Apple patches exploited iOS and macOS WebKit flaws

iPhone, iPad, Apple Watch users may have been subject to arbitrary code execution

Apple has released security updates addressing zero-day vulnerabilities in its WebKit browser engine, which is primarily used in Safari and any other web browsers available on iOS, as well as Apple Mail and the App Store.

The two vulnerabilities, known as CVE-2021-30665 and CVE-2021-30663, allowed hackers to execute arbitrary remote code execution (RCE) on any device that had visited a malicious website.

CVE-2021-30665 had been reported by Beijing-based security researcher Yang Kang and Bian Liang, who is reportedly a researcher for antivirus provider Qihoo 360 ATA. The researcher who had discovered CVE-2021-30663 opted to remain anonymous.

Devices that may have been exploited by the two bugs include iPhone 6s and later, all models of iPad Pro, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, the 7th generation iPod touch, as well as the Apple Watch Series 3 and later.

The security updates iOS 14.5.1 and iPadOS 14.5.1 were released on Monday to remedy the issues, which Apple described as “a memory corruption issue” and “an integer overflow”, which were “addressed with improved state management”.

The latest security update is also a fix for issues with Apple’s new App Tracking Transparency (ATT), which was released with iOS 14.5.

Related Resource

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

cost of a data breach report 2020 - whitepaper from IBMDownload now

"This update fixes an issue with App Tracking Transparency where some users who previously disabled Allow Apps to Request to Track in Settings may not receive prompts from apps after re-enabling it," Apple stated in its iOS 14.5.1 release notes.

Apple also released an update for macOS Big Sur, labelled 11.3.1.

All three security updates were described as remedies to CVE-2021-30663 and CVE-2021-30665, with the tech giant stating that it “is aware of a report that this issue may have been actively exploited”.

However, the scope of the issue, as well as the number of affected users was not made publicly available. IT Pro has contacted Apple for comment and will update this story when more information becomes available.

The new security updates come just days after iOS 14.5, released on 27 April, which removed default data tracking and made it a requirement for app developers to present users with a pop-up notification asking them to consent to be tracked.

In the months coming up to the release of iOS 14.5, Facebook publicly campaigned against this decision, arguing that it would severely harm the revenues of its advertising partners, many of which are smaller companies.

Featured Resources

How to be an MSP: Seven steps to success

Building your business from the ground up

Download now

The smart buyer’s guide to flash

Find out whether flash storage is right for your business

Download now

How MSPs build outperforming sales teams

The definitive guide to sales

Download now

The business guide to ransomware

Everything you need to know to keep your company afloat

Download now

Recommended

New report highlights the need for diversity in cyber security recruitment
cyber security

New report highlights the need for diversity in cyber security recruitment

28 Apr 2021
Apple doubles down in the US with $430 billion investment
business intelligence (BI)

Apple doubles down in the US with $430 billion investment

27 Apr 2021
Tech giants lobby US to fund chip production
Hardware

Tech giants lobby US to fund chip production

11 May 2021
Apple faces UK class-action over "excessive" App Store charges
Policy & legislation

Apple faces UK class-action over "excessive" App Store charges

11 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021