Security News > 2023 > September > Apple patches two zero-days under attack (CVE-2023-41064, CVE-2023-41061)
Apple has patched two zero-day vulnerabilities exploited to deliver NSO Group's Pegasus spyware.
"The exploit chain was capable of compromising iPhones running the latest version of iOS without any interaction from the victim," Citizen Lab shared.
CVE-2023-41061 is a validation issue in Apple's Wallet, where users can store payment cards, IDs, event tickets, traveling tickets, etc.
CVE-2023-41064 was reported by The Citizen Lab at The University of Torontoʼs Munk School, while CVE-2023-41061 was figured out by Apple with their help, probably as they were validating the existence of CVE-2023-41064.
The exploit chain - dubbed BLASTPASS by Citizen Lab - was detected when they analyzed a device of an individual employed by a Washington DC-based civil society organization with international offices.
Another good idea for users that run the latest versions of Apple's operating systems is to enable Apple Rapid Security Response, which automatically installs security patches as they are made available.
News URL
https://www.helpnetsecurity.com/2023/09/08/cve-2023-41064-cve-2023-41061/
Related news
- Apple fixes two zero-days exploited in targeted iPhone attacks (source)
- Apple plugs zero-day holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201) (source)
- Apple Patches Two Zero-Days Used in ‘Extremely Sophisticated’ Attacks (source)
- Google fixes Android zero-days exploited in attacks, 60 other flaws (source)
- Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks (source)
- Phishing detection is broken: Why most attacks feel like a zero day (source)
- DslogdRAT Malware Deployed via Ivanti ICS Zero-Day CVE-2025-0282 in Japan Attacks (source)
- SAP fixes suspected Netweaver zero-day exploited in attacks (source)
- Craft CMS RCE exploit chain used in zero-day attacks to steal data (source)
- Google: 97 zero-days exploited in 2024, over 50% in spyware attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-07 | CVE-2023-41064 | Classic Buffer Overflow vulnerability in Apple Ipados A buffer overflow issue was addressed with improved memory handling. | 7.8 |
| 2023-09-07 | CVE-2023-41061 | Unspecified vulnerability in Apple Ipados A validation issue was addressed with improved logic. | 7.8 |