Security News > 2021 > June > Apple: WebKit Bugs Exploited to Hack Older iPhones
Apple late Monday shipped an out-of-band iOS update for older iPhones and iPads alongside a warning that a pair of WebKit security vulnerabilities may have been actively exploited.
As is customary, Apple did not provide details on the zero-day attacks, which appear to be aimed at a range of older models of Apple flagship iPhone devices.
The latest iOS 12.5.4 patch covers at least three documented security holes that expose unpatched devices to arbitrary code execution attacks.
According to Apple, two flaws in the WebKit rendering engine could be exploited via booby-trapped web content to execute code on devices running iOS 12.
The two WebKit bugs are memory corruption and use-after-free issues that Apple says were fixed with improved state management.
The iOS 12.5.4 also fixes a memory corruption issue in the ASN.1 decoder that could expose older iPhone to code execution attacks.
News URL
Related news
- Apple Patches Actively Exploited Zero-Day Affecting iPhones, Macs, and More (source)
- Apple zero-day vulnerability exploited to target iPhone users (CVE-2025-24085) (source)
- SLAP, Apple, and FLOP: Safari, Chrome at risk of data theft on iPhone, Mac, iPad Silicon (source)
- Week in review: Apple 0-day used to target iPhones, DeepSeek’s popularity exploited by scammers (source)
- First Apple-notarized porn app available to iPhone users in Europe (source)