Title: iOS, macOS, Catalina, CoreGraphics, WebKit: Apple Addresses Two Security Flaws Used by Autocratic Governments to Spy on Human Rights Advocates

Apple has issued security patches for its mobile and desktop operating systems, as well as its WebKit browser engine, to address two security flaws that were reportedly used by autocratic governments to spy on human rights advocates.

According to a report from the University of Toronto's Citizen Lab, one of the bugs, CVE-2021-30860, resides in Apple's CoreGraphics framework and is an integer overflow that allows a malicious PDF file to achieve arbitrary code execution. This vulnerability has been confirmed to be actively exploited by autocratic governments, specifically targeting human rights activists.

The other bug affects WebKit-based Safari on macOS Catalina (10.15) and Mojave (10.14), allowing attackers to execute arbitrary code. Apple released updated versions of Safari 14.1.2 for these operating systems, with Catalina also receiving a supplemental fix.

In addition to the security patches, Apple has also issued updates for iOS 14.8 and iPadOS 14.8, watchOS 7.6.2, and macOS Big Sur 11.6.

The Citizen Lab report highlights the issue of spyware being used against human rights advocates, particularly in Bahrain. The researchers found that the iPhones of nine Bahraini activists had been hacked between June 2020 and February 2021 using NSO Group's Pegasus spyware and two zero-click iMessage exploits.

Apple has acknowledged the report and stated that it is aware of a possible exploitation of the issue. However, the company did not provide further details on the matter.

In light of these findings, it is essential for users to ensure they have installed the latest security patches and updates for their devices to prevent potential exploitation by malicious actors.

Ios macos catalina coregraphics webkit