Apple Patches Zero-Days in iOS 14.8 Update

Apple today released security updates for iOS, iPadOS, macOS, and watchOS to deliver an important security update to fix two vulnerabilities that the company says "may have been actively exploited."

CVE-2021-30860 is a vulnerability in CoreGraphics. A patch is available for iPhone 6s and later, all models of the iPad Pro, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and the 7th generation iPod touch. Security updates are also available for macOS Big Sur 11.6 and watchOS 7.6.2, and there is a Security Update 2021-005 for macOS Catalina.

"Processing a maliciously crafted PDF may lead to arbitrary code execution," Apple says of the flaw, noting it is aware of reports that the vulnerability may have been actively exploited.

The vulnerability was discovered by Citizen Lab, which reported in August that it found zero-click exploits targeting Bahrani activists. Researchers have now shared new details on what they call the ForcedEntry flaw, which was used to push the NSO Group's Pegasus spyware onto devices and bypassed Apple's Blastdoor protection, introduced in earlier versions of iOS 14.

In a new blog post on the vulnerability, Citizen Lab says ForcedEntry was found on a Saudi activist's phone infected with Pegasus. The zero-day, zero-click exploit targets CoreGraphics, Apple's image rendering library, and was effective against iOS, macOS, and watchOS devices, researchers report. They believe ForcedEntry has been in use since at least February 2021.

Apple has also released a patch for CVE-2021-30858, a vulnerability in WebKit affecting iPhone 6 and later, all models of iPad Pro, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and the 7th generation iPod touch.

"Processing maliciously crafted web content may lead to arbitrary code execution," Apple writes in the comments. "Apple is aware of a report that this issue may have been actively exploited." The company credits an anonymous researcher with finding the vulnerability.

Read Apple's update notes for more details.