Apple patches two iOS zero-days in old-gen devices
Catalin Cimpanu June 14, 2021

Apple patches two iOS zero-days in old-gen devices

Apple patches two iOS zero-days in old-gen devices

Apple has released today security updates to address two zero-day vulnerabilities that were exploited in the wild to hack older generation iPhones and iPads.

Both vulnerabilities, tracked as CVE-2021-30761 and CVE-2021-30762, reside in WebKit, the browser engine used by Safari, and the component used by all iOS apps to load web content.

Apple said it received reports from anonymous researchers that threat actors had exploited the two bugs to run malicious code on users’ devices when the WebKit engine loaded and processed maliciously crafted web content.

The Cupertino-based company released today iOS 12.5.4 to patch both issues.

The update is intended for old-gen devices such as the iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation), Apple said.

The two zero-days patched today mark the 8th and 9th actively-exploited zero-days patched in Apple products this year. Previous zero-days included:

CVEPatch dateDescription
CVE-2021-1782February 1A zero-day impacting the macOS, iOS, iPadOS, watchOS, and tvOS kernels.
CVE-2021-1870February 1WebKit zero-day impacting macOS, iOS, iPadOS, and watchOS
CVE-2021-1871February 1WebKit zero-day impacting macOS, iOS, iPadOS, and watchOS
CVE-2021-1879March 26WebKit bug impacting both old and new-gen iOS, iPadOS, and watchOS
CVE-2021-30657April 26macOS Gatekeeper bypass abused by Shlayer malware
CVE-2021-30661April 26WebKit zero-day impacting old and new-gen iOS, iPadOS, watchOS, and tvOS.
CVE-2021-30663May 3WebKit zero-day impacting macOS, iOS, iPadOS, and watchOS
CVE-2021-30665May 3WebKit zero-day impacting macOS, iOS, iPadOS, and watchOS
CVE-2021-30666May 3WebKit zero-day impacting macOS, iOS, iPadOS, and watchOS
CVE-2021-30713May 24macOS TCC bypass abused by XCSSET malware
CVE-2021-30761June 14WebKit zero-day impacting old-gen iOS devices
CVE-2021-30762June 14WebKit zero-day impacting old-gen iOS devices

Catalin Cimpanu is a cybersecurity reporter for The Record. He previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.