8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Apple on Monday rolled out security updates for iOS, iPadOS, macOS, and Safari to address a zero-day flaw that it said has been actively exploited in the wild.
Tracked as CVE-2023-23529, the issue relates to a type confusion bug in the WebKit browser engine that could be activated when processing maliciously crafted web content, culminating in arbitrary code execution.
The iPhone maker said the bug was addressed with improved checks, adding itβs βaware of a report that this issue may have been actively exploited.β An anonymous researcher has been credited with reporting the flaw.
Itβs not immediately clear as to how the vulnerability is being exploited in real-world attacks, but itβs the second actively abused type confusion flaw in WebKit to be patched by Apple after CVE-2022-42856 in as many months, which was closed in December 2022.
WebKit flaws are also notable for the fact that they impact every third-party web browser thatβs available for iOS and iPadOS owing to Appleβs restrictions that require browser vendors to use the same rendering framework.
Also addressed by the company is a use-after-free issue in the Kernel (CVE-2023-23514) that could permit a rogue app to execute arbitrary code with the highest privileges.
Credited with reporting the issue are Xinru Chi of Pangu Lab and Ned Williamson of Google Project Zero. Apple said it resolved the vulnerability with improved memory management.
Separately, the latest macOS update also plugs a privacy defect in Shortcuts that a malware-laced app can take advantage of to βobserve unprotected user data.β The problem, Apple noted, was fixed with improved handling of temporary files.
Users are advised to update to iOS 16.3.1, iPadOS 16.3.1, macOS Ventura 13.2.1, and Safari 16.3.1 to mitigate potential risks. The updates are available for the following devices -
Apple remediated a total of 10 zero-days spanning its software in 2022, nine of which were disclosed as actively exploited by threat actors. Four of those flaws were discovered in WebKit.
Found this article interesting? Follow us on Twitter ο and LinkedIn to read more exclusive content we post.