Security Experts:

Connect with us

Hi, what are you looking for?



Apple Patches Flaws in iOS, OS X, Other Products

Updates released on Monday by Apple for OS X, iOS, iTunes, Safari, tvOS and watchOS patch tens of vulnerabilities discovered by external researchers and the company’s own security team.

Updates released on Monday by Apple for OS X, iOS, iTunes, Safari, tvOS and watchOS patch tens of vulnerabilities discovered by external researchers and the company’s own security team.

A total of 39 CVE identifiers have been assigned to the flaws affecting Apple’s iOS mobile operating system. iOS 9.3.2 resolves vulnerabilities that can lead to information disclosure, arbitrary code execution, and denial-of-service (DoS).

Researchers reported last month that they had found a way to bypass the lockscreen on the iPhone 6s and access photos and contacts by using Siri to conduct an online search for email addresses via Twitter. Apple said at the time that it addressed the issue through a server-side fix, but it appears the company has now also rolled out an iOS patch by disabling data detectors in Twitter results.

Apple has credited independent researchers and employees of Google, Trend Micro, Context Information Security, Tencent, Nanyang Technological University, and Palo Alto Networks for reporting the vulnerabilities patched in iOS.

The vulnerabilities resolved with the release of OS X El Capitan 10.11.5 have been assigned 67 CVE identifiers. However, it’s worth noting that many of them are issues that affect both OS X and iOS.

The flaws addressed in OS X can be exploited to execute arbitrary code with root or kernel privileges, for DoS attacks, and to access potentially sensitive user information. Apple has also patched the TLS issue known as DROWN.

Independent experts and people from the following organizations have been credited by Apple for reporting these security holes: BoB, Google, Trend Micro, Context Information Security, TechSmartKids, CESG, Nanyang Technological University, Computest, Knownsec, COSIG, Palo Alto Networks and Cisco.

Safari 9.1.1 patches seven WebKit vulnerabilities that can be exploited for information disclosure and arbitrary code execution. One flaw that can lead to arbitrary code execution was resolved by Apple with the release of iTunes 12.4.

Since the Apple TV operating system tvOS and the Apple Watch operating system watchOS are based on iOS, the vulnerabilities fixed with the release of watchOS 2.2.1 and tvOS 9.2.1 are mostly the same as the ones patched in iOS.

Earlier this month, Apple released an update for its Xcode development environment to address a couple of serious vulnerabilities in the Git version control system.

Related: Apple Patches Multiple Vulnerabilities in iOS, OS X

Related: No Patches for QuickTime Flaws as Apple Ends Support on Windows

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...