Latest iOS 12.1.4 Update Patches 2 Zero-Day and FaceTime Bugs

The Facetime bug (CVE-2019-6223) was discovered by 14-year-old
Grant Thompson of Catalina Foothills High School while he was
trying to set up a Group FaceTime session with his friends.

Thompson reported the bug to the company a week before it made
headlines across the internet, forcing Apple to temporarily disable
the group calling feature within FaceTime.

In its advisory published Thursday, Apple
described the bug as “a logic issue existed in the handling of
Group FaceTime calls,” that also impacted the group FaceTime
calling feature on Apple’s macOS Mojave 10.14.2.

Along with Thompson, Apple has also credited Daven Morris of
Arlington, Texas, in its official advisory for reporting this
bug.

According to media reports, Apple has confirmed to “compensate”
the family and help towards the teenager’s future education costs
as part of its Bug Bounty program, though it is unclear how much
the company is going to pay.

Two More In-The-Wild Zero-Day Flaws Discovered

The iOS 12.1.4 update also patches three more security
vulnerabilities, two of which were also reportedly being exploited
in the wild, confirmed by
Google Project Zero researchers, who discovered and reported these
vulnerabilities to Apple. The last bug was also related to
FaceTime.

• CVE-2019-7286: a memory corruption issue that could allow a
  malicious application to gain elevated privileges on the vulnerable
  Apple device.
• CVE-2019-7287: a memory corruption issue that could allow a
  malicious application to execute arbitrary code with kernel
  privileges.
• CVE-2019-7288: discovered by the Apple security team, this flaw
  is another FaceTime issue with Live Photos.

If you haven’t yet, you are highly recommended to update your Apple
devices with iOS 12.1.4 release, which is available for the iPhone
5S, and later, iPad Air and later, and iPod touch 6th
generation.
To run the update on your iPhone, iPad or iPod, just go to
Settings→ General → Software Update and click the ‘Download and
Install’ button.

If you are a Mac owner, you should also install the new macOS
Mojave 10.14.3 update^[4]
on your computer that also fixes three of the four vulnerabilities
briefed above, including the FaceTime issues.

To update your Mac computer, just go to Apple menu in the top
left corner of your computer, select ‘System Preferences,’ click
‘Software Update’ and download the new update.

^[1][2][3]