After Apple and Google, Mozilla has also released patches for an image processing-related zero-day vulnerability that has been exploited to deliver spyware.
The existence of a new zero-day came to light on September 7, when Apple announced iOS and macOS updates to patch an exploited vulnerability tracked as CVE-2023-41064. The tech giant described the zero-day as a buffer overflow in the ImageIO component that can be exploited for arbitrary code execution using specially crafted images.
On the same day, the Citizen Lab group at the University of Torontoʼs Munk School reported that the vulnerability is part of a new zero-click exploit dubbed BlastPass that has been used to target iPhones running the latest version of iOS.
Citizen Lab said the exploit, which had been used to deliver the NSO Group’s notorious Pegasus spyware via malicious images sent through iMessage, targeted an employee at a “Washington DC-based civil society organization with international offices”.
On September 11, Google also announced Chrome updates to patch a critical zero-day vulnerability whose existence was reported by Apple and Citizen Lab. Google, which tracks the flaw as CVE-2023-4863, said the issue impacts the WebP component used by its web browser.
WebP, an image format developed by Google, is offered as an alternative to JPEG, PNG and GIF. The significantly smaller size of WebP images results in web pages loading much faster.
The WebP format is also supported by Mozilla’s Firefox web browser, as well as its Thunderbird email client, and the organization on Tuesday announced releasing updates that should patch the zero-day. In the case of Firefox and Thunderbird, the vulnerability is in the libwebp component. Just like Google, Mozilla tracks the zero-day as CVE-2023-4863.
Apple initially released patches for the zero-day on September 7, but only for the latest versions of iOS and macOS. On September 11, the company rolled out fixes for older versions of its operating systems, including for Macs (Monterey and Big Sur), and iPhones and iPads.
The zero-day appears to have only been exploited in targeted attacks for now, but given the widespread use of the affected image-processing component, millions of users could be at risk.
StackDiary provides a technical analysis of the vulnerability based on the patch.
Related: Google Links More iOS, Android Zero-Day Exploits to Spyware Vendors
Related: US to Adopt New Restrictions on Using Commercial Spyware
Related: Details Emerge on Israeli Spyware Vendor QuaDream and Its iOS Malware