Apple, Mac, MacOS, iOS4, iPad, iPhone and (in)security...

Citizen Lab says two zero-days fixed by Apple today in emergency security updates were actively abused as part of a zero-click exploit chain (dubbed BLASTPASS) to deploy NSO Group's Pegasus commercial spyware onto fully patched iPhones.

The two bugs, tracked as CVE-2023-41064 and CVE-2023-41061, allowed the attackers to infect a fully-patched iPhone running iOS 16.6 and belonging to a Washington DC-based civil society organization via PassKit attachments containing malicious images.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security

https://www.scoop.it/topic/apple-mac-ios4-ipad-iphone-and-in-security/?&tag=Blastpass

Apple released security updates for older iPhones to fix a zero-day vulnerability tracked as CVE-2023-41064 that was actively exploited to infect iOS devices with NSO's Pegasus spyware.

CVE-2023-31064 is a remote code execution flaw that is exploited by sending maliciously crafted images via iMessage.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/apple-mac-ios4-ipad-iphone-and-in-security