After Apple and Google, Mozilla has also released patches for an image processing-related zero-day vulnerability that has been exploited to deliver spyware.
The existence of a new zero-day came to light on September 7, when Apple announced iOS and macOS updates to patch an exploited vulnerability tracked as CVE-2023-41064. The tech giant described the zero-day as a buffer overflow in the ImageIO component that can be exploited for arbitrary code execution using specially crafted images.
On the same day, the Citizen Lab group at the University of Torontoʼs Munk School reported that the vulnerability is part of a new zero-click exploit dubbed BlastPass that has been used to target iPhones running the latest version of iOS.
Citizen Lab said the exploit, which had been used to deliver the NSO Group’s notorious Pegasus spyware via malicious images sent through iMessage, targeted an employee at a “Washington DC-based civil society organization with international offices”.
On September 11, Google also announced Chrome updates to patch a critical zero-day vulnerability whose existence was reported by Apple and Citizen Lab. Google, which tracks the flaw as CVE-2023-4863, said the issue impacts the WebP component used by its web browser.
WebP, an image format developed by Google, is offered as an alternative to JPEG, PNG and GIF. The significantly smaller size of WebP images results in web pages loading much faster.
The WebP format is also supported by Mozilla’s Firefox web browser, as well as its Thunderbird email client, and the organization on Tuesday announced releasing updates that should patch the zero-day. In the case of Firefox and Thunderbird, the vulnerability is in the libwebp component. Just like Google, Mozilla tracks the zero-day as CVE-2023-4863.
Apple initially released patches for the zero-day on September 7, but only for the latest versions of iOS and macOS. On September 11, the company rolled out fixes for older versions of its operating systems, including for Macs (Monterey and Big Sur), and iPhones and iPads.
The zero-day appears to have only been exploited in targeted attacks for now, but given the widespread use of the affected image-processing component, millions of users could be at risk.
StackDiary provides a technical analysis of the vulnerability based on the patch.
Related: Google Links More iOS, Android Zero-Day Exploits to Spyware Vendors
Related: US to Adopt New Restrictions on Using Commercial Spyware
Related: Details Emerge on Israeli Spyware Vendor QuaDream and Its iOS Malware
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- NIST Publishes Final Version of 800-82r3 OT Security Guide
- Johnson Controls Hit by Ransomware
- Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users
- Government Shutdown Could Bench 80% of CISA Staff
- Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
- macOS 14 Sonoma Patches 60 Vulnerabilities
- New GPU Side-Channel Attack Allows Malicious Websites to Steal Data
Latest News
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Generative AI Startup Nexusflow Raises $10.6 Million
- In Other News: RSA Encryption Attack, Meta AI Privacy, ShinyHunters Hacker Guilty Plea
- Researchers Extract Sounds From Still Images on Smartphone Cameras
- National Security Agency is Starting an Artificial Intelligence Security Center
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
