After Apple and Google, Mozilla has also released patches for an image processing-related zero-day vulnerability that has been exploited to deliver spyware.
The existence of a new zero-day came to light on September 7, when Apple announced iOS and macOS updates to patch an exploited vulnerability tracked as CVE-2023-41064. The tech giant described the zero-day as a buffer overflow in the ImageIO component that can be exploited for arbitrary code execution using specially crafted images.
On the same day, the Citizen Lab group at the University of Torontoʼs Munk School reported that the vulnerability is part of a new zero-click exploit dubbed BlastPass that has been used to target iPhones running the latest version of iOS.
Citizen Lab said the exploit, which had been used to deliver the NSO Group’s notorious Pegasus spyware via malicious images sent through iMessage, targeted an employee at a “Washington DC-based civil society organization with international offices”.
On September 11, Google also announced Chrome updates to patch a critical zero-day vulnerability whose existence was reported by Apple and Citizen Lab. Google, which tracks the flaw as CVE-2023-4863, said the issue impacts the WebP component used by its web browser.
WebP, an image format developed by Google, is offered as an alternative to JPEG, PNG and GIF. The significantly smaller size of WebP images results in web pages loading much faster.
The WebP format is also supported by Mozilla’s Firefox web browser, as well as its Thunderbird email client, and the organization on Tuesday announced releasing updates that should patch the zero-day. In the case of Firefox and Thunderbird, the vulnerability is in the libwebp component. Just like Google, Mozilla tracks the zero-day as CVE-2023-4863.
Apple initially released patches for the zero-day on September 7, but only for the latest versions of iOS and macOS. On September 11, the company rolled out fixes for older versions of its operating systems, including for Macs (Monterey and Big Sur), and iPhones and iPads.
The zero-day appears to have only been exploited in targeted attacks for now, but given the widespread use of the affected image-processing component, millions of users could be at risk.
StackDiary provides a technical analysis of the vulnerability based on the patch.
Related: Google Links More iOS, Android Zero-Day Exploits to Spyware Vendors
Related: US to Adopt New Restrictions on Using Commercial Spyware
Related: Details Emerge on Israeli Spyware Vendor QuaDream and Its iOS Malware
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- NIST Publishes Final Version of 800-82r3 OT Security Guide
- Johnson Controls Hit by Ransomware
- Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users
- Government Shutdown Could Bench 80% of CISA Staff
- Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
- macOS 14 Sonoma Patches 60 Vulnerabilities
- New GPU Side-Channel Attack Allows Malicious Websites to Steal Data
- Microsoft Adding New Security Features to Windows 11
Latest News
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
- Cloudflare Users Exposed to Attacks Launched From Within Cloudflare: Researchers
- A Key US Government Surveillance Tool Should Face New Limits, a Divided Privacy Oversight Board Says
- NIST Publishes Final Version of 800-82r3 OT Security Guide
- FBI Warns Organizations of Dual Ransomware, Wiper Attacks
- Johnson Controls Hit by Ransomware
- US State Department Says 60,000 Emails Taken in Alleged Chinese Hack
- Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product
