By Deeba Ahmed
Another day, another crypto hack making cybercriminals multi-millionaires in no time, while leaving unsuspecting crypto investors without funds.…
This is a post from HackRead.com Read the original post: Mixin Network Halts Services After $200M Crypto Hack

Another day, another crypto hack making cybercriminals multi-millionaires in no time, while leaving unsuspecting crypto investors without funds.

Mixin Network has temporarily suspended its deposit and withdrawal services after cybercriminals targeted the decentralized wallet service. The network, reportedly, has lost $200 million in funds.

Mixin is a Hong Kong-based crypto firm that offers layer-2 protocol-like service to encourage cheaper and more efficient cross-chain transfers.

The network posted its announcement on X (formerly Twitter), stating that on September 23, 2023, its cloud service provider’s database was hacked early Saturday morning, resulting in a loss of approx. US$200 million.

“In the early morning of September 23…the database of Mixin Network’s cloud service provider was attacked by hackers, resulting in the loss of some assets on the mainnet. The funds involved are approximately US$200 million,” Mixin Network’s post on X read.

The network’s token, XIN, fell considerably (around 8% down) after this confirmation. According to its website, Mixin Network attracts 100,000 daily users and has over $1 billion in assets. Moreover, the network reported 663,489 unique transactions of BTC and 179,647 of ETH during July.

Mixin Network contacted blockchain security firm SlowMist and Google to launch an investigation into the hacking. It will reopen the services after confirming that the vulnerabilities are fixed.

However, the network explained that transfers will remain unaffected during this time. The vulnerability was disclosed today by Mixin Network founder Feng Xiaodong in a livestream in which he explained that they can only confirm that half of the assets are at least safe.

“We will try our best to minimize the losses and deeply apologize for this,” the network stated while assuring its users to provide a solution regarding what it intends to do about their lost assets.

SlowMist also posted a statement to confirm the attack on the cloud service provider: “🚨SlowMist Security Alert🚨 – On September 23, the Mixin Network cloud service provider database was attacked, and the amount of funds involved was ~ $200M. SlowMist is assisting in the investigation. Please wait for @MixinKernel updates for more information.”

Chainalysis, a leading blockchain data platform, has found that in 2022 alone, $3.8 billion worth of cryptocurrency was stolen, making it the worst year ever for the community.

Recently, Hackread reported the hacking of the world’s largest Australian cryptocurrency casino, Stake, which lost $41 million worth of cryptocurrency. The incident happened on September 4, 2023, and was caused due to a leaked private key.

****RELATED ARTICLES****

1.  6 of the Best Crypto Bug Bounty Programs
2.  We Need Smarter Smart Contracts To Prevent DeFi Hacks
3.  ETH Founder Vitalik Buterin’s X (Twitter) Hacked, $700k Stolen
4.  NY Couple Pleads Guilty to $4.5B Bitcoin Theft in Bitfinex Hack
5.  Billionaire Mark Cuban Falls Victim to Crypto Hack, Loses $900K

Mixin Network Halts Services After $200M Crypto Hack

Apple Security Advisory 2023-09-21-7 - macOS Monterey 12.7 addresses a privilege escalation vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-2023-09-21-7 macOS Monterey 12.7

macOS Monterey 12.7 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213932.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

Additional CVE entries coming soon.

Kernel  
Available for: macOS Monterey  
Impact: A local attacker may be able to elevate their privileges. Apple  
is aware of a report that this issue may have been actively exploited  
against versions of iOS before iOS 16.7.  
Description: The issue was addressed with improved checks.  
CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Additional recognition

Kernel  
We would like to acknowledge Bill Marczak of The Citizen Lab at The  
University of Toronto's Munk School and Maddie Stone of Google's Threat  
Analysis Group for their assistance.

macOS Monterey 12.7 may be obtained from the Mac App Store or Apple's  
Software Downloads web site: https://support.apple.com/downloads/  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUMi+UACgkQX+5d1TXa  
Ivodjg/+Lz5oU3oZFmJoiYgTRKvcCVcRb/u8ioWsOxB0ZZQ1Z7o/KCi/ccV09fRy  
zbt72qAzpjseCcfq46hgy+zIuKgbOdXvUJZEOywZuWmPy540sB7YDm/BsinP7ESA  
XTlh1BnKL6kboXMZ0zurdW1kzAMqLjxYp/ku5ySSCG8YWwtjgvmYM7fjoRhj7/rp  
If5mmHkTdlEvRL1OZni3kmP5uMyAAQ5kB/LOwE5euqFJb5mtgAZaXPGZe2UPIaWw  
mHTI3SwyGtEcehuOBi3jArJMI3r/k4qYfOpK5Z3rwJrffdK6ztCMgePKfF7IuWS+  
VRgCnhyL7eu2THyK03m4VwzyuYuUDLYXkFDmEE4K5ymedSjjFaZpF27SOVYGD6G9  
oGoxnJ8k55Ldy6El/caiKb2YNgMD5KPsCCvZRim3o+ADl1E2q5TfU5d9nnG6DPXP  
ZXDb4Q/IQRTlKhunJ6cDA7ZRkQ53A9vIECxHLCeOIC6VALib++8TvdKrjbm2r09d  
1fhMFeSiE3Nak2RwHWHAjNCfL/enIwpGM9kiRZK1QHFCbDm7JM7d5rNW9FLgXXv+  
PlhL3CRgmE2iGDZZJpZavyGcSGqewLmeWAn/gWhzwGRBilKiMpAGPLQlAPd6YOA8  
6p366vYRJ1cITlIJ6KzYhGLrah4iYFErzyyfK8cZy6ajJFJZ01g=  
=nhhn  
-----END PGP SIGNATURE-----

Apple Security Advisory 2023-09-21-7

Apple Security Advisory 2023-09-21-6 - macOS Ventura 13.6 addresses bypass vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-2023-09-21-6 macOS Ventura 13.6

macOS Ventura 13.6 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213931.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

Additional CVE entries coming soon.

Kernel  
Available for: macOS Ventura  
Impact: A local attacker may be able to elevate their privileges. Apple  
is aware of a report that this issue may have been actively exploited  
against versions of iOS before iOS 16.7.  
Description: The issue was addressed with improved checks.  
CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Security  
Available for: macOS Ventura  
Impact: A malicious app may be able to bypass signature  
validation. Apple is aware of a report that this issue may have been  
actively exploited against versions of iOS before iOS 16.7.  
Description: A certificate validation issue was addressed.  
CVE-2023-41991: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

WebKit  
Available for: macOS Ventura  
Impact: Processing web content may lead to arbitrary code  
execution. Apple is aware of a report that this issue may have been  
actively exploited against versions of iOS before iOS 16.7.  
Description: The issue was addressed with improved checks.  
WebKit Bugzilla: 261544  
CVE-2023-41993: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Additional recognition

Kernel  
We would like to acknowledge Bill Marczak of The Citizen Lab at The  
University of Toronto's Munk School and Maddie Stone of Google's Threat  
Analysis Group for their assistance.

macOS Ventura 13.6 may be obtained from the Mac App Store or Apple's  
Software Downloads web site: https://support.apple.com/downloads/  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUMi+UACgkQX+5d1TXa  
IvpVCQ/+PH+bewmpAxIP9LKpZWkBLgiRwd7BnB1GuqC3IjjQebkqq1mBKM9J5aVV  
iNrGOIccwxHKofbcwHda2upOkUOGV7zdi4iO5TV1TgsZoM1HCfkQ/laKMtyEPZj7  
jdOSpR0kr9E1xUN/muIgir3Acy3SHmqq+6tp5JtaIdTV2WvG/w0LSU8bHmroNhB8  
tRWml3mUV9i9HG+kDT+q+bYNdDs7GO1eTAQyOvB6X+pSBVQiClp8r9PbQAPvMw41  
QZQsZGHF1/Oq1A/6FZlBdwgPvqsKyhSsK9HzVgDPuCftdYBCbf7XJ/QkIRi5udrX  
YKuWwYyTjtaDaokPEbQtlw8R60ZL2ecyaF2u8wuhx1m5v2hq6OM3vZemeNgBVmtB  
7TdimeKzvl+IY1gmo34hkHGJ8ILTUExHD+0VhRBsYXYi9cNpV+S2HFUbqkeGtCRL  
fDMaz6jZo8o9WQ69aYLC1Vqn6xwQxUH6+XS8JOzoTfHBtQgJFZ9r9kt/vJlrdCLu  
aFSfU6sdfXcI7aBlTyL+PNF0M5S+P2i6oEqJUnLhMpnD0ESeNZSOr4wfNwNW21/3  
2DtBbdzNXZ7+c2+Ds8xcOXLwHQlLfsD+u5GHbOr5X97PG59OA3GSmumEdn0DFCdJ  
q+VBu5otgp+DIFJ/xsen4pURqRsw17/aOAzyGguoVJ306SRD2Bo=  
=9eKC  
-----END PGP SIGNATURE-----

Apple Security Advisory 2023-09-21-6

Apple Security Advisory 2023-09-21-5 - watchOS 9.6.3 addresses bypass vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-2023-09-21-5 watchOS 9.6.3

watchOS 9.6.3 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213929.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

Kernel  
Available for: Apple Watch Series 4 and later  
Impact: A local attacker may be able to elevate their privileges. Apple  
is aware of a report that this issue may have been actively exploited  
against versions of iOS before iOS 16.7.  
Description: The issue was addressed with improved checks.  
CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Security  
Available for: Apple Watch Series 4 and later  
Impact: A malicious app may be able to bypass signature  
validation. Apple is aware of a report that this issue may have been  
actively exploited against versions of iOS before iOS 16.7.  
Description: A certificate validation issue was addressed.  
CVE-2023-41991: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUMi+QACgkQX+5d1TXa  
IvqEKBAAot3koiHF8bV334s7cFZFe+xUGkFszWH7XR/73NCyKVRJaxjfgHkcJUPZ  
qiEgALnau3mEFagwLu2+hIEJKZLCF5nU7uf0tQOBOjWL/ZUk9DXStAahkBWmom9/  
7mGxRqiEPPduJ8jU3BbxVqbwo3IiNhww8o2bS15o/ByhBopvCtIgJFKVPdWOlnHV  
og85okHBa7uOKzwXIdERl62UuAG6swGc8iTdhDxgrlCqDNQPKTT8Re/+Dzv2htlI  
UI38gp/3wFLhQArmgzIbrU6WLMnMRPn+M/juT1AjuFLY1JkdGd/y+uEmNg/rU8tF  
b4ptEbbuR5mNxhcyx0RIn18pHOv7MV/hYRNtXzCkEH5bxAIlPMFLTRWs8OsqlBlQ  
t4lDnf/u0I50W5F3Bf6BpN4lAJaHFej1vNQtz0CN1sXocBj3LUlWFjK5lFXymWUc  
qKt+1xwXBraDuNGabZua5cZpMXNUL8wAjVv1uZOjmvdB1jHN6FVfyu9oc2ONH+p+  
UigbKwLFqlRjJ/8ee2UhNQFwkXf8wDIud/U0kuftu3xtLFJjZsiFJLBUDQ2XQl7z  
eXDvLYdq6Jvo3qiW2AuUGzVLiw4IDSUZk4U3b8ER37/SEFFOEXEJ05uzwMinYYmD  
qTWm/89O74yzgF6HPKigfzNqePZ4eButFer73hndgja9WvYxSCg=  
=4meq  
-----END PGP SIGNATURE-----

Apple Security Advisory 2023-09-21-5

Apple Security Advisory 2023-09-21-4 - watchOS 10.0.1 addresses bypass vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-2023-09-21-4 watchOS 10.0.1

watchOS 10.0.1 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213928.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

Kernel  
Available for: Apple Watch Series 4 and later  
Impact: A local attacker may be able to elevate their privileges. Apple  
is aware of a report that this issue may have been actively exploited  
against versions of iOS before iOS 16.7.  
Description: The issue was addressed with improved checks.  
CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Security  
Available for: Apple Watch Series 4 and later  
Impact: A malicious app may be able to bypass signature  
validation. Apple is aware of a report that this issue may have been  
actively exploited against versions of iOS before iOS 16.7.  
Description: A certificate validation issue was addressed.  
CVE-2023-41991: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Instructions on how to update your Apple Watch software are available  
at https://support.apple.com/kb/HT204641  To check the version on  
your Apple Watch, open the Apple Watch app on your iPhone and select  
"My Watch > General > About".  Alternatively, on your watch, select  
"My Watch > General > About".  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUMi+QACgkQX+5d1TXa  
Ivrolg//eCfa6uj7rYz+BwmO2KTNLG+gAn+NZ9hnFb/txI8aoIwYc5rxDM8ektDP  
itxupK30fcz3cG3fdWazD8YQ16Q7nN9KgU1alLELMZCgBI9K9osMGHzwzCepF1bJ  
gaIt6e/DT6nEruNbtR9DOvZYFK0bBaM+Iar6GZ9NgSP8KwXZjRgCUBtaYuKEu2z4  
K3xic4l0iKbV6T+Wb2hoinsRYjD5vf85q/6qcufRzUdBzpCyy6jEmMZs0CKnCef7  
joEtz1tCVOydrydWXDNrmVXm5BLjBp4Fo3+i5O+zXXJvOaFdvHsbZ9IXmdMR2Zrz  
YY7XxCawuRopfTAsNmnl8dYGGA2u9hSNmxienTCReYfF2gY6QG9tUpnS6TYkv1+3  
HT/W5or4HLlVQvG4M+6ZOLIL/RlCBlnJBP7L78FYQW/0650FU6Xq3UoeQIx5LBf2  
xtz4Dk/Dd/hF0dpGgRtg/Qw1ZqMZbwSgM4Z9yNOT1BnDWKgPyyl4Cg8D50ua4jyH  
eGXUOQhM8hUoaIYjyNe2HM44tW3zZue/eXdu2xLL0LqwBWu4nEZBoyXHJLZHCtYq  
W3KFBpcK3xgXujoknsu+X4Lq/oKH9SdPVmExkIZ/3Ga+8W2pYS3vIhRglt/Cuiis  
xezTX8F3NjxIIztlBwlIgIGcdhb3pFRm7YqMwXykxOIpevPAyRM=  
=zsee  
-----END PGP SIGNATURE-----

Apple Security Advisory 2023-09-21-4

LogoBee CMS version 0.2 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : LogoBee CMS v0.2 XSS Vulnerability                                                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://logobee.com                                                                                                |  | # Dork      : intext:''Logo & Web Design by LogoBee''                                                                            |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : /updates.php?id=<marquee><font color=lime size=32>Hacked by indoushka</font></marquee>[+]  http://vaxform127.0.0.1/updates.php?id=%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

LogoBee CMS 0.2 Cross Site Scripting

Lamano LMS version 0.1 suffers from an ignored default credential vulnerability.

    ====================================================================================================================================| # Title     : Lamano LMS v0.1 Insecure Settings Vulnerability                                                                    || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : http://www.lamano.lu/                                                                                              |  | # Dork      :  © 2018 Lamano by easysolutions                                                                                    |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Insecure Settings : appears to leave a default administrative account in place post installation.[+] Use payload : user = admin & Pass : 1234[+] https://www.sylviebecker127.0.0.1luGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Lamano LMS 0.1 Insecure Settings

Apple Security Advisory 2023-09-21-3 - iOS 16.7 and iPadOS 16.7 addresses bypass vulnerabilities.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7iOS 16.7 and iPadOS 16.7 addresses the following issues.Information about the security content is also available athttps://support.apple.com/kb/HT213927.Apple maintains a Security Updates page athttps://support.apple.com/HT201222 which lists recentsoftware updates with security advisories.Additional CVE entries coming soon.KernelAvailable for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rdgeneration and later, iPad 5th generation and later, and iPad mini 5thgeneration and laterImpact: A local attacker may be able to elevate their privileges. Appleis aware of a report that this issue may have been actively exploitedagainst versions of iOS before iOS 16.7.Description: The issue was addressed with improved checks.CVE-2023-41992: Bill Marczak of The Citizen Lab at The University ofToronto's Munk School and Maddie Stone of Google's Threat Analysis GroupSecurityAvailable for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rdgeneration and later, iPad 5th generation and later, and iPad mini 5thgeneration and laterImpact: A malicious app may be able to bypass signaturevalidation. Apple is aware of a report that this issue may have beenactively exploited against versions of iOS before iOS 16.7.Description: A certificate validation issue was addressed.CVE-2023-41991: Bill Marczak of The Citizen Lab at The University ofToronto's Munk School and Maddie Stone of Google's Threat Analysis GroupWebKitAvailable for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rdgeneration and later, iPad 5th generation and later, and iPad mini 5thgeneration and laterImpact: Processing web content may lead to arbitrary codeexecution. Apple is aware of a report that this issue may have beenactively exploited against versions of iOS before iOS 16.7.Description: The issue was addressed with improved checks.WebKit Bugzilla: 261544CVE-2023-41993: Bill Marczak of The Citizen Lab at The University ofToronto's Munk School and Maddie Stone of Google's Threat Analysis GroupAdditional recognitionKernelWe would like to acknowledge Bill Marczak of The Citizen Lab at TheUniversity of Toronto's Munk School and Maddie Stone of Google's ThreatAnalysis Group for their assistance.This update is available through iTunes and Software Update on youriOS device, and will not appear in your computer's Software Updateapplication, or in the Apple Downloads site. Make sure you have anInternet connection and have installed the latest version of iTunesfrom https://www.apple.com/itunes/  iTunes and Software Update on thedevice will automatically check Apple's update server on its weeklyschedule. When an update is detected, it is downloaded and the optionto be installed is presented to the user when the iOS device isdocked. We recommend applying the update immediately if possible.Selecting Don't Install will present the option the next time youconnect your iOS device.  The automatic update process may take up toa week depending on the day that iTunes or the device checks forupdates. You may manually obtain the update via the Check for Updatesbutton within iTunes, or the Software Update on your device.  Tocheck that the iPhone, iPod touch, or iPad has been updated:  *Navigate to Settings * Select General * Select About. The versionafter applying this update will be "iOS 16.7 and iPadOS 16.7".All information is also posted on the Apple Security Updatesweb site: https://support.apple.com/en-us/HT201222.This message is signed with Apple's Product Security PGP key,and details are available at:https://www.apple.com/support/security/pgp/-----BEGIN PGP SIGNATURE-----iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUMi+MACgkQX+5d1TXaIvqDVA//ViOiBbSSAlFO6+SkMIWoXJvV+5lQktWubXwtiDkC2gXrxFazBMrGOmzz1ELGkLVPGbgPR0nt5C2VrmFWEQ6U4HGf8K1RTIniqqSVHuVZeoQ8JGobIEItgj0/NYws3BtdZKaYJtW9imdMBgjk9pFsqYvw14yNxxScaUz1zmOjdbslQSkYIMqYp5Er2ION56ZLVvTfNs70RsZ3k/8S+2FFR1UQR0kfXrGZg7vmeaEw0XPW7NZGjLDiDTxW/Ro2lfl/7jLMH7gy5IeHTJw0TsZZlkCgQ0EllJ3UPuptpr9EiNgs26bJLGjv8Hjl1Mp1/uzkPhdNLcN8UghgCrQNHuMb9P69DcHahOAuACCPWO09eoQay2+ZmMR+Ec7HKUmVEnjCJ7I4crIY93c8zXdkrFp06kwcLOUo7JzVy7WWAn302wGKnNW1G/q7FXNSbGnWs/mQMWXfB3eeLT7atU39RmCQgLNopfQuJfgImTYiSYhVB1xBt0sKnP9OfT2RKlWO4+7Igs9UzcNkbNnDjkJGGtZuQNG1njUHDRaePpC8YnesQ5Xo3mUAdEKKDjfsvgvy/xZXLggpwj1Vo5RrRsceiWEjjffCsRJaBEx/R03dv4JUkm3VT/dRFWEntroGZ+lvhgKjvKUszZ9/ztER3Yfw9FvptRwznshof/KYt+IKAVwnQOQ==oY3a-----END PGP SIGNATURE-----

Apple Security Advisory 2023-09-21-3

Apple Security Advisory 2023-09-21-2 - iOS 17.0.1 and iPadOS 17.0.1 addresses bypass vulnerabilities.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256APPLE-SA-2023-09-21-2 iOS 17.0.1 and iPadOS 17.0.1iOS 17.0.1 and iPadOS 17.0.1 addresses the following issues.Information about the security content is also available athttps://support.apple.com/kb/HT213926.Apple maintains a Security Updates page athttps://support.apple.com/HT201222 which lists recentsoftware updates with security advisories.KernelAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,iPad mini 5th generation and laterImpact: A local attacker may be able to elevate their privileges. Appleis aware of a report that this issue may have been actively exploitedagainst versions of iOS before iOS 16.7.Description: The issue was addressed with improved checks.CVE-2023-41992: Bill Marczak of The Citizen Lab at The University ofToronto's Munk School and Maddie Stone of Google's Threat Analysis GroupSecurityAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,iPad mini 5th generation and laterImpact: A malicious app may be able to bypass signaturevalidation. Apple is aware of a report that this issue may have beenactively exploited against versions of iOS before iOS 16.7.Description: A certificate validation issue was addressed.CVE-2023-41991: Bill Marczak of The Citizen Lab at The University ofToronto's Munk School and Maddie Stone of Google's Threat Analysis GroupWebKitAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,iPad mini 5th generation and laterImpact: Processing web content may lead to arbitrary codeexecution. Apple is aware of a report that this issue may have beenactively exploited against versions of iOS before iOS 16.7.Description: The issue was addressed with improved checks.WebKit Bugzilla: 261544CVE-2023-41993: Bill Marczak of The Citizen Lab at The University ofToronto's Munk School and Maddie Stone of Google's Threat Analysis GroupThis update is available through iTunes and Software Update on youriOS device, and will not appear in your computer's Software Updateapplication, or in the Apple Downloads site. Make sure you have anInternet connection and have installed the latest version of iTunesfrom https://www.apple.com/itunes/  iTunes and Software Update on thedevice will automatically check Apple's update server on its weeklyschedule. When an update is detected, it is downloaded and the optionto be installed is presented to the user when the iOS device isdocked. We recommend applying the update immediately if possible.Selecting Don't Install will present the option the next time youconnect your iOS device.  The automatic update process may take up toa week depending on the day that iTunes or the device checks forupdates. You may manually obtain the update via the Check for Updatesbutton within iTunes, or the Software Update on your device.  Tocheck that the iPhone, iPod touch, or iPad has been updated:  *Navigate to Settings * Select General * Select About. The versionafter applying this update will be "iOS 17.0.1 and iPadOS 17.0.1".All information is also posted on the Apple Security Updatesweb site: https://support.apple.com/en-us/HT201222.This message is signed with Apple's Product Security PGP key,and details are available at:https://www.apple.com/support/security/pgp/-----BEGIN PGP SIGNATURE-----iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUMi+MACgkQX+5d1TXaIvrv2BAA2OVuQh+A+ueReKyIWMrCbMSa8Vr/0I30lmR6EwagXspttZU6o5B1YpxDQGljaQT4wKizwxW0Uvkjr/b74oLcfsTp0VVNF8RqrFLPEw7CszXANhxoCHa47J3BX4WYvVKMmjc65AAcBby54UXLBVRKs1pdcWXE+/X+/Oo+LzynUeuFzNlMJ6bMBtrax2ip/gLwNiR47gkpwP3JSnChnAwulbDnUVNpdt9+eRnU5qAoFKsCGVlbCj34lqVyPpHBc4NXAjar+F/iQkTVGwWpeolMFaxUNMWspy4dhdni3ol5lxjRZvBTQqqCiEy1iX1KrU+ZXiIu8GRAMJcYYczM0AqrGc3P59jmMKR9x1tmoWcqVJr4o05c89K4QPy/xxCO6D1kNkk4Flo4ko/9UElFlAkdcoh+Uw63lvc7QtsjIgbkkktD6Oy+PQmaPtXLijmJ6pAbX9IpFCyNDdGX+Iwpqa7gp9oxVD3O4UVIqJkMTcUlDqP7oOHyOVbLLDIhbL+11gQFRjO1j6CO5wqohd234XKArks/ifw2BUV5itOxt/jHfRP7XJpgBXx+R91RxWSn8r1Bf/GMD7S+jIpfJ6kON/UykDTqYHHJYhpMaKlLwuZQY5iWyp0SySTY+UHhl4Q/hGIEFQHItjz3Vk+1Kn6iwh4XDWHPMOLFTXkNoxl7dy5cQ+k==g23D-----END PGP SIGNATURE-----

Apple Security Advisory 2023-09-21-2

Apple Security Advisory 2023-09-21-1 - Safari 16.6.1 addresses a code execution vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-2023-09-21-1 Safari 16.6.1

Safari 16.6.1 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213930.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

WebKit  
Available for: macOS Big Sur and Monterey  
Impact: Processing web content may lead to arbitrary code  
execution. Apple is aware of a report that this issue may have been  
actively exploited against versions of iOS before iOS 16.7.  
Description: The issue was addressed with improved checks.  
WebKit Bugzilla: 261544  
CVE-2023-41993: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Safari 16.6.1 may be obtained from the Mac App Store.  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUMi+IACgkQX+5d1TXa  
IvrZ2BAAuNoAbXP8tdVUSSH8ZI5HlF80jdbUjVTMvRXl0sjkzBPGaS9g0hKJWZhD  
4b4yKY5/4flWuL4SXWaSzk8ZDe0EmgUoKG1Nr1rROR+KzXY78mm5V8z3xheCH4+d  
4e8wJ57xLQn++Gw1heVC21JBgFIq00OAbnBptPKfMQZGQaa6g/aRV8o/gezWcG3Y  
3zqbrW2wSvfTVWE2yMKJBTnHLbHZNWWHXojWJqgmKRli3pyfrff2N6vk7w0nsBxg  
FNgreWXK4KO3MkGONXYRdmwbqWpiLokJ2oAiHI4sepF4eb9mgrJ/dOLHVoWZ9HVm  
BWG7TKKV780d15dNegx4zgTU8p9X9x7rFvY3EoKjpg0Hvd/yf/4POeKCAz9TB2ve  
sVmGlHHqrYZm+ZkxmGHZwbZWzUTLSs6+T0T906LR5+qFUeffpjQTKFi7kOVuKIxt  
6GbWt+Tmfvkka/Wt/NM1xQXB0CCm1TtudqHgCECXGN3ZT5kxVlJpyltltG2o+Mp4  
IN31lMQ+77zwT59JOkup045RLWhaoMFfqpIJ61LYT0g16OXZmJH/Lheawy4LUr/N  
85A+42DoTsVwjOU8BoRhWqSX/nZeBcadV7hhK2rGw9pI2LI6S24BoIH6DUc5VTfX  
kQzhBo+SN5ZgV2c3mPO4DuRzAn9ijZO7HnJou/0nM7cZTJEmAVA=  
=dCMM  
-----END PGP SIGNATURE-----

Tag

#google