Apple Patches Zero-Days in iOS, Known Vuln in macOS

Apple today released security updates for three vulnerabilities in iOS and one flaw in macOS Catalina. Two of the iOS flaws may have been actively exploited, while exploits for the third iOS bug and macOS flaw exist in the wild.

iOS is affected by CVE-2021-30860, a vulnerability in CoreGraphics that could lead to arbitrary code execution if a maliciously crafted PDF is processed. Apple is aware of reports that the flaw, discovered by Citizen Lab, may have been actively exploited.

WebKit vulnerability CVE-2021-30858 may lead to arbitrary code execution if maliciously crafted Web content is processed. Reports indicate this may have also been actively exploited.

CVE-2021-30869 exists in XNU, which is part of the Darwin operating system used in macOS and iOS. If exploited, the vulnerability could allow a malicious application to execute arbitrary code with kernel privileges. The flaw was discovered by Erye Hernandez and Clément Lecigne of Google's Threat Analysis Group, along with Ian Beer of Google's Project Zero. This flaw also exists in macOS Catalina.

Security updates are available in iOS 12.5.5 and Security Update 2021-006 Catalina.

Read more in Apple's iOS and macOS updates.