Categories
Audio Sources - Full Text Articles

Apple fixed the tenth actively exploited zero-day this year

Listen to this article

apple.jpg?fit=900%2C520&ssl=1

Apple rolled out security updates to iOS, iPadOS, macOS, tvOS, and Safari to fix a new actively exploited zero-day (CVE-2022-42856).

Apple released security updates to address a new zero-day vulnerability, tracked as CVE-2022-42856, that is actively exploited in attacks against iPhones.

The flaw is the tenth actively exploited zero-day vulnerability since the start of the year.

The IT giant released security bulletins for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1. Apple addressed the vulnerability with improved state handling for the iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),Ā iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).

The CVE-2022-42856 flaw is a type confusion issue that impacts the WebKit browser engine, an attacker can exploit the bug when processing specially crafted content to achieve arbitrary code execution.

ā€œProcessing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1.ā€ reads the advisory published by Apple. ā€œA type confusion issue was addressed with improved state handling.ā€

The vulnerability was reported by ClĆ©ment Lecigne of Googleā€™s Threat Analysis Group. At this time there are no public details about the attacks exploiting the vulnerability.

Below are the other zero-day vulnerabilities addressed by Apple since January:

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

PierluigiĀ Paganini

(SecurityAffairsĀ ā€“ hacking, Apple)

The post Apple fixed the tenth actively exploited zero-day this year appeared first on Security Affairs.