Apple backported patches for CVE-2022-42856 zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-42856 | Type Confusion in Apple WebKit (Safari/iOS/macOS/tvOS), Actively Exploited CVE-2022-42856 is a type confusion vulnerability (CWE-843) in Apple's WebKit web engine, addressed with improved state handling and affecting Safari, iPhone OS (iOS), iPadOS, macOS (Ventura) and tvOS. It is triggered when a user processes maliciously crafted web content, for example by visiting an attacker-controlled web page, in a WebKit-based browser or app. Successful exploitation may lead to arbitrary code execution on the affected device. Anyone running the affected Apple platforms below the December 2022 patch level (Safari 16.2, macOS Ventura 13.1, tvOS 16.2, iOS/iPadOS 15.7.2, iOS 16.1.2) was exposed, which effectively means most Apple users at the time of disclosure. Exploitation is confirmed: Apple reported the issue may have been actively exploited against iOS versions released before iOS 15.1, it was added to CISA KEV on 2022-12-14 (EPSS 8.5%, 95th percentile), and related reporting ties it to commercial spyware campaigns in Italy, Malaysia, Kazakhstan and the UAE. Do: Update immediately to Safari 16.2, macOS Ventura 13.1, tvOS 16.2, and iOS/iPadOS 15.7.2 (for iOS 15-era devices) or iOS 16.1.2 (for iOS 16-era devices), or any later release; this is a CISA KEV entry whose required action is to apply vendor updates. Because the flaw was exploited as a zero-day against iOS versions before iOS 15.1 and is linked to commercial spyware campaigns, treat patching as urgent and verify that all managed and BYOD iPhones and iPads are on a fixed version; on iOS, all third-party browsers and most web-content apps use WebKit, so the OS update itself is the remediation rather than switching browsers. | 8.8 | 9% | KEV |
| mass~1 billion+ Apple devices at disclosure (every iOS/iPadOS/macOS/tvOS device below the December 2022 patch level; Apple's active installed base exceeds 1… |
Full article361 words · extracted from securityaffairs.com · click to collapse
Apple has backported the security updates for the zero-day vulnerability CVE-2022-42856 to older iPhones and iPads.
On December 2022, Apple released security updates to address a new zero-day vulnerability, tracked as CVE-2022-42856, that is actively exploited in attacks against iPhones.
The IT giant released security bulletins for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1. Apple addressed the vulnerability with improved state handling for the iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).
The CVE-2022-42856 flaw is a type confusion issue that impacts the WebKit browser engine, an attacker can exploit the bug when processing specially crafted content to achieve arbitrary code execution.
“Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1.” reads the advisory published by Apple. “A type confusion issue was addressed with improved state handling.”
The vulnerability was reported by Clément Lecigne of Google’s Threat Analysis Group. At this time there are no public details about the attacks exploiting the vulnerability.
Apple this week has backported the security updates for the CVE-2022-42856 issue to older iPhones and iPads.
To secure older devices against attacks exploiting the above issue, Apple released iOS 12.5.7. The patches are now available also for iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation).
On December 14, 2022, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to address it by January 04, 2022
The company addressed the zero-day bug with improved state handling for the following devices: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation).
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Apple)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/141221/security/apple-backported-patches-cve-2022-42856.html