Apple Releases iOS and macOS Updates to Patch Actively Exploited 0-Day Vulnerability

Apple on Wednesday launched iOS 15.3 and macOS Monterey 12.2 with a resolve for the privacy-defeating bug in Safari, as very well as to contain a zero-day flaw, which it said has been exploited in the wild to break into its equipment.

Tracked as CVE-2022-22587, the vulnerability relates to a memory corruption issue in the IOMobileFrameBuffer part that could be abused by a destructive application to execute arbitrary code with kernel privileges.

The iPhone maker stated it truly is “knowledgeable of a report that this issue may well have been actively exploited,” including it tackled the issue with enhanced enter validation. It did not expose the mother nature of the attacks, how prevalent they are, or the identities of the menace actors exploiting them.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

An nameless researcher together with Meysam Firouzi and Siddharth Aeri have been credited with exploring and reporting the flaw.

CVE-2022-22587 is the third zero-day vulnerability learned in IOMobileFrameBuffer in a span of six months after CVE-2021-30807 and CVE-2021-30883. In December 2021, Apple solved 4 supplemental weaknesses in the kernel extension that is applied to manage the screen framebuffer.

Also fixed by the tech giant is a lately disclosed vulnerability in Safari that stemmed from a defective implementation of the IndexedDB API (CVE-2022-22594), which could be abused by a destructive web page to monitor users’ on the web action in the web browser and even reveal their identity.

Other flaws of be aware contain —

• CVE-2022-22584 – A memory corruption issue in ColorSync that may well lead to arbitrary code execution when processing a malicious crafted file
• CVE-2022-22578 – A logic issue in Crash Reporter that could allow for a malicious software to acquire root privileges
• CVE-2022-22585 – A path validation issue in iCloud that could be exploited be a rogue software to access a user’s documents
• CVE-2022-22591 – A memory corruption issue in Intel Graphics Driver that could be abused by a destructive software to execute arbitrary code with kernel privileges
• CVE-2022-22593 – A buffer overflow issue in Kernel that could be abused by a malicious software to execute arbitrary code with kernel privileges
• CVE-2022-22590 – A use-following-no cost issue in WebKit that may well guide to arbitrary code execution when processing maliciously crafted web information

The updates are offered for iPhone 6s and later on, iPad Pro (all versions), iPad Air 2 and later, iPad 5th technology and later on, iPad mini 4 and later on, iPod contact (7th era), and macOS gadgets operating Big Sur, Catalina, and Monterey.

Located this article appealing? Observe THN on Facebook, Twitter  and LinkedIn to read through extra exclusive content material we article.