Kort efter det att Apples keynote avslutats så lanserades iOS 12.2 med utökat stöd för Siri och med Apple News – men bara för USA och Kanada. Nya Apple News kommer som bekant först i USA och Kanada.
Utöver de nyheterna så innehåller iOS 12.2 en rad viktiga buggfixar och säkerhetsuppdateringar – och håll i dig nu för här kommer hela listan på uppdateringar. Något att läsa kanske om du har svårt att sova. En annan nyhet är AirPlay 2 som är efterlängtat av alla de som vill ha bra ljud i sina prylar. Ett tips är dock att avvakta lite – det är hårt tryck mot Apples servrar just nu.
iOS 12.2
Released March 25, 2019
CFString
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing a maliciously crafted string may lead to a denial of service
Description: A validation issue was addressed with improved logic.
CVE-2019-8516: SWIPS Team of Frifee Inc.
configd
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2019-8552: Mohamed Ghannam (@_simo36)
Contacts
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2019-8511: an anonymous researcher
CoreCrypto
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2019-8542: an anonymous researcher
Exchange ActiveSync
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure
Description: This issue was addressed with improved transparency.
CVE-2019-8512: an anonymous researcher, an anonymous researcher
FaceTime
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A user’s video may not be paused in a FaceTime call if they exit the FaceTime app while the call is ringing
Description: An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic.
CVE-2019-8550: Lauren Guzniczak of Keystone Academy
Feedback Assistant
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to gain root privileges
Description: A race condition was addressed with additional validation.
CVE-2019-8565: CodeColorist of Ant-Financial LightYear Labs
Feedback Assistant
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to overwrite arbitrary files
Description: This issue was addressed with improved checks.
CVE-2019-8521: CodeColorist of Ant-Financial LightYear Labs
file
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing a maliciously crafted file might disclose user information
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2019-6237: an anonymous researcher
GeoServices
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Clicking a malicious SMS link may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved validation.
CVE-2019-8553: an anonymous researcher
iAP
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2019-8542: an anonymous researcher
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local user may be able to cause unexpected system termination or read kernel memory
Description: A memory corruption issue was addressed with improved state management.
CVE-2019-8545: Adam Donenfeld (@doadam) of the Zimperium zLabs Team
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local user may be able to read kernel memory
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2019-8504: an anonymous researcher
IOKit SCSI
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved input validation.
CVE-2019-8529: Juwei Lin (@panicaII) of Trend Micro
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved size validation.
CVE-2019-8527: Ned Williamson of Google and derrek (@derrekr6)
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A logic issue was addressed with improved state management.
CVE-2019-8514: Samuel Groß of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to determine kernel memory layout
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2019-8540: Weibo Wang (@ma1fan) of Qihoo 360 Nirvan Team
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local user may be able to read kernel memory
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-7293: Ned Williamson of Google
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to determine kernel memory layout
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation.
CVE-2019-6207: Weibo Wang of Qihoo 360 Nirvan Team (@ma1fan)
CVE-2019-8510: Stefan Esser of Antid0te UG
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing a maliciously crafted mail message may lead to S/MIME signature spoofing
Description: This issue was addressed with improved checks.
CVE-2019-7284: Damian Poddebniak of Münster University of Applied Sciences
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local user may be able to view sensitive user information
Description: An access issue was addressed with additional sandbox restrictions.
CVE-2019-8546: ChiYuan Chang
Power Management
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: Multiple input validation issues existed in MIG generated code. These issues were addressed with improved validation.
CVE-2019-8549: Mohamed Ghannam (@_simo36) of SSD Secure Disclosure (ssd-disclosure.com)
Privacy
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious app may be able to track users between installs
Description: A privacy issue existed in motion sensor calibration. This issue was addressed with improved motion sensor processing.
CVE-2019-8541: Stan (Jiexin) Zhang and Alastair R. Beresford of the University of Cambridge and Ian Sheret of Polymath Insight Limited
ReplayKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to access the microphone without indication to the user
Description: An API issue existed in the handling of microphone data. This issue was addressed with improved validation.
CVE-2019-8566: an anonymous researcher
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A website may be able to access sensor information without user consent
Description: A permissions issue existed in the handling of motion and orientation data. This issue was addressed with improved restrictions.
CVE-2019-8554: an anonymous researcher
Safari Reader
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting
Description: A logic issue was addressed with improved validation.
CVE-2019-6204: Ryan Pickren (ryanpickren.com)
CVE-2019-8505: Ryan Pickren (ryanpickren.com)
Siri
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to initiate a Dictation request without user authorization
Description: An API issue existed in the handling of dictation requests. This issue was addressed with improved validation.
CVE-2019-8502: Luke Deshotels of North Carolina State University, Jordan Beochler of North Carolina State University, William Enck of North Carolina State University, Costin Carabaș of University POLITEHNICA of Bucharest, and Răzvan Deaconescu of University POLITEHNICA of Bucharest
TrueTypeScaler
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2019-8517: riusksk of VulWar Corp working with Trend Micro Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A logic issue was addressed with improved validation.
CVE-2019-8551: Ryan Pickren (ryanpickren.com)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved state management.
CVE-2019-8535: Zhiyang Zeng (@Wester) of Tencent Blade Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6201: dwfault working with ADLab of Venustech
CVE-2019-8518: Samuel Groß of Google Project Zero
CVE-2019-8523: Apple
CVE-2019-8524: G. Geshev working with Trend Micro Zero Day Initiative
CVE-2019-8558: Samuel Groß of Google Project Zero
CVE-2019-8559: Apple
CVE-2019-8563: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox restrictions
Description: A memory corruption issue was addressed with improved validation.
CVE-2019-8562: Wen Xu of SSLab at Georgia Tech and Hanqing Zhao of Chaitin Security Research Lab
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A website may be able to access the microphone without the microphone use indicator being shown
Description: A consistency issue was addressed with improved state handling.
CVE-2019-6222: Denis Markov of Resonance Software
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may disclose sensitive user information
Description: A cross-origin issue existed with the fetch API. This was addressed with improved input validation.
CVE-2019-8515: James Lee (@Windowsrcer)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2019-8536: Apple
CVE-2019-8544: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
CVE-2019-7285: dwfault working at ADLab of Venustech
CVE-2019-8556: Apple
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A type confusion issue was addressed with improved memory handling.
CVE-2019-8506: Samuel Groß of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious website may be able to execute scripts in the context of another website
Description: A logic issue was addressed with improved validation.
CVE-2019-8503: Linus Särud of Detectify
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may result in the disclosure of process memory
Description: A validation issue was addressed with improved logic.
CVE-2019-7292: Zhunki and Zhiyi Zhang of 360 ESG Codesafe Team
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A device may be passively tracked by its WiFi MAC address
Description: A user privacy issue was addressed by removing the broadcast MAC address.
CVE-2019-8567: David Kreitschmann and Milan Stute of Secure Mobile Networking Lab at Technische Universität Darmstadt
XPC
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A malicious application may be able to overwrite arbitrary files
Description: This issue was addressed with improved checks.
CVE-2019-8530: CodeColorist of Ant-Financial LightYear Labs
0 kommentarer