Apple fixed the 17th zero-day flaw exploited in attacks

Apple released emergency security updates to address a new actively exploited zero-day vulnerability impacting iPhone and iPad devices.

Apple released emergency security updates to address a new zero-day vulnerability, tracked as CVE-2023-42824, that is exploited in attacks targeting iPhone and iPad devices.

The vulnerability is a privilege escalation issue that resides in the Kernel, it was addressed with improved checks.

“A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.” reads the advisory published by the company.

The vulnerability impacts iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later.

The IT giant also addressed a buffer overflow issue, tracked as CVE-2023-5217, in WebRTC that may result in arbitrary code execution.

The company addressed the vulnerability by updating to libvpx 1.13.1.

The flaw was discovered by security researcher Clément Lecigne from Google’s Threat Analysis Group (TAG).

Last week, Google also released security updates to address the actively exploited vulnerability CVE-2023-5217.

Apple has already patched 16 actively exploited zero-day vulnerabilities in 2023, below is the list of the flaws fixed by the company:

• September 2023 – CVE-2023-41993, CVE-2023-41991, and CVE-2023-41992
• September 2023 –  CVE-2023-41064 and CVE-2023-41061.
• July 2023 – CVE-2023-37450 and CVE-2023-38606.
• June 2023 – CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439.
• May 2023 – CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373).
• April 2023 – CVE-2023-28206 and CVE-2023-28205.
• February 2023 – CVE-2023-23529.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, zero-day)