San Francisco-based cybersecurity company ZecOps today announced that it has uncovered two zero-day security vulnerabilities affecting Apple's stock Mail app on iOS devices, as noted by Motherboard and The Wall Street Journal.
/article-new/2020/04/mail-ios-app-icon.png?lossy){kind=icon}
ZecOps claims that one of the vulnerabilities enables an attacker to remotely infect an iOS device by sending emails that consume a significant amount of memory, while another could allow remote code execution capabilities. Successful exploitation of the vulnerabilities is said to allow an attacker to leak, modify, and delete a user's emails.
Targets of the vulnerabilities have apparently included corporate executives and government officials rather than average end users.
The vulnerabilities are said to impact all software versions between iOS 6 and iOS 13.4.1. ZecOps said that Apple has patched the vulnerabilities in the latest beta of iOS 13.4.5, which should be publicly released within the coming weeks. In the meantime, ZecOps recommends using a third-party email app like Gmail or Outlook, which are apparently not impacted.
Top Rated Comments
I stopped reading there...ZecOps recommends using a third-party email app like Gmail
My guess is Apple will roll this into ios 12, when ios 13.4.5 is released.I guess everyone with devices that can't run iOS 13 need to just buy new hardware.
/s
Except that the cat was already out of the bag: they were already being exploited, for years. ZecOps found them by investigating the aftermath of successful attacks.How considerate of them to tell Apple first and allow it to be patched before publicly disclosing it.
/s