Apple Releases Security Patches For Older iPhone and iPad Models

Apple has unveiled fixes for a vulnerability affecting more mature iPhone and iPad styles that could lead to remote code execution (RCE).

The tech huge launched the iOS 15.7.4 and iPadOS 15.7.4 updates along with the new iOS 16.4 and iPadOS 16.4 variations (for more recent Apple models) on Monday.

Read additional on iOS security capabilities listed here: Apple Introduces New Facts Protections to Maximize Cloud Security

The flaw impacts a variety of older Apple gadgets, which include all ‌iPhone‌ 6s and ‌iPhone‌ 7 types, the initial-generation iPhone SEs, the iPad Air 2, the fourth-generation iPad mini and the seventh-generation iPod touch.

The vulnerability (CVE-2023-23529) refers to a style confusion bug in the WebKit browser engine. It was reportedly fastened by Apple on February 13, but only disclosed on Monday.

“Processing maliciously crafted web content material could direct to arbitrary code execution,” Apple explained in the advisory. “For our customers’ protection, Apple does not disclose, discuss or confirm security issues right until an investigation has transpired and patches or releases are obtainable.”

At the similar time, the Cupertino-centered firm mentioned they were being conscious of “a report that this issue may possibly have been actively exploited.” 

As is customary, the organization did not share facts about how the vulnerability was currently being exploited in the wild or what its effects was on iPhone and iPad customers. Apple reported the type confusion issue was tackled with enhanced checks. An nameless researcher was credited with the discovery.

The patches appear a couple months soon after Apple released a independent resolve for a zero-day security flaw (CVE-2022-42856) that was actively exploited in the wild.

Far more not too long ago, cybersecurity scientists from Trellix have shed light on 6 vulnerabilities on macOS and iOS, and an entirely new bug course based on the ForcedEntry attack utilised to deploy the NSO Group’s mobile Pegasus malware.

Editorial graphic credit history: nikkimeel / Shutterstock.com

Some parts of this article are sourced from:
www.infosecurity-journal.com