Security News > 2023 > October > Apple patches another iOS zero-day under attack (CVE-2023-42824)
![Apple patches another iOS zero-day under attack (CVE-2023-42824)](/static/build/img/news/apple-patches-another-ios-zero-day-under-attack-cve-2023-42824-medium.jpg)
Apple has released a security update for iOS and iPadOS to fix another zero-day vulnerability exploited in the wild.
"Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6," the company stated.
The company addressed the vulnerability by releasing iOS 17.0.3 and iPadOS 17.0.3 updates, which also cover CVE-2023-5217 - a buffer overflow vulnerability in vp8 encoding in the libvpx video codec library that could allow arbitrary code execution.
Both vulnerabilities were reported by Citizen Lab and have been fixed in both the iOS 16 and iOS 15 branches.
In late September, Citizen Lab together with Google TAG reported three more zero-day vulnerabilities affecting iOS devices.
Apple has addressed these issues in iOS 17 and has also made updates to Lockdown Mode, a security feature that offers additional protection to high-risk users.
News URL
https://www.helpnetsecurity.com/2023/10/05/cve-2023-42824/
Related news
- Black Basta ransomware gang linked to Windows zero-day attacks (source)
- Critical Flaws in CocoaPods Expose iOS and macOS Apps to Supply Chain Attacks (source)
- 'Almost every Apple device' vulnerable to CocoaPods supply chain attack (source)
- Millions of Apple Applications Were Vulnerable to CocoaPods Supply Chain Attack (source)
- Windows MSHTML zero-day used in malware attacks for over a year (source)
- Japanese space agency spotted zero-day attacks while cleaning up raid on M365 (source)
- Apple Is Alerting iPhone Users of Spyware Attacks (source)
- Void Banshee APT exploited “lingering Windows relic” in zero-day attacks (source)
- Apple iOS 18 Cheat Sheet: Release Date, RCS Integration and More (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2023-09-28 | CVE-2023-5217 | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |