Today, Apple has released security updates that fix two actively exploited iOS zero-day vulnerabilities in the Webkit engine used by hackers to attack iPhones, iPads, iPods, macOS, and Apple Watch devices.
"Apple is aware of a report that this issue may have been actively exploited," the company said in multiple security advisories published today.
Webkit is Apple's browser rendering engine that is required to be used by all mobile web browsers in iOS and other applications that render HTML, such as Apple Mail and the App Store.
These vulnerabilities are tracked as CVE-2021-30665 and CVE-2021-30663, and both allow arbitrary remote code execution (RCE) on vulnerable devices simply by visiting a malicious website.
RCE vulnerabilities are considered the most dangerous as they allow attackers to target vulnerable devices and execute commands on them remotely.
CVE-2021-30665 was discovered by Yang Kang, zerokeeper, and Bian Liang of Qihoo 360 ATA, while CVE-2021-30663 was reported to Apple by a researcher who wishes to remain anonymous.
The list of affected devices includes:
iOS 14.5.1 update
This update also resolved a bug that prevented users from seeing App Tracking Transparency prompts within apps.
"This update fixes an issue with App Tracking Transparency where some users who previously disabled Allow Apps to Request to Track in Settings may not receive prompts from apps after re-enabling it," stated Apple in their iOS 14.5.1 release notes.
Apple has been dealing with a stream of actively exploited zero-day vulnerabilities over the past few months, with one fixed in macOS last month and numerous other iOS vulnerabilities fixed in the previous months.
"Apple is aware of a report that this issue may have been actively exploited," the company said in multiple security advisories published today.
Webkit is Apple's browser rendering engine that is required to be used by all mobile web browsers in iOS and other applications that render HTML, such as Apple Mail and the App Store.
These vulnerabilities are tracked as CVE-2021-30665 and CVE-2021-30663, and both allow arbitrary remote code execution (RCE) on vulnerable devices simply by visiting a malicious website.
RCE vulnerabilities are considered the most dangerous as they allow attackers to target vulnerable devices and execute commands on them remotely.
CVE-2021-30665 was discovered by Yang Kang, zerokeeper, and Bian Liang of Qihoo 360 ATA, while CVE-2021-30663 was reported to Apple by a researcher who wishes to remain anonymous.
The list of affected devices includes:
- iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
- macOS Big Sur
- Apple Watch Series 3 and later
This update also resolved a bug that prevented users from seeing App Tracking Transparency prompts within apps.
"This update fixes an issue with App Tracking Transparency where some users who previously disabled Allow Apps to Request to Track in Settings may not receive prompts from apps after re-enabling it," stated Apple in their iOS 14.5.1 release notes.
Apple has been dealing with a stream of actively exploited zero-day vulnerabilities over the past few months, with one fixed in macOS last month and numerous other iOS vulnerabilities fixed in the previous months.
