Apple heeft enkele dagen geleden versie 18.2.1 van iOS uitgebracht. In iOS 18, dat geschikt is voor alle modellen waarop ook iOS 17 draait, is het onder meer mogelijk het beginscherm aan te passen, is er ondersteuning voor Rich Communication Services, heeft het bedieningspaneel een opfrisbeurt gekregen en is de fotoapp vernieuwd. Verder is er een wachtwoordmanager en kunnen apps worden verborgen of worden afgeschermd. In deze update treffen we enkele niet nader gespecificeerde bugfixes en zijn de volgende beveiligingsproblemen verholpen:
AppleMobileFileIntegrityAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
AppleMobileFileIntegrity
Impact: A malicious app may be able to access private information
Description: The issue was addressed with improved checks.
CVE-2024-54526: Mickey Jin (@patch1t), Arsenii Kostromin (0x3c3e)Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Audio
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2024-54527: Mickey Jin (@patch1t)Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Crash Reporter
Impact: Muting a call while ringing may not result in mute being enabled
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2024-54503: Micheal Chukwu and an anonymous researcherAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
FontParser
Impact: An app may be able to access sensitive user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2024-54513: an anonymous researcherAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
ImageIO
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: The issue was addressed with improved checks.
CVE-2024-54486: Hossein Lotfi (@hosselot) of Trend Micro Zero Day InitiativeAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Kernel
Impact: Processing a maliciously crafted image may result in disclosure of process memory
Description: The issue was addressed with improved checks.
CVE-2024-54500: Junsung Lee working with Trend Micro Zero Day InitiativeAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Kernel
Impact: An attacker may be able to create a read-only memory mapping that can be written to
Description: A race condition was addressed with additional validation.
CVE-2024-54494: sohybbykAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Kernel
Impact: An app may be able to leak sensitive kernel state
Description: A race condition was addressed with improved locking.
CVE-2024-54510: Joseph Ravichandran (@0xjprx) of MIT CSAILAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
libexpat
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2024-44245: an anonymous researcherAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
libxpc
Impact: A remote attacker may cause an unexpected app termination or arbitrary code execution
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
CVE-2024-45490Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
libxpc
Impact: An app may be able to break out of its sandbox
Description: The issue was addressed with improved checks.
CVE-2024-54514: an anonymous researcherAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Passwords
Impact: An app may be able to gain elevated privileges
Description: A logic issue was addressed with improved checks.
CVE-2024-44225: 风沐云烟(@binary_fmyy)Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Safari
Impact: An attacker in a privileged network position may be able to alter network traffic
Description: This issue was addressed by using HTTPS when sending information over the network.
CVE-2024-54492: Talal Haj Bakry and Tommy Mysk of Mysk Inc. (@mysk_co)Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
SceneKit
Impact: On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website
Description: The issue was addressed with improved routing of Safari-originated requests.
CVE-2024-44246: Jacob BraunAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
VoiceOver
Impact: Processing a maliciously crafted file may lead to a denial of service
Description: The issue was addressed with improved checks.
CVE-2024-54501: Michael DePlante (@izobashi) of Trend Micro's Zero Day InitiativeAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
WebKit
Impact: An attacker with physical access to an iOS device may be able to view notification content from the lock screen
Description: The issue was addressed by adding additional logic.
CVE-2024-54485: Abhay Kailasia (@abhay_kailasia) from C-DAC Thiruvananthapuram IndiaAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
WebKit
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: The issue was addressed with improved checks.
WebKit Bugzilla: 278497
CVE-2024-54479: Seunghyun Lee
WebKit Bugzilla: 281912
CVE-2024-54502: Brendon Tiszka of Google Project ZeroAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
WebKit
Impact: Processing maliciously crafted web content may lead to an unexpected process crash
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 282180
CVE-2024-54508: linjy of HKUS3Lab and chluo of WHUSecLab, Xiangwei Zhang of Tencent Security YUNDING LABAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
WebKit
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: A type confusion issue was addressed with improved memory handling.
WebKit Bugzilla: 282661
CVE-2024-54505: Gary KwongAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later
Impact: Processing maliciously crafted web content may lead to memory corruption
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 277967
CVE-2024-54534: Tashita Software Security
:fill(white):strip_exif()/i/2006928442.jpeg?f=thumbmedium)
:fill(white):strip_exif()/i/2006928554.jpeg?f=thumbmedium)
:strip_exif()/i/2006208068.jpeg?f=fpa)
:fill(white):strip_exif()/i/2006085380.jpeg?f=thumbmedium)
:fill(white):strip_exif()/i/2006928586.jpeg?f=thumbmedium)
:fill(white):strip_exif()/i/2006085286.jpeg?f=thumbmedium)
:strip_exif()/i/2004606044.png?f=thumbmedium)
:fill(white):strip_exif()/i/2005333472.jpeg?f=thumbmedium)
:fill(white):strip_exif()/i/2006085342.jpeg?f=thumbmedium)
:strip_exif()/i/2004606072.png?f=thumbmedium)
:fill(white):strip_exif()/i/2005333556.jpeg?f=thumbmedium)
:fill(white):strip_exif()/i/2006928496.jpeg?f=thumbmedium)
:strip_exif()/i/2004968528.png?f=thumbmedium)
:strip_exif()/i/2003060680.png?f=thumbmedium)
:strip_exif()/i/2004606086.png?f=thumbmedium)
:fill(white):strip_exif()/i/2006085350.jpeg?f=thumbmedium)
:strip_exif()/i/2003921462.png?f=thumbmedium)
:fill(white):strip_exif()/i/2005333580.jpeg?f=thumbmedium)
:strip_exif()/i/2003921420.png?f=thumbmedium)
:strip_exif()/i/2004606116.png?f=thumbmedium)
:strip_exif()/i/2003539266.png?f=thumbmedium)
:fill(white):strip_exif()/i/2002468080.jpeg?f=thumbmedium)
:fill(white):strip_exif()/i/2002467922.jpeg?f=thumbmedium)
:strip_exif()/i/2003060706.png?f=thumbmedium)
:strip_exif()/i/2003921510.png?f=thumbmedium)
:strip_exif()/i/2001025601.png?f=thumbmedium)
/u/254163/crop5815faf49e2d2_cropped.png?f=community){kind=small}
:strip_icc():strip_exif()/u/78725/train-icon3.jpg?f=community){kind=small}
.
/u/400/defember100.png?f=community){kind=small}
:strip_icc():strip_exif()/u/29371/crop6739d1f0e6c70_cropped.jpg?f=community){kind=small}
/u/313564/crop6177ba5336d16_cropped.png?f=community){kind=small}
:strip_icc():strip_exif()/u/1743468/crop666ec799b4ae1_cropped.jpg?f=community){kind=small}