The Patching Friars' AlmanacA calendar of CVE saints

September 7

BLASTPASSHoly card for blastpass, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 0-click BLASTPASS SINE TACTU INTRAT
🤖 Image and text generated with AI

⬇ Download holy card: ·

⚔ Commemorated today: The Scourge of Equifax (2017)

Embed on your site

Saint BLASTPASS, Who Entered Without a Click

Patron of iPhones, images received by message, and everyone who never tapped the link.

Life

On 7 September 2023 the Citizen Lab revealed BLASTPASS, a zero-click exploit chain used to install NSO Group's Pegasus spyware on iPhones. A malicious image sent over iMessage, processed automatically by the phone, was enough to run code without the victim touching anything. Apple rushed out an emergency update and introduced Lockdown Mode.

Prayer

O Saint BLASTPASS, who arrive as an image and stay as a guest, keep our phones from processing what nobody asked to open. Amen.

How to celebrate

Celebrated by installing Apple security updates at once and, for those at risk, turning on Lockdown Mode.

An image arrived, a phone already lost.

Technical record

Disclosed on
September 7 2023
CVE
CVE-2023-41064CVE-2023-41061
CVSS
7.8Actively exploited (CISA KEV)
Product
Apple · macOS

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Sources: citizenlab.ca

Commemorated today

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.