Security News > 2023 > April > Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads
2023-04-10 20:20

Simply put, there were zero days during which even the most proactive and cybersecurity conscious users amongst us could have been patched in advance of the crooks.

Just to be clear: the Apple Safari browser uses WebKit for "Processing web content" on all Apple devices, although third-party browsers such as Firefox, Edge and Chromium don't use WebKit on Mac.

We didn't know at the time whether the older macOSes didn't get patched for CVE-2023-28206 because they weren't vulnerable to the kernel bug, or because Apple simply hadn't got the patch ready yet.

Even more worryingly, iOS 15 and iPadOS 15, which are still officially supported, and are indeed all you can run if you have an older iPhone and iPad that can't be upgraded to version 16, didn't get any patches at all.

All supported versions of iOS and iPadOS and of macOS are vulnerable to both of these bugs, and they have now all received patches for both vulnerabilities.

If you have an older iPhone or iPad, you need to get today's update, or else you remain vulnerable to both bugs, as used in the wild in the attack discovered by Amnesty and investigated by Google.


News URL

https://nakedsecurity.sophos.com/2023/04/10/apple-zero-day-spyware-patches-extended-to-cover-older-macs-iphones-and-ipads/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2023-04-10 CVE-2023-28206 Out-of-bounds Write vulnerability in Apple Ipados and Iphone OS
An out-of-bounds write issue was addressed with improved input validation.
local
low complexity
apple CWE-787
8.6

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Apple 72 238 1567 2279 265 4349