Security News > 2021 > May > Apple fixes 2 iOS zero-day vulnerabilities actively used in attacks
Today, Apple has released security updates that fix two actively exploited iOS zero-day vulnerabilities in the Webkit engine used by hackers to attack iPhones, iPads, iPods, macOS, and Apple Watch devices.
"Apple is aware of a report that this issue may have been actively exploited," the company said in multiple security advisories published today.
Webkit is Apple's browser rendering engine that is required to be used by all mobile web browsers in iOS and other applications that render HTML, such as Apple Mail and the App Store.
The zero-days were addressed by Apple earlier today in the iOS 14.5.1, iOS 12.5.3, macOS Big Sur 11.3.1, and the watchOS 7.4.1 updates.
"This update fixes an issue with App Tracking Transparency where some users who previously disabled Allow Apps to Request to Track in Settings may not receive prompts from apps after re-enabling it," stated Apple in their iOS 14.5.1 release notes.
Apple has been dealing with a stream of actively exploited zero-day vulnerabilities over the past few months, with one fixed in macOS last month and numerous other iOS vulnerabilities fixed in the previous months.
News URL
Related news
- Apple fixes two zero-days used in attacks on Intel-based Macs (source)
- Apple Releases Urgent Updates to Patch Actively Exploited Zero-Day Vulnerabilities (source)
- Apple Patches Two Zero-Day Attack Vectors (source)
- Rackspace monitoring data stolen in ScienceLogic zero-day attack (source)
- CUPS vulnerabilities could be abused for DDoS attacks (source)
- Apple Releases Critical iOS and iPadOS Updates to Fix VoiceOver Password Vulnerability (source)
- Qualcomm patches high-severity zero-day exploited in attacks (source)
- Ivanti warns of three more CSA zero-days exploited in attacks (source)
- Zero-Day Alert: Three Critical Ivanti CSA Vulnerabilities Actively Exploited (source)
- Mozilla fixes Firefox zero-day actively exploited in attacks (source)