The vulnerability of the web page rendering modules in Safari’s WebKit browser for iOS, watchOS, tvOS, iPadOS operating systems allows a hacker to execute arbitrary code.

The vulnerability of the web page rendering modules in WebKit of Safari browsers for iOS, watchOS, tvOS, and iPadOS stems from insufficient input validation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Update now! Apple patches a raft of vulnerabilities

Apple has released security updates for its phones, iPads, Macs, watches and TVs. Updates are available for these products: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th...

DEBIAN-CVE-2023-41983

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. Processing web content may lead to a denial-of-service...

CVE-2023-41997

This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. An attacker with physical access may be able to use Siri to access sensitive user data...

CVE-2023-42847

A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An attacker may be able to access passkeys without authentication...

CVE-2023-42846

This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS 17.1 and iPadOS 17.1. A device may be passively tracked by its Wi-Fi MAC address...

CVE-2023-42857

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data...

CVE-2023-41072

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data...

CVE-2023-40449

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. An app may be able to cause a denial-of-service...

PT-2023-28613 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: Apple tvOS versions prior to 17.1 Apple watchOS versions prior to 10.1 Apple macOS Sonoma versions prior to 14.1 Apple iOS versions prior to 17.1 Apple iPadOS versions prior to 17.1 Description: The issue allows an app to access sensitive use...

PT-2023-8687 · Apple · Macos Monterey +3

Name of the Vulnerable Software and Affected Versions: macOS Monterey versions prior to 12.7.1 iOS versions prior to 16.7.2 and prior to 17.1 iPadOS versions prior to 16.7.2 and prior to 17.1 Description: The issue is related to improved memory handling and may lead to arbitrary code execution in...

PT-2023-8360 · Apple · Macos Monterey +6

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17.1 iPadOS versions prior to 17.1 macOS Monterey versions prior to 12.7.1 watchOS versions prior to 10.1 iOS versions prior to 16.7.2 iPadOS versions prior to 16.7.2 macOS Ventura versions prior to 13.6.1 macOS Sonoma...

PT-2023-8364 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.1 iOS versions prior to 17.1 iPadOS versions prior to 17.1 Description: A privacy issue was addressed with improved private data redaction for log entries. This issue may allow an app to access sensitive user...

PT-2023-8355 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.1 iOS versions prior to 17.1 iPadOS versions prior to 17.1 iOS versions prior to 16.7.2 iPadOS versions prior to 16.7.2 macOS Ventura versions prior to 13.6.1 Description: The issue is related to improved memory...

PT-2023-8348 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.1 iOS versions prior to 17.1 iPadOS versions prior to 17.1 Description: A privacy issue is related to insufficient protection of registration data in the Contacts component of iOS, macOS, and iPadOS operating system...

PT-2023-28656 · Apple · Macos Sonoma +5

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 17.1 Apple iPadOS versions prior to 17.1 Apple macOS Sonoma versions prior to 14.1 Apple tvOS versions prior to 17.1 Apple watchOS versions prior to 10.1 Description: A permissions issue was addressed with addition...

PT-2023-6492 · Apple · Macos Sonoma +7

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 17.1 iOS versions prior to 17.1 iOS versions prior to 16.7.2 iPadOS versions prior to 17.1 iPadOS versions prior to 16.7.2 watchOS versions prior to 10.1 tvOS versions prior to 17.1 macOS Sonoma versions prior to 14.1...

PT-2023-7179 · Apple · Ipados +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.1 watchOS versions prior to 10.1 iOS versions prior to 16.7.2 and prior to 17.1 iPadOS versions prior to 16.7.2 and prior to 17.1 Description: This issue is related to insufficient access control in the Siri persona...

The outstanding stealth of Operation Triangulation

Introduction In our previous blogpost on Triangulation, we discussed the details of TriangleDB, the main implant used in this campaign, its C2 protocol and the commands it can receive. We mentioned, among other things, that it is able to execute additional modules. We also mentioned that this...

The vulnerability of GPU driver components in iPadOS and iOS operating systems allows attackers to execute arbitrary code.

The vulnerability of GPU driver in iPadOS and iOS systems relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...