苹果发布iOS 18.3.2和iPadOS 18.3.2更新，修复WebKit零日漏洞CVE-2025-24201，该漏洞已被用于针对特定目标的复杂攻击。此前一个月，苹果还修复了允许禁用USB受限模式的安全问题。 2025-3-11 19:11:14 Author: www.securityweek.com(查看原文) 阅读量:8 收藏
Apple on Tuesday released iOS 18.3.2 and iPadOS 18.3.2 with an urgent fix for a WebKit flaw that’s already been exploited on older versions of the mobile operating system.
The zero-day, tagged as CVE-2025-24201, allows attackers to break out of the Web Content sandbox and Cupertino warns that it “may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.”
“This is a supplementary fix for an attack that was blocked in iOS 17.2,” the company said in a barebones bulletin.
“For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available,” the company added.
Apple described the bug as an out-of-bounds write issue that was fixed with improved checks to prevent unauthorized actions.
The iOS 18.3.2 rollout comes exactly one month after Apple patched a security flaw that allowed attackers with physical access to a locked iPhone or iPad to disable USB Restricted Mode – a key protection mechanism.
In that case, the company said the bug led to “an extremely sophisticated attack against specific targeted individuals.” The discovery of the exploit was credited to Bill Marczak of The Citizen Lab at The University of Toronto’s Munk School, suggesting the exploit was used for nation-state level surveillance.
USB Restricted Mode is a security feature designed to block data access via an iPhone or iPad’s Lightning/USB-C port when the device has been locked for over an hour. It was introduced to thwart hacking tools that connect via USB to crack a device’s passcode or extract data.
Advertisement. Scroll to continue reading.
Related: Apple: USB Restricted Mode Exploited in ‘Extremely Sophisticated’ Attack
Related: Apple Confirms Zero-Day Attacks Hitting macOS Systems
Related: Microsoft Patches 57 Flaws, Flags Six Active Zero-Days
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Join this in-depth briefing on how to protect executives and the enterprises they lead from the growing convergence of digital, narrative, and physical attacks.
Learn how integrating BAS and Automated Penetration Testing empowers security teams to quickly identify and validate threats, enabling prompt response and remediation.
如有侵权请联系:admin#unsafe.sh