Updates released on Monday by Apple for OS X, iOS, iTunes, Safari, tvOS and watchOS patch tens of vulnerabilities discovered by external researchers and the company’s own security team.
A total of 39 CVE identifiers have been assigned to the flaws affecting Apple’s iOS mobile operating system. iOS 9.3.2 resolves vulnerabilities that can lead to information disclosure, arbitrary code execution, and denial-of-service (DoS).
Researchers reported last month that they had found a way to bypass the lockscreen on the iPhone 6s and access photos and contacts by using Siri to conduct an online search for email addresses via Twitter. Apple said at the time that it addressed the issue through a server-side fix, but it appears the company has now also rolled out an iOS patch by disabling data detectors in Twitter results.
Apple has credited independent researchers and employees of Google, Trend Micro, Context Information Security, Tencent, Nanyang Technological University, and Palo Alto Networks for reporting the vulnerabilities patched in iOS.
The vulnerabilities resolved with the release of OS X El Capitan 10.11.5 have been assigned 67 CVE identifiers. However, it’s worth noting that many of them are issues that affect both OS X and iOS.
The flaws addressed in OS X can be exploited to execute arbitrary code with root or kernel privileges, for DoS attacks, and to access potentially sensitive user information. Apple has also patched the TLS issue known as DROWN.
Independent experts and people from the following organizations have been credited by Apple for reporting these security holes: BoB, Google, Trend Micro, Context Information Security, TechSmartKids, CESG, Nanyang Technological University, Computest, Knownsec, COSIG, Palo Alto Networks and Cisco.
Safari 9.1.1 patches seven WebKit vulnerabilities that can be exploited for information disclosure and arbitrary code execution. One flaw that can lead to arbitrary code execution was resolved by Apple with the release of iTunes 12.4.
Since the Apple TV operating system tvOS and the Apple Watch operating system watchOS are based on iOS, the vulnerabilities fixed with the release of watchOS 2.2.1 and tvOS 9.2.1 are mostly the same as the ones patched in iOS.
Earlier this month, Apple released an update for its Xcode development environment to address a couple of serious vulnerabilities in the Git version control system.
Related: Apple Patches Multiple Vulnerabilities in iOS, OS X
Related: No Patches for QuickTime Flaws as Apple Ends Support on Windows
