Apple recommends users update to iOS 17.1.2, iPadOS 17.1.2 and macOS 14.1.2.
Google's Threat Analysis Group discovered these security bugs.
Apple has patched two zero-day vulnerabilities affecting iOS, iPadOS and macOS; users are advised to update to iOS 17.1.2, iPadOS 17.1.2 and macOS 14.1.2.
The vulnerabilities were discovered by Google's Threat Analysis group, which has been working on fixes for active Chrome vulnerabilities this week as well.
"Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1," according to Apple's post about the security updates on Nov. 30.
This implies that attackers may be actively using the vulnerabilities.
Apple's update said the problem originated in WebKit, the engine used for Apple's browsers, where "Processing web content may lead to arbitrary code execution." The updates fix an out-of-bounds read through improved input validation and repair a memory corruption vulnerability using improved locking.
SEE: Attackers have launched eavesdropping attacks on Apple devices over the last year.
The first vulnerability, the out-of-bounds read, is tracked as CVE-2023-42916.
The second vulnerability, the memory corruption, is tracked as CVE-2023-42917.
Information is sparse about the vulnerabilities, which Apple said were investigated by Clément Lecigne at Google's Threat Analysis Group; the group's stated mission is to "Counter government-backed attacks."
Remediation and protection against the WebKit exploits.
Apple users should be sure they are running the latest version of their operating system, as a general security best practice as well as in the case of active vulnerabilities such as these.
Apple has provided a complete list of the most up-to-date software updates.
The Google Threat Analysis Group also spotted and fixed an out of bounds memory access and six other vulnerabilities in Google Chrome earlier this week.
"We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel," the Chrome team wrote in the post about the security update.
TechRepublic contacted Apple and Google for commentary about this story.
Apple referred us to the security release notes; Google has not responded at the time of publication.
This Cyber News was published on www.techrepublic.com. Publication date: Fri, 01 Dec 2023 23:06:57 +0000