It’s Patch Wednesday in Cupertino.
Apple’s security response team pushed out major security updates to fix security flaws across the iOS and macOS ecosystems, warning of risks of data leakage, sandbox escapes and code execution attacks.
The company called immediate attention to its iOS 18.2 and macOS Sequoia 15.2 patches, warning of flaws in the kernel, WebKit, AppleMobileFileIntegrity, Passwords and ImageIO components.
The updates also fix a major security defect in libexpat, an open-source software utility integrated into Apple’s software. The bug, tagged as CVE-2024-45490, allows a remote attacker to cause an unexpected app termination or arbitrary code execution, Apple warned in an advisory.
According to the public documentation, the iOS 18.2 update addresses a pair of bugs in AppleMobileFileIntegrity that allow malicious apps to bypass protections and access sensitive user data.
Apple also pushed patches for multiple kernel bugs that allow attackers to create writable memory mappings that should have been read-only or let apps leak sensitive kernel state information.
As is customary, the patches cover security holes in the WebKit browser engine, including issues that could cause process crashes or lead to memory corruption when processing malicious web content.
Apple also pushed a patch to the Passwords component to fix a bug that allows attackers in a privileged network position to alter network traffic.
In the new macOS Sequoia 15.2 rollout, Apple patched dozens of operation system flaws and called attention to a bug in IOMobileFrameBuffer that allows arbitrary code execution attacks in DCP firmware.
The company also shipped security-themed updates for watchOS, tvOS and visionOS.
Related: Microsoft Ships Urgent Patch for Exploited Windows CLFS Zero-Day
Related: Critical OpenWrt Flaw Exposes Firmware Update Server to Exploitation
Related: Adobe Patches Over 160 Vulnerabilities Across 16 Products
Related: New iOS Security Feature Reboots Devices to Protect User Data
