Security News > 2024 > May > Apple backports iOS zero-day patch, adds Bluetooth tracker alert
Apple has backported the patch for CVE-2024-23296 to the iOS 16 branch and has fixed a bug in MarketplaceKit that may allow maliciously crafted webpages to distribute a script that tracks iOS users on other webpages.
The company has also added a new capability to iOS 17 that will alert users if an unknown Bluetooth tracker is "Seen" moving with them.
The fix for the RTKit zero-day - which has been patched in iOS and iPadOS 17.4, macOS Sonoma, watchOS, tvOS and visionOS in March 2024 after reports of in-the-wild exploitation - has been backported only to Ventura, iOS 16.7.8 and iPadOS 16.7.8.
In March 2023, Apple has introduced a new URI scheme in iOS 17.4 to allow EU users to install alternative marketplace apps from developers' websites.
Apple and Google announced that iPhones and Android 6.0+ devices will from now alert users to the presence of unknown Bluetooth tracking devices.
"If a user gets on their iOS device, it means that someone else's AirTag, Find My accessory, or other industry specification-compatible Bluetooth tracker is moving with them. It's possible the tracker is attached to an item the user is borrowing, but if not, iPhone can view the tracker's identifier, have the tracker play a sound to help locate it, and access instructions to disable it," Apple explained.
News URL
https://www.helpnetsecurity.com/2024/05/14/ios-bluetooth-tracker-alert/
Related news
- Apple Patches Actively Exploited iOS Zero-Day CVE-2025-24200 in Emergency Update (source)
- Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks (source)
- Apple fixes zero-day exploited in 'extremely sophisticated' attacks (source)
- Apple fixes zero-day flaw exploited in “extremely sophisticated” attack (CVE-2025-24200) (source)
- Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws (source)
- Patch Tuesday: Microsoft Patches Two Actively Exploited Zero-Day Flaws (source)
- Global Pressure Mounts for Apple as Brazilian Court Demands iOS Sideloading Within 90 Days (source)
- Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws (source)
- Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks (source)
- Choose your own Patch Tuesday adventure: Start with six zero day fixes, or six critical flaws (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-03-05 | CVE-2024-23296 | Out-of-bounds Write vulnerability in Apple products A memory corruption issue was addressed with improved validation. | 7.8 |