Apple has rolled out iOS 14.8, watchOS 7.6.2, iPadOS 14.8, Safari 14.1.2, and macOS Big Sur 11.6 releases to address two actively exploited vulnerabilities, one of which could bypass the operating system’s additional security measures.
Here are the two identified flaws:
- CVE-2021-30858 (WebKit) – A use after free issue
- CVE-2021-30860 (CoreGraphics) – An integer overflow vulnerability
Apple also stated that it has received information about the potential exploitation of these vulnerabilities.
The updates come just weeks after Citizen Lab researchers disclosed specifics of a zero-day exploit known as “FORCEDENTRY” (aka Megalodon). It was weaponized by the NSO Group, an Israeli surveillance vendor, and reportedly used by the Bahraini government to install Pegasus spyware to infiltrate the phones of nine activists in the nation since February of this year.
In addition to being triggered by delivering a malicious message to the target, FORCEDENTRY has other features. It completely contradicts Apple’s new BlastDoor software security feature, which prevents zero-click attacks by screening untrusted data transmitted through iMessage.
According to Citizen Lab researchers, their most recent finding of another Apple zero-day in NSO Group’s armory highlights how firms like NSO Group are supporting ‘despotism-as-a-service’ for unaccountable security agencies of the government.
Citizen Lab further said that the exploit chain begins when victims receive a text message with a malicious GIF image. That, in reality, is an Adobe PSD (Photoshop Document file) or PDF file crafted to crash the iMessage component accountable for automatically rendering images and deploying the surveillance tool.
CVE-2021-30858 is the most recent in a slew of WebKit zero-day issues that Apple has patched this year. With these releases, the company has succeeded in fixing 15 zero-day vulnerabilities since 2021 beginning.
Users of Apple’s iPhone, iPad, Mac, and Apple Watch should update their software immediately to avoid any exploitation of the vulnerabilities.
