Apple fixes two zero-day exploits

Two high-risk zero-day vulnerabilities have been addressed in the new iOS 12.5.3 version that was released by Apple on Monday.  According to the iPhone maker, there are reports that the flaws have been exploited in the wild.

As per the available details, iOS 12.5.4 includes three security-related updates, including a memory corruption problem in the ASN.1 decoder (CVE-2021-30737) and two weaknesses with the WebKit browser engine that might be leveraged to accomplish remote code execution.

Tracked as CVE-2021-30761, the first WebKit flaw is a memory corruption vulnerability that might be exploited to execute arbitrary code when processing malware-infected web content.

The second flaw in the WebKit, tracked as CVE-2021-30762 is a use-after-free vulnerability that might be exploited to enable arbitrary code execution when maliciously generated web content is processed.

Apple’s advisory indicates that the company is aware of exploits targeting CVE-2021-30761 and CVE-2021-30762. Both of the flaws have been reported anonymously. Due to security reasons, the Cupertino-based company did not provide any detailed information about the specifics of the attacks, the targeted victims, or the malicious actors that may be exploiting them.

An observation that is worth noting, however, is that the main exploitation efforts were aimed at gaining unauthorized access to older Apple devices like iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch rather than newer models.

The same set of devices was targeted with another WebKit flaw tracked as (CVE-2021-30666) addressing buffer overflow issue that Apple fixed with an update released on the 3^rd of May. This points out the assumption that threat actors are streaming their active exploitation attempts to users with older devices.

Adding these two vulnerabilities to the list, a total of 12 zero-days impacting iOS, iPadOS, macOS, tvOS, and watchOS have been fixed by Apple since the start of the year.

All users of Apple devices are advised to download the latest updates and apply the fixes as soon as possible to limit the risk related to the above-mentioned flaws.