A week in security (December 4 – December 10)

Last week on Malwarebytes Labs: Meta’s Purple Llama wants to test safety risks in AI models US government is snooping on people via phone push notifications, says senator Android phones can be taken over remotely – update when you can How IT teams can conduct a vulnerability assessment for...

PT-2023-8869

Name of the Vulnerable Software and Affected Versions Safari versions prior to 17.2 iOS versions prior to 17.2 iPadOS versions prior to 17.2 tvOS versions prior to 17.2 watchOS versions prior to 10.2 macOS Sonoma versions prior to 14.2 Description A use after free issue was addressed with improve...

PT-2023-28642 · Apple · Macos Sonoma +3

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.2 iOS versions prior to 17.2 iPadOS versions prior to 17.2 watchOS versions prior to 10.2 Description: A privacy issue was addressed with improved private data redaction for log entries. This issue may allow ...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. Apple iOS version 17.2 and iPadOS version 17.2 contain a security vulnerability that originates from an application that m...

PT-2023-28661 · Apple · Macos Monterey +5

Name of the Vulnerable Software and Affected Versions: macOS Monterey versions prior to 12.7.2 macOS Ventura versions prior to 13.6.3 iOS versions prior to 17.2 iPadOS versions prior to 17.2 iOS versions prior to 16.7.3 iPadOS versions prior to 16.7.3 macOS Sonoma versions prior to 14.2...

Warning for iPhone Users: Experts Warn of Sneaky Fake Lockdown Mode Attack

A new "post-exploitation tampering technique" can be abused by malicious actors to visually deceive a target into believing that their Apple iPhone is running in Lockdown Mode when it's actually not and carry out covert attacks. The novel method, detailed by Jamf Threat Labs in a report shared wi...

Update your iPhones! Apple fixes two zero-days in iOS

Apple has released emergency security updates for iOS 17.1.2 and iPadOS 17.1.2 to patch for two zero-day vulnerabilities that may have been actively exploited. Apple said both vulnerabilities were in the WebKit component, which is the engine that powers Safari browser on Macs as well as all...

PT-2023-7336

Name of the Vulnerable Software and Affected Versions iOS versions prior to 17.1.2 iPadOS versions prior to 17.1.2 macOS Sonoma versions prior to 14.1.2 Safari versions prior to 17.1.2 Description A memory corruption issue was addressed with improved locking, which may lead to arbitrary code...

You Don’t Need to Turn Off Apple’s NameDrop Feature in iOS 17

Yes, your iPhone automatically turns on NameDrop with the latest software update. But you shouldn’t really be worried about it—regardless of what the police are saying...

CVE-2023-49060

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the referrerpolicy attribute. This vulnerability affects Firefox for iOS 120...

CVE-2023-49061

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS 120...

PT-2023-7113 · Mozilla · Firefox For Ios

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 120 Description: The issue is related to the Reader Mode in Firefox for iOS, where the browser fails to neutralize HTML tags, allowing an attacker to perform HTML template injection. This could enable a remot...

Alarm system cyberattack leaves those in need struggling to call for help

An alarm system company that allows those in need to ask for help at the touch of a button has suffered a cyberattack, causing serious disruption. Tunstall Netherlands says the attack left the control room struggling to receive distress calls from clients on Sunday November 12, 2023. Tunstall,...

Apple Security Update: iOS 17.1.1 and iPadOS 17.1.1

Apple recommends to install security update iOS 17.1.1 and iPadOS 17.1.1 on devices iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th...

Crashing iPhones with a Flipper Zero

The Flipper Zero is an incredibly versatile hacking device. Now it can be used to crash iPhones in its vicinity by sending them a never-ending stream of pop-ups. These types of hacks have been possible for decades, but they require special equipment and a fair amount of expertise. The capabilitie...

This Cheap Hacking Device Can Crash Your iPhone With Pop-Ups

Plus: SolarWinds is charged with fraud, New Orleans police face recognition has flaws, and new details about Okta’s October data breach emerge...

The vulnerability of the web page rendering module in WebKit operating systems for iOS, tvOS, iPadOS, MacOS, and watchOS allows attackers to execute arbitrary code.

The vulnerability of the web page rendering module in WebKit operating systems for iOS, tvOS, iPadOS, MacOS, and watchOS is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2023-9367 · Apple +7 · Macos Sonoma +11

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 17.2 iOS versions prior to 17.2 iPadOS versions prior to 17.2 macOS Sonoma versions prior to 14.2 WebKitGTK affected versions not specified WPE WebKit affected versions not specified Description: The issue is related ...

The vulnerability of the kernel of operating systems such as watchOS, iPadOS, iOS, and macOS lies in the operation of operations beyond buffer boundaries in memory, allowing attackers to execute arbitrary code.

The vulnerability of the kernel of watchOS, iPadOS, and iOS lies in the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the web page rendering modules in Safari’s WebKit browser for iOS, watchOS, tvOS, iPadOS operating systems allows a hacker to execute arbitrary code.

The vulnerability of the web page rendering modules in WebKit of Safari browsers for iOS, watchOS, tvOS, and iPadOS stems from insufficient input validation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...