News of the Cyber World

[kyonides]

Apple Issues Emergency Updates to iPhones After Exploits Found

Apple released iOS 16.4.1 on April 7, about two weeks after the firm released its previous update to the operating system. The update was deployed to fix vulnerabilities that could be actively exploited.
...
“Apple’s own Safari browser uses WebKit, making it directly vulnerable to WebKit bugs,” it said. “Additionally, Apple’s App Store rules mean that all browsers on iPhones and iPads must use WebKit, making this sort of bug a truly cross-browser problem for mobile Apple devices.”

...a security hole in IOSurfaceAccelerator that can allow an app to execute code with kernel privileges, meaning an attacker can target the core of the code in iOS if it isn’t patched.

“This bug allows a booby-trapped local app to inject its own rogue code right into the operating system kernel itself. Kernel code execution bugs are inevitably much more serious than app-level bugs, because the kernel is responsible for managing the security of the entire system, including what permissions apps can acquire, and how freely apps can share files and data between themselves,” Sophos wrote.

Malwarebytes, another security firm, said that if an attacker can gain access to iOS kernel privileges, it’s a “serious matter” because those individuals could have “more than administrator privileges.” It means that a malign actor can gain “complete and unrestricted access to the underlying hardware via the security flaw.”
...
On Mac laptops and desktop computers, it’s similar. Users can open the Apple menu and choose System Settings before going to General and then clicking on Software Update.