Apple was forced to patch two more zero-day vulnerabilities, bringing the total for the year to 20.
The tech giant said both bugs in its WebKit browser engine were being actively exploited in the wild.
The first vulnerability, CVE-2023-42916, is found in a range of Apple products: iPhone XS and later, iPad Pro 12.9 inch 2nd generation and later, iPad Pro 10.5 inch, iPad Pro 11 inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later.
The flaw is described as an “out-of-bounds read” which Apple responded to with improved input validation.
“Processing web content may disclose sensitive information,” Apple said of its impact.
Learn more about Apple Zero-Days: Apple Releases Emergency Fixes for More Zero-Day Bugs
The second vulnerability, CVE-2023-42917, is a memory corruption flaw in WebKit that was fixed with “enhanced locking.”
It is present in the same list of products as the first vulnerability.
“Processing web content may lead to arbitrary code execution,” Apple said of the flaw.
Both bugs have been discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG), a researcher and organization known for finding vulnerabilities and exploits used in commercial spyware operations.
This week again, he was cited by Google in a Chrome update to find CVE-2023-6345, an integer overflow issue in the open source 2D graphics library Skia, related to similar state-sponsored activity.
The continued discovery of zero-day vulnerabilities in Apple’s kit, frequently sought by commercial spyware organizations to provide eavesdropping capabilities to targeted devices, suggests that such operations are still alive and well despite Western pressure.
The United States has placed organizations like NSO Group on commercial blacklists in an effort to stifle their activities, and in March, President Biden approved an executive order prohibiting the government from using any commercial spyware that has already been misused by foreign states to spy on citizens, dissidents, activists and others.
Image credit: NYC Russ / Shutterstock.com