Apple Security Advisory 10-28-2024-1

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256APPLE-SA-10-28-2024-1 iOS 18.1 and iPadOS 18.1iOS 18.1 and iPadOS 18.1 addresses the following issues.Information about the security content is also available athttps://support.apple.com/121563.Apple maintains a Security Releases page athttps://support.apple.com/100100 which lists recentsoftware updates with security advisories.AccessibilityAvailable for: iPhone XS and laterImpact: An attacker with physical access to a locked device may be ableto view sensitive user informationDescription: The issue was addressed with improved authentication.CVE-2024-44274: Rizki Maulana (rmrizki.my.id), Matthew Butler, JakeDerouinApp SupportAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: A malicious app may be able to run arbitrary shortcuts withoutuser consentDescription: A path handling issue was addressed with improved logic.CVE-2024-44255: an anonymous researcherCoreMedia PlaybackAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: A malicious app may be able to access private informationDescription: This issue was addressed with improved handling ofsymlinks.CVE-2024-44273: pattern-f (@pattern_F_), Hikerell of Loadshine LabCoreTextAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Processing a maliciously crafted font may result in thedisclosure of process memoryDescription: The issue was addressed with improved checks.CVE-2024-44240: Hossein Lotfi (@hosselot) of Trend Micro Zero DayInitiativeCVE-2024-44302: Hossein Lotfi (@hosselot) of Trend Micro Zero DayInitiativeFoundationAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Parsing a file may lead to disclosure of user informationDescription: An out-of-bounds read was addressed with improved inputvalidation.CVE-2024-44282: Hossein Lotfi (@hosselot) of Trend Micro Zero DayInitiativeImageIOAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Processing an image may result in disclosure of process memoryDescription: This issue was addressed with improved checks.CVE-2024-44215: Junsung Lee working with Trend Micro Zero Day InitiativeImageIOAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Processing a maliciously crafted message may lead to a denial-of-serviceDescription: The issue was addressed with improved bounds checks.CVE-2024-44297: Jex AmroIOSurfaceAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An app may be able to cause unexpected system termination orcorrupt kernel memoryDescription: A use-after-free issue was addressed with improved memorymanagement.CVE-2024-44285: an anonymous researcheriTunesAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: A remote attacker may be able to break out of Web ContentsandboxDescription: A custom URL scheme handling issue was addressed withimproved input validation.CVE-2024-40867: Ziyi Zhou (@Shanghai Jiao Tong University), Tianxiao Hou(@Shanghai Jiao Tong University)KernelAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An app may be able to leak sensitive kernel stateDescription: An information disclosure issue was addressed with improvedprivate data redaction for log entries.CVE-2024-44239: Mateusz Krzywicki (@krzywix)Managed ConfigurationAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Restoring a maliciously crafted backup file may lead tomodification of protected system filesDescription: This issue was addressed with improved handling ofsymlinks.CVE-2024-44258: Hichem Maloufi, Christian Mina, Ismail AmzdakMobileBackupAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Restoring a maliciously crafted backup file may lead tomodification of protected system filesDescription: A logic issue was addressed with improved file handling.CVE-2024-44252: Nimrat Khalsa, Davis Dai, James Gill(@[email protected])Pro ResAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An app may be able to cause unexpected system termination orcorrupt kernel memoryDescription: The issue was addressed with improved memory handling.CVE-2024-44277: an anonymous researcher and Yinyi Wu(@_3ndy1) from DawnSecurity Lab of JD.com, Inc.Safari DownloadsAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An attacker may be able to misuse a trust relationship todownload malicious contentDescription: This issue was addressed through improved state management.CVE-2024-44259: Narendra Bhati, Manager of Cyber Security at Suma SoftPvt. Ltd, Pune (India)Safari Private BrowsingAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Private browsing may leak some browsing historyDescription: An information leakage was addressed with additionalvalidation.CVE-2024-44229: Lucas Di TomaseSceneKitAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Processing a maliciously crafted file may lead to heapcorruptionDescription: This issue was addressed with improved checks.CVE-2024-44218: Michael DePlante (@izobashi) of Trend Micro Zero DayInitiativeShortcutsAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An app may be able to access sensitive user dataDescription: This issue was addressed with improved redaction ofsensitive information.CVE-2024-44254: Kirin (@Pwnrin)ShortcutsAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: A malicious app may use shortcuts to access restricted filesDescription: A logic issue was addressed with improved checks.CVE-2024-44269: an anonymous researcherSiriAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An app may be able to access sensitive user dataDescription: This issue was addressed with improved redaction ofsensitive information.CVE-2024-44194: Rodolphe Brunetti (@eisw0lf)SiriAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An attacker with physical access may be able to access contactphotos from the lock screenDescription: This issue was addressed by restricting options offered ona locked device.CVE-2024-40851: Abhay Kailasia (@abhay_kailasia) of Lakshmi NarainCollege of Technology Bhopal India, Srijan PoudelSiriAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An app may be able to access user-sensitive dataDescription: A logic issue was addressed with improved state management.CVE-2024-44263: Kirin (@Pwnrin) and 7feileeSiriAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: A sandboxed app may be able to access sensitive user data insystem logsDescription: An information disclosure issue was addressed with improvedprivate data redaction for log entries.CVE-2024-44278: Kirin (@Pwnrin)SpotlightAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An attacker may be able to view restricted content from the lockscreenDescription: This issue was addressed through improved state management.CVE-2024-44251: Abhay Kailasia (@abhay_kailasia) of Lakshmi NarainCollege of Technology Bhopal IndiaSpotlightAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An attacker may be able to view restricted content from the lockscreenDescription: The issue was addressed with improved checks.CVE-2024-44235: Rizki Maulana (rmrizki.my.id), Dalibor Milanovic,Richard Hyunho Im (@richeeta) with Route Zero SecurityVoiceOverAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: An attacker may be able to view restricted content from the lockscreenDescription: This issue was addressed by restricting options offered ona locked device.CVE-2024-44261: Braylon (@softwarescool)WebKitAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Processing maliciously crafted web content may prevent ContentSecurity Policy from being enforcedDescription: The issue was addressed with improved checks.WebKit Bugzilla: 278765CVE-2024-44296: Narendra Bhati, Manager of Cyber Security at Suma SoftPvt. Ltd, Pune (India)WebKitAvailable for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch3rd generation and later, iPad Pro 11-inch 1st generation and later,iPad Air 3rd generation and later, iPad 7th generation and later, andiPad mini 5th generation and laterImpact: Processing maliciously crafted web content may lead to anunexpected process crashDescription: A memory corruption issue was addressed with improved inputvalidation.WebKit Bugzilla: 279780CVE-2024-44244: an anonymous researcher, Q1IQ (@q1iqF) and P1umer(@p1umer)Additional recognitionAccessibilityWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) of LakshmiNarain College of Technology Bhopal India, Chi Yuan Chang of ZUSO ARTand taikosoup for their assistance.App StoreWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) of LakshmiNarain College of Technology Bhopal India, Chi Yuan Chang of ZUSO ARTand taikosoup for their assistance.CalculatorWe would like to acknowledge Kenneth Chew for their assistance.CalendarWe would like to acknowledge  K宝(@Pwnrin) for their assistance.CameraWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) of LakshmiNarain College of Technology Bhopal India for their assistance.FilesWe would like to acknowledge Chi Yuan Chang of ZUSO ART and taikosoup,Christian Scalese for their assistance.ImageIOWe would like to acknowledge Amir Bazine and Karsten König ofCrowdStrike Counter Adversary Operations, an anonymous researcher fortheir assistance.MessagesWe would like to acknowledge Collin Potter, an anonymous researcher fortheir assistance.NetworkExtensionWe would like to acknowledge Patrick Wardle of DoubleYou & theObjective-See Foundation for their assistance.Personalization ServicesWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) of LakshmiNarain College of Technology Bhopal India, Bistrit Dahal for theirassistance.PhotosWe would like to acknowledge James Robertson, Kamil Bourouiba for theirassistance.Safari Private BrowsingWe would like to acknowledge an anonymous researcher, r00tdaddy fortheir assistance.Safari TabsWe would like to acknowledge Jaydev Ahire for their assistance.SecurityWe would like to acknowledge Bing Shi, Wenchao Li and Xiaolong Bai ofAlibaba Group for their assistance.SettingsWe would like to acknowledge Chi Yuan Chang of ZUSO ART and taikosoup,JS for their assistance.SiriWe would like to acknowledge Bistrit Dahal for their assistance.SpotlightWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) from LNCTBhopal and C-DAC Thiruvananthapuram India for their assistance.Time ZoneWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) of LakshmiNarain College of Technology Bhopal India and Siddharth Choubey fortheir assistance.This update is available through iTunes and Software Update on youriOS device, and will not appear in your computer's Software Updateapplication, or in the Apple Downloads site. Make sure you have anInternet connection and have installed the latest version of iTunesfrom https://www.apple.com/itunes/iTunes and Software Update on the device will automatically checkApple's update server on its weekly schedule. When an update isdetected, it is downloaded and the option to be installed ispresented to the user when the iOS device is docked. We recommendapplying the update immediately if possible. SelectingDon't Install will present the option the next time you connectyour iOS device.The automatic update process may take up to a week depending onthe day that iTunes or the device checks for updates. You maymanually obtain the update via the Check for Updates buttonwithin iTunes, or the Software Update on your device.To check that the iPhone, iPod touch, or iPad has been updated:* Navigate to Settings* Select General* Select About. The version after applying this update will be"iOS 18.1 and iPadOS 18.1".All information is also posted on the Apple Security Releasesweb site: https://support.apple.com/100100.This message is signed with Apple's Product Security PGP key,and details are available at:https://www.apple.com/support/security/pgp/-----BEGIN PGP SIGNATURE-----iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmcf/dUACgkQX+5d1TXaIvqm0BAApx/I4XTM2+r/UgcEZEbgh0EpJ1eAh4YUjhhfju7hcytJK5hFtXAWoOr8n9ZBIWz2ulzpXnjFkP6NySC6gyPPeF0Mb3TjWcUz9HaSwbscaLaHQOMSHs5+g6npuJreJ0oC3HS1YQiBAuHcjgg/v9QWqP33osue2gF40ywGTfmjIQp1W8Pgm9iUIIiV2whN5M0UWUg4ioxkCI5wol9cE6HYsD38u45RuqkBNa1DEOta4rpHK8t+Tku7nqKP0aH3EPyahxvW5mTG1f0M5yesYrf5xA7XCnwelvHLan+FmtxiCCtlzAyrIeDrut27oBJNN9ypoMC0h9wz8lNw2Z8r/8OzSGBhmQOaIFs3aFDck2k/itvaYscCIZp1hwcU3sQ14mygrxJQCzRJt2P0WNZDQEN3z8qTMfPa22w+0CfjzavCeqJBUAPcz9lVLqzs6wrssaK/MbKA1MleFY1UcfxEPKr2jJ/c1zwxG32OsHowHyYhcrWlURIQO3onCdcDY664cEelaOlm+PkDUY+AWOOOTGB/UpV7JzRFl6oG6VqFFyigd7ukYnZ6R6gRwmhzF13x3VrrynWuQfuuc5nFNI+6K19tjqX6O9p+5bUcK5Pmrs3EglWd3OLIauWLcy4oJGe0KeD70kWoXDCwHFzTQl3MwdMmxAJomsjEUre1ghUifCc/vDs==1SoX-----END PGP SIGNATURE-----