Update Your iOS Devices Now — 3 Actively Exploited 0-Days Discovered

Apple on Thursday released multiple security updates to patch
three zero-day vulnerabilities that were revealed as being actively
exploited in the wild.

Rolled out as part of its iOS, iPadOS, macOS, and watchOS
updates, the flaws reside in the FontParser component and the
kernel, allowing adversaries to remotely execute arbitrary code and
run malicious programs with kernel-level privileges.

The zero-days were discovered and reported to Apple by Google’s
Project Zero security team.

“Apple is aware of reports that an exploit for this issue exists
in the wild,” the iPhone maker said of the three zero-days without
giving any additional details so as to allow a vast majority of
users to install the updates.

The list of impacted devices^[1]
includes iPhone 5s and later, iPod touch 6th and 7th generation,
iPad Air, iPad mini 2 and later, and Apple Watch Series 1 and
later.

The fixes are available in versions iOS 12.4.9 and 14.2, iPadOS
14.2, watchOS 5.3.9, 6.2.9, and 7.1, and as a supplemental update
for macOS Catalina 10.15.7.

According to Apple’s security
bulletin^[2], the flaws are:

• CVE-2020-27930: A memory corruption issue in
  the FontParser library that allows for remote code execution when
  processing a maliciously crafted font.
• CVE-2020-27932: A memory initialization issue
  that allows a malicious application to execute arbitrary code with
  kernel privileges.
• CVE-2020-27950: A type-confusion issue that
  makes it possible for a malicious application to disclose kernel
  memory.

“Targeted exploitation in the wild similar to the other recently
reported 0days,” said^[3]
Shane Huntley, Director of Google’s Threat Analysis Group. “Not
related to any election targeting.”

The disclosure is the latest in the string of zero-days Project
Zero has reported since October 20. First came the Chrome zero-day
in Freetype font rendering library (CVE-2020-15999^[4]), then a Windows
zero-day (CVE-2020-17087^[5]), followed by two more
in Chrome and its Android variant (CVE-2020-16009 and CVE-2020-16010^[6]).

A patch for the Windows zero-day is expected to be released on
November 10 as part of this month’s Patch Tuesday.

While more details are awaited on whether the zero-days were
abused by the same threat actor, it’s recommended that users update
their devices to the latest versions to mitigate the risk
associated with the flaws.