Apple Issues Urgent Patches for 2 Zero-Day Flaws Exploited in the Wild

Apple on Monday shipped out-of-band security patches to address
two zero-day vulnerabilities in iOS 12.5.3 that it says are being
actively exploited in the wild.

The latest update, iOS
12.5.4^[1], comes with three
security fixes, including a memory corruption issue in the ASN.1
decoder^[2] (CVE-2021-30737) and two
flaws concerning the WebKit browser engine that could be abused to
achieve remote code execution —

• CVE-2021-30761 – A memory corruption issue
  that could be exploited to gain arbitrary code execution when
  processing maliciously crafted web content. The flaw was addressed
  with improved state management.
• CVE-2021-30762 – A use-after-free issue that
  could be exploited to gain arbitrary code execution when processing
  maliciously crafted web content. The flaw was resolved with
  improved memory management.

Both CVE-2021-30761 and CVE-2021-30762 were reported to Apple
anonymously, with the Cupertino-based company stating in its
advisory that it’s aware of reports that the vulnerabilities “may
have been actively exploited.” As is usually the case, Apple didn’t
share any specifics on the nature of the attacks, the victims that
may have been targeted, or the threat actors that may be abusing
them.

One thing evident, however, is that the active exploitation
attempts were directed against owners of older devices such as
iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad
mini 3, and iPod touch (6th generation). The move mirrors a similar
fix that Apple rolled out on May 3 to remediate a buffer overflow
vulnerability (CVE-2021-30666) in WebKit targeting the same set of
devices.

Along with the two aforementioned flaws, Apple has patched a
total of 12 zero-days affecting iOS, iPadOS, macOS, tvOS, and
watchOS since the start of the year —

• CVE-2021-1782^[3] (Kernel) – A malicious
  application may be able to elevate privileges
• CVE-2021-1870^[4] (WebKit) – A remote
  attacker may be able to cause arbitrary code execution
• CVE-2021-1871^[5] (WebKit) – A remote
  attacker may be able to cause arbitrary code execution
• CVE-2021-1879^[6] (WebKit) – Processing
  maliciously crafted web content may lead to universal cross-site
  scripting
• CVE-2021-30657^[7] (System Preferences) – A
  malicious application may bypass Gatekeeper checks
• CVE-2021-30661^[8] (WebKit Storage)-
  Processing maliciously crafted web content may lead to arbitrary
  code execution
• CVE-2021-30663^[9] (WebKit) – Processing
  maliciously crafted web content may lead to arbitrary code
  execution
• CVE-2021-30665^[10] (WebKit) – Processing
  maliciously crafted web content may lead to arbitrary code
  execution
• CVE-2021-30666^[11] (WebKit) – Processing
  maliciously crafted web content may lead to arbitrary code
  execution
• CVE-2021-30713^[12] (TCC framework) – A
  malicious application may be able to bypass Privacy
  preferences

Users of Apple devices are recommended to update to the latest
versions to mitigate the risk associated with the
vulnerabilities.