,
iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Macs
Bleepingcomputer
Apple fixes zero-day exploited in 'extremely sophisticated' attacks
blogs_bleepingcomputer·2025-02-10·CVSS 7.8
[HIGH] Apple fixes zero-day exploited in 'extremely sophisticated' attacks
## Apple fixes zero-day exploited in 'extremely sophisticated' attacks
## Sergiu Gatlan
USB Restricted Mode is a security feature ( introduced almost seven years ago in iOS 11.4.1) that blocks USB accessories from creating a data connection if the device has been locked for over an hour. This feature is designed to block forensic software like Graykey and Cellebrite (commonly used by law enforcement) from extracting data from locked iOS devices.
In November, Apple introduced another security feature (dubbed "inactivity reboot") that automatically restarts iPhones after long idle times to re-encrypt data and make it harder to extract by forensic software.
The zero-day vulnerability (tracked as CVE-2025-24200 and reported by Citizen Lab's Bill Marczak) patched today by Apple is an author
Bleepingcomputer
Apple fixes this year’s first actively exploited zero-day bug
blogs_bleepingcomputer·2025-01-27·CVSS 6.5
CVE-2024-23222 [MEDIUM] Apple fixes this year’s first actively exploited zero-day bug
## Apple fixes this year’s first actively exploited zero-day bug
## Sergiu Gatlan
According to the company's official documentation , Core Media "defines the media pipeline used by AVFoundation and other high-level media frameworks found on Apple platforms."
Apple has fixed CVE-2024-23222 with improved memory management in iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, visionOS 2.3, and tvOS 18.3.
The list of devices impacted by this zero-day is quite extensive, as the bug affects older and newer models, including:
iPhone XS and later,
iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
macOS Sequoia
Apple Watch Ser
Bleepingcomputer
Apple fixes two zero-days used in attacks on Intel-based Macs
blogs_bleepingcomputer·2024-11-19·CVSS 8.8
CVE-2024-44308 [HIGH] Apple fixes two zero-days used in attacks on Intel-based Macs
## Apple fixes two zero-days used in attacks on Intel-based Macs
## Lawrence Abrams
The JavaScriptCore CVE-2024-44308 flaw allows attackers to achieve remote code execution through maliciously crafted web content. The other flaw, CVE-2024-44309, allows cross-site scripting (CSS) attacks.
The company says it addressed the security flaws in macOS Sequoia 15.1.1 .
As the same components are found in other Apple operating systems, it was also fixed in iOS 17.7.2 and iPadOS 17.7.2 , iOS 18.1.1 and iPadOS 18.1.1 , and visionOS 2.1.1 .
While Apple says both flaws were discovered by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group, the company has not provided further details on how they were exploited.
BleepingComputer contacted Google to learn how the flaws were exploite
Bleepingcomputer
Apple fixes first zero-day bug exploited in attacks this year
blogs_bleepingcomputer·2024-01-22·CVSS 8.8
[HIGH] Apple fixes first zero-day bug exploited in attacks this year
## Apple fixes first zero-day bug exploited in attacks this year
## Sergiu Gatlan
"Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited," Apple said today.
The company has yet to attribute the discovery of this security vulnerability to a security researcher. Although the company disclosed that it's aware of in-the-wild exploitation, it has yet to publish further details regarding these attacks.
Apple addressed CVE-2024-23222 with improved checks in iOS 16.7.5 and later, iPadOS 16.7.5 and later, and macOS Monterey 12.7.3 and higher, as well as on tvOS 17.3 and later.
The complete list of devices impacted by this WebKit zero-day is quite extensive, as the bug affects older and newer models, i
Sentinelone
Protecting macOS | 7 Strategies for Enterprise Security in 2024
blogs_sentinelone·2024-01-02
Protecting macOS | 7 Strategies for Enterprise Security in 2024
Welcome to 2024! It may be a new year for us all, but it’s very much business as usual for cybersecurity professionals. Last year saw an increase in the number and variety of new threats targeting the macOS platform, and as the influence of the Mac continues to expand in enterprise environments, there is little doubt that 2024 will continue that trend.
In this post, we reflect on the lessons we can learn from the last 12 months of threat activity against Apple’s desktop operating system, and offer 7 strategies for defenders to help bolster their threat hunting, detection and mitigation efforts .
## 1. Don’t Rely on Persistence for Detection
Perhaps the most important lesson that defenders learned from 2023’s crop of macOS malware was that monitoring for persistence methods became a much
Sentinelone
Protecting macOS | 7 Strategies for Enterprise Security in 2024
blogs_sentinelone·2024-01-02
Protecting macOS | 7 Strategies for Enterprise Security in 2024
Welcome to 2024! It may be a new year for us all, but it’s very much business as usual for cybersecurity professionals. Last year saw an increase in the number and variety of new threats targeting the macOS platform, and as the influence of the Mac continues to expand in enterprise environments, there is little doubt that 2024 will continue that trend.
In this post, we reflect on the lessons we can learn from the last 12 months of threat activity against Apple’s desktop operating system, and offer 7 strategies for defenders to help bolster their threat hunting, detection and mitigation efforts.
## 1. Don’t Rely on Persistence for Detection
Perhaps the most important lesson that defenders learned from 2023’s crop of macOS malware was that monitoring for persistence methods became a much
Bleepingcomputer
Apple emergency updates fix recent zero-days on older iPhones
blogs_bleepingcomputer·2023-12-11·CVSS 6.5
[MEDIUM] Apple emergency updates fix recent zero-days on older iPhones
## Apple emergency updates fix recent zero-days on older iPhones
## Sergiu Gatlan
They can let attackers obtain access to sensitive data through and execute arbitrary code using maliciously crafted webpages designed to exploit out-of-bounds and memory corruption bugs on unpatched devices.
Today, Apple addressed the zero-days in iOS 16.7.3, iPadOS 16.7.3 , tvOS 17.2 , and watchOS 10.2 with improved input validation and locking.
The company says the bugs are now also patched on the following list of devices:
iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
Apple TV HD and Apple TV 4K (all models)
Apple Watch Series 4 and later
Clément Lecigne, a security researcher from Google's Threat
Bleepingcomputer
Apple fixes two new iOS zero-days in emergency updates
blogs_bleepingcomputer·2023-11-30·CVSS 8.6
[HIGH] Apple fixes two new iOS zero-days in emergency updates
## Apple fixes two new iOS zero-days in emergency updates
## Sergiu Gatlan
The company says it addressed the security flaws for devices running iOS 17.1.2, iPadOS 17.1.2 , macOS Sonoma 14.1.2 , and Safari 17.1.2 with improved input validation and locking.
The list of impacted Apple devices is quite extensive, and it includes:
iPhone XS and later
iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later
Macs running macOS Monterey, Ventura, Sonoma
Security researcher Clément Lecigne of Google's Threat Analysis Group (TAG) found and reported both zero-days.
While Apple has not released information regarding ongoing exploitation in
Bleepingcomputer
Apple fixes iOS Kernel zero-day vulnerability on older iPhones
blogs_bleepingcomputer·2023-10-12·CVSS 7.8
CVE-2023-5217 [HIGH] Apple fixes iOS Kernel zero-day vulnerability on older iPhones
## Apple fixes iOS Kernel zero-day vulnerability on older iPhones
## Sergiu Gatlan
Apple has now also fixed the issue in iOS 16.7.1 and iPadOS 16.7.1 with improved checks, but it has yet to reveal who discovered and reported the flaw.
The second one, a bug identified as CVE-2023-5217, is caused by a heap buffer overflow vulnerability within the VP8 encoding of the open-source libvpx video codec library. This flaw could let threat actors gain arbitrary code execution upon successful exploitation.
Even though Apple did not confirm any instances of exploitation in the wild, Google previously patched the libvpx bug as a zero-day in its Chrome web browser. Microsoft also addressed the same vulnerability in its Edge, Teams, and Skype products.
Google attributed the discovery of CVE-2023-521
Bleepingcomputer
Apple emergency update fixes new zero-day used to hack iPhones
blogs_bleepingcomputer·2023-10-04·CVSS 7.8
[HIGH] Apple emergency update fixes new zero-day used to hack iPhones
## Apple emergency update fixes new zero-day used to hack iPhones
## Sergiu Gatlan
While Apple said it addressed the security issue in iOS 17.0.3 and iPadOS 17.0.3 with improved checks, it has yet to reveal who found and reported the flaw.
The list of impacted devices is quite extensive, and it includes:
iPhone XS and later
iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later
Apple also addressed a bug tracked as CVE-2023-5217 and caused by a heap buffer overflow weakness in the VP8 encoding of the open-source libvpx video codec library, which could allow arbitrary code execution following successful exploitation.
While Apple
Sentinelone
Beyond the WebP Flaw | An In-depth Look at 2023's Browser Security Challenges
blogs_sentinelone·2023-10-03
Beyond the WebP Flaw | An In-depth Look at 2023's Browser Security Challenges
This week, Firefox users were urged to apply Mozilla’s latest updates against a critical flaw that could allow attackers to take control of affected systems. It follows hard on the heels of similar updates for Microsoft Edge, Google Chrome, and Apple’s Safari browser. All have been heavily impacted by an actively exploited vulnerability in the WebP code library.
Although the WebP vulnerability affects other software as well, browsers are by far and away the most ubiquitous and widely used applications on end user devices . Having a foothold in a compromised browser gives threat actors access to sensitive information and potential avenues into targeted environments.
In this post, we take a deep dive into browser security , exploring the differences between vulnerabilities and exploits, ze
Sentinelone
Beyond the WebP Flaw | An In-depth Look at 2023's Browser Security Challenges
blogs_sentinelone·2023-10-03
Beyond the WebP Flaw | An In-depth Look at 2023's Browser Security Challenges
This week, Firefox users were urged to apply Mozilla’s latest updates against a critical flaw that could allow attackers to take control of affected systems. It follows hard on the heels of similar updates for Microsoft Edge, Google Chrome, and Apple’s Safari browser. All have been heavily impacted by an actively exploited vulnerability in the WebP code library.
Although the WebP vulnerability affects other software as well, browsers are by far and away the most ubiquitous and widely used applications on end user devices. Having a foothold in a compromised browser gives threat actors access to sensitive information and potential avenues into targeted environments.
In this post, we take a deep dive into browser security, exploring the differences between vulnerabilities and exploits, zero
Bleepingcomputer
Apple emergency updates fix 3 new zero-days exploited in attacks
blogs_bleepingcomputer·2023-09-21·CVSS 8.8
[HIGH] Apple emergency updates fix 3 new zero-days exploited in attacks
## Apple emergency updates fix 3 new zero-days exploited in attacks
## Sergiu Gatlan
Apple fixed the three zero-day bugs in macOS 12.7/13.6, iOS 16.7/17.0.1, iPadOS 16.7/17.0.1, and watchOS 9.6.3/10.0.1 by addressing a certificate validation issue and through improved checks.
"Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7," the company revealed in security advisories describing the security flaws.
The list of impacted devices encompasses older and newer device models, and it includes:
iPhone 8 and later
iPad mini 5th generation and later
Macs running macOS Monterey and newer
Apple Watch Series 4 and later
All three zero-days were found and reported by Bill Marczak of the Citizen Lab at The University of Toronto'
Bleepingcomputer
Apple backports BLASTPASS zero-day fix to older iPhones
blogs_bleepingcomputer·2023-09-12·CVSS 8.8
[HIGH] Apple backports BLASTPASS zero-day fix to older iPhones
## Apple backports BLASTPASS zero-day fix to older iPhones
## Bill Toulas
When the phones received and processed the attachment, it installed NSO's Pegasus spyware, even on fully patched iOS (16.6) devices.
Apple released fixes for the two flaws with macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2, and CISA published an alert requiring federal agencies to patch by October 2, 2023.
The security updates have now been backported to iOS 15.7.9 and iPadOS 15.7.9 , macOS Monterey 12.6.9 , and macOS Big Sur 11.7.10 to prevent the use of this attack chain on those devices.
It's worth noting that support for iOS 15 ended a year ago, in September 2022, while the vendor still supports Monterey and Big Sur.
The security updates cover all iPhone 6s models, the iPhone 7, the fir
Bleepingcomputer
CISA warns govt agencies to secure iPhones against spyware attacks
blogs_bleepingcomputer·2023-09-11·CVSS 6.5
CVE-2023-41064 [MEDIUM] CISA warns govt agencies to secure iPhones against spyware attacks
## CISA warns govt agencies to secure iPhones against spyware attacks
## Sergiu Gatlan
"Apple is aware of a report that this issue may have been actively exploited," the company said when describing the two Image I/O and Wallet vulnerabilities, tracked as CVE-2023-41064 and CVE-2023-41061 .
The list of impacted devices is quite extensive, as the bugs affect both older and newer models, and it includes:
iPhone 8 and later
iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
Macs running macOS Ventura
Apple Watch Series 4 and later
Apple fixed the two zero-days in macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2 with memory handling and improved logic. Both allow attackers to gain arbitrary c
Bleepingcomputer
Apple zero-click iMessage exploit used to infect iPhones with spyware
blogs_bleepingcomputer·2023-09-07·CVSS 8.8
[HIGH] Apple zero-click iMessage exploit used to infect iPhones with spyware
## Apple zero-click iMessage exploit used to infect iPhones with spyware
## Sergiu Gatlan
"The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim."
Citizen Lab also urged Apple customers to update their devices immediately and encouraged those at risk of targeted attacks due to their identity or profession to activate Lockdown Mode .
Apple and Citizen Lab security researchers discovered the two zero-days in the Image I/O and Wallet frameworks.
CVE-2023-41064 is a buffer overflow triggered when processing maliciously crafted images, while CVE-2023-41061 is a validation issue that can be exploited via malicious attachments.
Both allow threat actors to gain arbitrary code execution on unpatched iPhone and iPad devices.
Bleepingcomputer
Apple discloses 2 new zero-days exploited to attack iPhones, Macs
blogs_bleepingcomputer·2023-09-07·CVSS 6.5
CVE-2023-41064 [MEDIUM] Apple discloses 2 new zero-days exploited to attack iPhones, Macs
## Apple discloses 2 new zero-days exploited to attack iPhones, Macs
## Sergiu Gatlan
Citizen Lab also revealed today that the CVE-2023-41064 and CVE-2023-41061 bugs were actively abused as part of as part of a zero-click iMessage exploit chain named BLASTPASS that was used to deploy NSO Group's Pegasus mercenary spyware onto fully-patched iPhones (running iOS (16.6) via PassKit attachments containing malicious images.
CVE-2023-41064 is a buffer overflow weakness that gets triggered when processing maliciously crafted images, and it can lead to arbitrary code execution on unpatched devices.
CVE-2023-41061 is a validation issue that can be exploited using a malicious attachment to also gain arbitrary code execution on targeted devices.
Apple fixed the zero-days in macOS Ventura 13.5.2,
Talos
Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
blogs_talos·2023-04-13
Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
Welcome to this week’s edition of the Threat Source newsletter.
Law enforcement organizations across the globe notched a series of wins over the past few weeks against online forums for cybercriminals.
On March 23, the FBI announced it disrupted the online cybercriminal marketplace BreachForums, known for being a place where users could buy and sell stolen user information. They also arrested a 20-year-old suspected of being the site’s founder and main administrator.
Then last week we had “Operation Cookie Monster” in which several international agencies worked together to take down Genesis Market, a similar dark web forum, arresting dozens of suspected users and administrators.
These arrests and network operations are important in that they disrupted sites that were known for highly s
Talos
Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
blogs_talos·2023-04-13
Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
## Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
Welcome to this week’s edition of the Threat Source newsletter.
Law enforcement organizations across the globe notched a series of wins over the past few weeks against online forums for cybercriminals.
On March 23, the FBI announced it disrupted the online cybercriminal marketplace BreachForums , known for being a place where users could buy and sell stolen user information. They also arrested a 20-year-old suspected of being the site’s founder and main administrator.
Then last week we had “Operation Cookie Monster” in which several international agencies worked together to take down Genesis Market , a similar dark web forum, arresting dozens of suspected users and administrators.
These arrests and network opera
Krebs
Microsoft (& Apple) Patch Tuesday, April 2023 Edition
blogs_krebs·2023-04-12·CVSS 8.8
CVE-2023-28206 [HIGH] Microsoft (& Apple) Patch Tuesday, April 2023 Edition
Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones , iPads and Macs .
On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including CVE-2023-28206 , which can be exploited by apps to seize control over a device. CVE-2023-28205 can be used by a malicious or hacked website to install code.
Both vulnerabilities are addressed in iOS/iPadOS 16.4.1, iOS 15.7.5, and macOS 12.6.5 and 11.7.6 . If you use Apple devices and you don’t have automatic upda
Krebs
Microsoft (& Apple) Patch Tuesday, April 2023 Edition
blogs_krebs·2023-04-11·CVSS 8.8
CVE-2023-28206 [HIGH] Microsoft (& Apple) Patch Tuesday, April 2023 Edition
Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones, iPads and Macs.
On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including CVE-2023-28206, which can be exploited by apps to seize control over a device. CVE-2023-28205 can be used by a malicious or hacked website to install code.
Both vulnerabilities are addressed in iOS/iPadOS 16.4.1, iOS 15.7.5, and macOS 12.6.5 and 11.7.6. If you use Apple devices and you don’t have automatic updates
Checkpoint
10th April – Threat Intelligence Report
blogs_checkpoint·2023-04-10
CVE-2023-28205 10th April – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 10th April – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 10th April, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
Taiwanese computing hardware giant MSI has suffered a ransomware attack by the recently-founded group Money Message. The group has demanded $4M in ransom, and claims to have stolen source code and databases as part of 1.5TB of information exfiltrated from the company.
Check Point Harmony Endpoint and Threat Emulation provide p
https://support.apple.com/en-us/HT213720https://support.apple.com/en-us/HT213721https://support.apple.com/en-us/HT213722https://support.apple.com/en-us/HT213723https://support.apple.com/en-us/HT213720https://support.apple.com/en-us/HT213721https://support.apple.com/en-us/HT213722https://support.apple.com/en-us/HT213723https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28205
2023-04-10
Published
2023-04-10
Added to CISA KEV
Exploited in the wild