Apple Releases Security Patches for all Devices Fixing Dozens of New Vulnerabilities

Apple on Wednesday rolled out software
fixes^[1] for iOS, iPadOS, macOS,
tvOS, and watchOS to address a number of security flaws affecting
its platforms.

This includes at least 37 flaws spanning different components in
iOS and macOS that range from privilege escalation to arbitrary
code execution and from information disclosure to denial-of-service
(DoS).

Chief among them is CVE-2022-2294, a memory corruption flaw in
the WebRTC component that Google disclosed^[2]
earlier this month as having been exploited in real-world attacks
aimed at users of the Chrome browser. There is, however, no
evidence of in-the-wild zero-day exploitation of the flaw targeting
iOS, macOS, and Safari.

Besides CVE-2022-2294, the updates also address several
arbitrary code execution flaws impacting Apple Neural Engine
(CVE-2022-32810, CVE-2022-32829, and CVE-2022-32840), Audio
(CVE-2022-32820), GPU Drivers (CVE-2022-32821), ImageIO
(CVE-2022-32802), IOMobileFrameBuffer (CVE-2022-26768), Kernel
(CVE-2022-32813 and CVE-2022-32815), and WebKit
(CVE-2022-32792).

Also patched is a Pointer Authentication^[3]
bypass affecting the Kernel (CVE-2022-32844), a DoS bug in the
ImageIO component (CVE-2022-32785), and two privilege escalation
flaws in AppleMobileFileIntegrity and File System Events
(CVE-2022-32819 and CVE-2022-32826).

What’s more, the latest version of macOS resolves five security
vulnerabilities in the SMB module that could be potentially
exploited by a malicious app to gain elevated privileges, leak
sensitive information, and execute arbitrary code with kernel
privileges.

Users of Apple devices are recommended to update to iOS 15.6,
iPadOS 15.6, macOS (Monterey 12.5, Big Sur 11.6.8, and 2022-005
Catalina), tvOS 15.6, and watchOS 8.7 to obtain the latest security
protections.