With the release of iOS 16.3.1 last week, Apple fixed several security vulnerabilities for iPhone and iPad users. Although the company has already detailed these patches on its website, Apple has now updated its security page to announce that even more vulnerabilities have been fixed with the latest iOS updates.
Like Aaron on Twitter writes, Apple has added one new CVE (Common Vulnerabilities and Exposures) for iOS 16.3.1 and three new CVEs for iOS 16.3, released in January. The new vulnerability, identified by Apple and fixed in iOS 16.3.1, is related to a "maliciously crafted certificate" that could lead to a denial-of-service (DoS) attack, in which the attacker floods the device or network with traffic to cause a crash. Loud Apple fixed the DoS issue with “improved input validation.”
iOS 16.3.1: The update is strongly recommended
Interestingly, the iOS 16.3 security content webpage was also updated with three new vulnerabilities that were fixed with the update. One of the vulnerabilities, found in the system's Crash Reporter, could allow an attacker to read arbitrary files as root. Two other vulnerabilities related to the Foundation could allow an attacker to execute arbitrary code on the iPhone or iPad with elevated privileges, thereby bypassing the app's sandbox.
- Affected: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5.
- Impact: An app may be able to execute arbitrary code outside of its sandbox or with certain elevated privileges.
- Description: The issue was resolved through improved memory management.
- CVE-2023-23530: Austin Emmitt, senior security researcher at Trellix ARC
It's unclear why Apple hasn't announced the closure of these vulnerabilities yet. However, it's worth remembering that these vulnerabilities were all fixed with iOS 16.3.1, which is now available to all users. With macOS 13.2.1 and iOS 16.3.1, Apple also fixed a vulnerability related to WebKit (Safari's web browser engine) that was "actively exploited." (Photo by Mehaniq / Bigstockphoto)
