Apple Issues Security Updates for Older iOS Devices Targeted by Coruna Web Kit Exploit

Summary: Apple backported fixes for CVE-2023-43010, a WebKit memory corruption flaw used in the Coruna exploit kit, to older iOS, iPadOS, and macOS Sonoma versions on Wednesday, and iOS 15.8.7 and iPadOS 15.8.7 add patches for three more Coruna-linked vulnerabilities. Google said Coruna carries 23 exploits across five chains targeting iPhones running iOS 13.0 through 17.2.1, and iVerify, tracking the framework as CryptoWaters, noted similarities to tooling from threat actors affiliated with the U.S. government.
Key Takeaway: The exploit kit covers iOS 13.0 to 17.2.1, so any iPhone still on an older release that cannot take the latest update is only now receiving a fix Apple first shipped in iOS 17.2 on December 11, 2023.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-32434 CVE-2023-38606 CVE-2023-43010
Related: Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass Attacks Cyber Risks ·
CVE-2023-38606: Apple Multiple Products Kernel Unspecified Vulnerability Known Exploited Vulnerabilities · Jul 26, 2023
CVE-2023-32434: Apple Multiple Products Integer Overflow Vulnerability Known Exploited Vulnerabilities · Jun 23, 2023