Apple has swiftly released an emergency patch to address a vulnerability, identified as CVE-2023-42824, that it believes may have been exploited. The company has not provided specific details about the nature of the vulnerability in its usual manner.
This vulnerability impacts several Apple devices, including “iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later.” It is classified as a local privilege escalation vulnerability in the kernel and may have been actively exploited on iOS versions prior to iOS 16.6.
The emergency patch also addresses another vulnerability, CVE-2023-5217, which is related to the libvpx video codec library developed by Google and the Alliance for Open Media. This vulnerability, described as a heap buffer overflow, was initially reported by Clément Lecigne of Google’s Threat Analysis Group.
According to Mozilla, this vulnerability could result in a heap buffer overflow in the content process when handling an attacker-controlled VP8 media stream, potentially leading to remote code execution. Mozilla noted that the issue has been observed to be exploited in other products.
