https://pwn.watch/t/pegasus Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 11 Sep 2023 00:00:00 GMT https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061 https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061 Mon, 11 Sep 2023 00:00:00 GMT high <p>Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> iOS 16.6.1 and iPadOS 16.6.1, iOS 15.7.9 and iPadOS 15.7.9, macOS Ventura 13.5.2, macOS Monterey 12.6.9, macOS Big Sur 11.7.10, watchOS 9.6.2</p> <p><strong>Latest updates:</strong></p><ul><li>2023-09-11: CISA adds both CVEs to the KEV catalog</li><li>2023-09-07: Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates (<a href="https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-41064, CVE-2023-41061</p>