WebKit is the browser engine that powers Safari and all other third-party browsers that work on iOS. The flaw allows for processing maliciously crafted web content that can lead to code execution, and also has been reported to be under active exploit, according to Apple. The second flaw is identified as a WebKit bug (tracked as CVE-2022-32893), which is an out-of-bounds write issue that Apple addressed with improved bounds checking. The vulnerability allows an application to execute arbitrary code with kernel privileges, according to Apple, which, in usual vague fashion, said there is a report that it “may have been actively exploited.” According to Apple it is an “out-of-bounds write issue was addressed with improved bounds checking.” One of the flaws is a kernel bug ( CVE-2022-32894), which is present both in iOS and macOS.
Patches address two flaws, which basically impact any Apple device that can run either iOS 15 or the Monterey version of its desktop OS, according to security updates released by Apple Wednesday. Patches are available for effected devices running iOS 15.6.1 and macOS Monterey 12.5.1.
The patches are for vulnerabilities that allow attackers to execute arbitrary code and ultimately take over devices. Apple is urging macOS, iPhone and iPad users immediately to install respective updates this week that includes fixes for two zero-days under active attack.
0 kommentar(er)
