https://pwn.watch/t/kaspersky Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 27 Dec 2023 00:00:00 GMT https://pwn.watch/i/operation-triangulation-ios-zero-click-2023 https://pwn.watch/i/operation-triangulation-ios-zero-click-2023 Wed, 27 Dec 2023 00:00:00 GMT high <p>Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD), CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD), CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)</p> <p><strong>Latest updates:</strong></p><ul><li>2023-12-27: At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606 (<a href="https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/">source</a>)</li><li>2023-07-24: Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26 (<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-38606">source</a>)</li><li>2023-06-21: Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23 (<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-32434">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-32434, CVE-2023-32435, CVE-2023-38606</p>