Apple delivers belated zero-day patch for iOS v12 (CVE-2022-42856)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-42856 | Type Confusion in Apple WebKit (Safari/iOS/macOS/tvOS), Actively Exploited CVE-2022-42856 is a type confusion vulnerability (CWE-843) in Apple's WebKit web engine, addressed with improved state handling and affecting Safari, iPhone OS (iOS), iPadOS, macOS (Ventura) and tvOS. It is triggered when a user processes maliciously crafted web content, for example by visiting an attacker-controlled web page, in a WebKit-based browser or app. Successful exploitation may lead to arbitrary code execution on the affected device. Anyone running the affected Apple platforms below the December 2022 patch level (Safari 16.2, macOS Ventura 13.1, tvOS 16.2, iOS/iPadOS 15.7.2, iOS 16.1.2) was exposed, which effectively means most Apple users at the time of disclosure. Exploitation is confirmed: Apple reported the issue may have been actively exploited against iOS versions released before iOS 15.1, it was added to CISA KEV on 2022-12-14 (EPSS 8.5%, 95th percentile), and related reporting ties it to commercial spyware campaigns in Italy, Malaysia, Kazakhstan and the UAE. Do: Update immediately to Safari 16.2, macOS Ventura 13.1, tvOS 16.2, and iOS/iPadOS 15.7.2 (for iOS 15-era devices) or iOS 16.1.2 (for iOS 16-era devices), or any later release; this is a CISA KEV entry whose required action is to apply vendor updates. Because the flaw was exploited as a zero-day against iOS versions before iOS 15.1 and is linked to commercial spyware campaigns, treat patching as urgent and verify that all managed and BYOD iPhones and iPads are on a fixed version; on iOS, all third-party browsers and most web-content apps use WebKit, so the OS update itself is the remediation rather than switching browsers. | 8.8 | 9% | KEV |
| mass~1 billion+ Apple devices at disclosure (every iOS/iPadOS/macOS/tvOS device below the December 2022 patch level; Apple's active installed base exceeds 1… |
Full article282 words · extracted from helpnetsecurity.com · click to collapse
Apple has released security updates for macOS, iOS, iPadOS and watchOS, patching – among other things – a type confusion flaw in the WebKit component (CVE-2022-42856) that could be exploited for remote code execution on older iPhones and iPads running iOS v12.
“Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1,” the company said.
CVE-2022-42856 was a zero-day vulnerability flagged by Clément Lecigne of Google’s Threat Analysis Group and was patched by Apple in November and December 2022 in the iOS 16 and 15 branches, respectively. Apple still has not shared details of the attacks leveraging this vulnerability.
As per usual, the security update for the most recent macOS version (v13, or Ventura) is more hefty that those for Monterey (v12) and Big Sur (v11), but many of the fixes overlap. Likewise, iOS and iPadOS v16.3 deliver more fixes than v15.7.3 for those two OSes.
Wider availability of new security features
Advanced Data Protection for iCloud and Security Keys for Apple ID, two security features announced and partially rolled out for testing by Apple late last year, have also been included in this latest macOS Ventura update.
Advanced Data Protection for iCloud expands end-to-end encryption to more data categories in iCloud (including iCloud Backup, Notes, and Photos), and Security Keys for Apple ID adds the necessary support so users can use physical security keys as their second authentication factor.
More details about each of these features is available here. If you’re a Mac user and you still haven’t explored the security and privacy features introduced with macOS Ventura, check out this quick overview.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/01/24/cve-2022-42856-ios-v12/