Apple iOS/iPadOS Security Update: WebKit RCE, Kernel Privilege Escalation, and 15 CVE Fixes

From the screenshot of the webpage, here are the key details about the vulnerabilities: Link: The broader context for this information is documented on the Apple Security Support page ( ) Context: This update includes several fixes for different bugs on various Apple devices, such as the iPhone 8 and later, iPad Pro, iPad Air, iPad 5, iPad mini 5, etc. Details of the vulnerabilities: App Store: CVE-2023-40448 - A remote attacker may be able to break out of Web Content sandbox. Biometric Authentication: CVE-2023-41232 - An app might be able to disclose kernel memory. CoreAnimation: CVE-2023-40420 - Processing web content may lead to a denial-of-service. Game Center: CVE-2023-40395 - An app may be able to access contacts. Kernel: CVE-2023-41984, CVE-2023-41981, CVE-2023-41992 - An app might execute arbitrary code with kernel privileges. libxpc: CVE-2023-41073, CVE-2023-40454 - An app may be able to access protected user data and delete files without permission. libxslt: CVE-2023-40403 - Processing web content may disclose sensitive information. MobileStorageMounter: CVE-2023-41068 - A user might elevate privileges. Pro Res: CVE-2023-41063 - An app might execute arbitrary code with kernel privileges. Safari: CVE-2023-35990 - An app may be able to name other apps a user has installed. Security: CVE-2023-41991 - A malicious app may bypass signature validation. Share Sheet: CVE-2023-41070 - An app may access sensitive data logged when a user shares a link. WebKit: CVE-2023-38078 - Processing web content may lead to arbitrary code execution. Additional recognition: AppSandbox: Acknowledges Kirin for their assistance. Kernel: Acknowledges Bill Marczak and Maddie Stone for their assistance. WebKit: Acknowledges Khiem Tran, Narendra Bhati for their assistance. WebRTC: Acknowledges anonymous researcher for their assistance. libxml2: Acknowledges OSS-Fuzz and Ned Williamson of the Google Project Zero for their assistance. This update is available through iTunes and Software updates on your iOS device, and will not appear in your device’s machine’s algorithm update application or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from Apple's site; iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting "Don't Install" will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check For Updates button within iTunes, or the Software Update on your device. Navigate to Settings -> Select General -> Select About. The version after applying this update will be "iOS 16.7" and "iPadOS 16.7". All information is also posted on the Apple Security Updates website ( ).

Goal Reached Thanks to every supporter — we hit 100%!

Apple iOS/iPadOS Security Update: WebKit RCE, Kernel Privilege Escalation, and 15 CVE Fixes

More from this source