5 ms·

https://support.apple.com/en-us/HT213414 https://support.apple.com/en-us/HT213414

• testplzignore 4y ago
  And the other advisories: https://support.apple.com/en-us/HT213412 https://support.apple.com/en-us/HT213412 https://support.apple.com/en-us/HT213413 https://support.apple.com/en-us/HT213413
• kossTKR 4y ago
  "Processing maliciously crafted web content may lead to arbitrary code execution. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited." Sounds pretty serious, has active exploitation like this happened before in the Apple ecosystem or is this like most zerodays; edge cases and state level exploits that don't target broadly?
  • clint 4y ago
    I have no hard data, but having looked at the security content of a lot of these over the years I'd wager WebKit has serious issues like this crop up more than any other component in iOS.
• googlryas 4y ago
  I'm curious if Lockdown mode would prevent this exploit? From Apple's Lockdown site, it's hard to tell the extent of what is locked down. > Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode This is allegedly the fix for this exploit for webkit: https://github.com/WebKit/WebKit/pull/3023 https://github.com/WebKit/WebKit/pull/3023, it appears to at least somewhat related to the JIT, but I don't know enough about the exploit, or webkit to make that determination.