Source: www.securityweek.com – Author: Ryan Naraine
Apple on Monday rolled out an urgent software update to its iOS and iPadOS mobile operating systems and warned that zero-day exploitation has already been detected.
For the second time since adopting the “rapid security responses” process to address zero-day attacks, Apple pushed iOS 16.5.1 (a) and iPadOS 16.5.1 (a) to devices globally after an anonymous researcher disclosed the underlying vulnerability.
A barebones advisory from Cupertino said the security defect exists in WebKit, the browser engine used by Safari, Mail, AppStore and many other apps on iOS- and macOS-powered devices.
“Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited,” the company said. “The issue was addressed with improved checks.”
The vulnerability has been tagged as CVE-2023-37450.
So far in 2023, there have been 41 publicly documented cases of zero-day attacks with more than one-fifth (22 percent) affecting software code on Apple devices.
July 11 Update: Apple released Rapid Response Updates for both iOS and macOS, but was forced to pull them after users reported that the patches were breaking some websites.
Related: Problems Installing Apple’s First iOS Rapid Security Response Patch
Related: Apple Ships Urgent iOS Patch for Exploited Zero-Days
Related: Apple Fixes Exploited Zero-Day With iOS 16.1 Patch
Related: Apple Says WebKit Zero-Day Hitting iOS, macOS Devices
Original Post URL: https://www.securityweek.com/apple-ships-urgent-ios-patch-for-webkit-zero-day/
Category & Tags: Incident Response,Mobile & Wireless,Vulnerabilities,Apple,CVE-2023-37450,iOS,iPadOS,WebKit,Zero-Day – Incident Response,Mobile & Wireless,Vulnerabilities,Apple,CVE-2023-37450,iOS,iPadOS,WebKit,Zero-Day
