Apple has issued critical emergency updates across its platforms, including iOS, iPadOS, macOS, visionOS, and Safari, to address two (2) actively exploited zero-day vulnerabilities. The first flaw, tracked as CVE-2024-44308, is a JavaScriptCore vulnerability enabling remote code execution (RCE) via maliciously crafted web content. The second vulnerability, tracked as CVE-2024-44309, is a WebKit issue flaw allowing cross-site scripting (XSS) attacks. These Vulnerabilities, identified by Clément Lecigne and Benoît Sevens of Google’s Threat Analysis Group, were likely exploited in highly targeted spyware attacks, specifically on Intel-based Mac systems. Apple resolved the issues with improved checks and state management, providing updates in macOS Sequoia 15.1.1, iOS 18.1.1 and 17.7.2, iPadOS 18.1.1 and 17.7.2, visionOS 2.1.1, and Safari 18.1.1. While Apple has not disclosed details on the exploitation, it has urged users to update promptly to safeguard against potential threats. With these patches, Apple has addressed six (6) zero-day vulnerabilities in 2024, marking a significant improvement compared to the twenty (20) fixed in 2023. CTIX analysts urge all readers to ensure their Apple devices are up-to-date to prevent future exploitation.
- The Hacker News: Apple Zero-Day Vulnerabilities Article
- Bleeping Computer: Apple Zero-Day Vulnerabilities Article