Apple iOS/iPadOS Security Update: Multiple CVEs Fixed in ColorSync, WebKit, Kernel

Key Vulnerability Information Summary Release Date: January 26, 2022 Affected Devices: iPhone 6s and later, all iPad Pro models, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation) Vulnerability Details ColorSync - CVE-ID: CVE-2022-22584 - Description: Memory corruption issue resolved via improved validation to prevent arbitrary code execution Crash Reporter - CVE-ID: CVE-2022-22578 - Description: Logic issue resolved via improved validation to prevent malicious apps from gaining root privileges iCloud - CVE-ID: CVE-2022-22585 - Description: Path validation logic issue resolved via improved path sanitization to prevent apps from accessing user files IOMobileFrameBuffer - CVE-ID: CVE-2022-22587 - Description: Memory corruption issue resolved via improved input validation to prevent malicious apps from executing arbitrary code with kernel privileges Kernel - CVE-ID: CVE-2022-22593 - Description: Buffer overflow issue resolved via improved memory handling to prevent malicious apps from executing arbitrary code with kernel privileges Model I/O - CVE-ID: CVE-2022-22579 - Description: Information disclosure issue resolved via improved state management to prevent malicious STL files from causing unexpected app termination or arbitrary code execution WebKit - CVE-ID: CVE-2022-22589, CVE-2022-22590, CVE-2022-22592, CVE-2022-22594 - Description: Multiple issues resolved via improved input validation, memory management, and state management to prevent malicious web content from causing arbitrary code execution, failure of Content Security Policy enforcement, or cross-origin issues Additional Recognition - Thanks to Prakash and bo13oy for their assistance Additional Information Update Date: May 25, 2022 Release Date: November 3, 2023

Goal Reached Thanks to every supporter — we hit 100%!

Apple iOS/iPadOS Security Update: Multiple CVEs Fixed in ColorSync, WebKit, Kernel