Apple addresses a new zero-day exploited to deploy the NSO Pegasus spyware

Apple has addressed three zero-day vulnerabilities exploited by threat actors in attacks in the wild to take over iPhones and Macs.

Apple has released security updates to address three zero-day vulnerabilities exploited in attacks in the wild to compromise iPhones and Macs running vulnerable iOS and macOS versions.

Apple confirmed that at least one of the flaws was exploited by threat actors to infect the device with the NSO Pegasus spyware.

The list of impacted devices includes iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch running iOS 12.5.5, and Macs with Security Update 2021-006 Catalina.

The flaw, tracked as CVE-2021-30860, is an integer overflow in the CoreGraphics framework that could lead to arbitrary code execution by processing a maliciously crafted PDF. The flaw was reported by researchers from Citizen Lab.

The other zero-day flaws addressed by Apple are a use after free issue in the WebKit, tracked as CVE-2021-30858, and a type confusion issue in the XNU operating system kernel, tracked as CVE-2021-30869.

The CVE-2021-30860 flaw can be triggered to execute arbitrary code by processing a maliciously crafted PDF. The CVE-2021-30858 vulnerability can be triggered to execute arbitrary code by processing maliciously crafted web content. 

Below are the advisories published by Apple:

Early this month, Apple addressed two zero-days flaws, one of which was exploited to deliver the Pegasus spyware on iPhones.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, zero-day)