Headline
Apple Security Advisory 02-02-2024-1
Apple Security Advisory 02-02-2024-1 - visionOS 1.0.2 addresses a code execution vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-02-02-2024-1 visionOS 1.0.2
visionOS 1.0.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT214070.
Apple maintains a Security Releases page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.
WebKit
Available for: Apple Vision Pro
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue
may have been exploited.
Description: A type confusion issue was addressed with improved
checks.
WebKit Bugzilla: 267134
CVE-2024-23222
Instructions on how to update visionOS are available
at https://support.apple.com/HT214009 To check the software
version on your Apple Vision Pro, open the Settings app and choose
General > About.
All information is also posted on the Apple Security Releases
web site: https://support.apple.com/HT201222.
This message is signed with Apple’s Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmW9aewACgkQX+5d1TXa
IvrZNxAAlUqs8RDuCeo/N9dUGSvXociXTXDrbhZzKZeQ+RQjLNnW9fyUailHNcMM
a2Udpkty1/eDQIWgZxTl8ftcBycxeEsatn29UpYaWNsRLuYPInTKr8LCdv4evUJm
KTnW4xyprG5hKbiVKV17inpxLwF0YyziC5ZTa670f1POT9B7tYRvlj0rvp8OK9+V
Gh/9gEKEwwhvc7DnwvtxIJsNZf0TPcRtjNBYxgXEghT8+a5H3dERVWiMyLepAh8X
Vrf5Hfy0SI792u53LIvN8zP2nLuQr3Sw0ZxxJsUOGNWmyg1SoF2jmAh56Ksh/MbV
fS4EhyfaZTSR4YycFZtuUozAoFiZ+Sk62xTTZGV64DxGvVu6Vr0gOp4K65fNy1QU
L6nkwc89G1TSHdbVlCLtP8VZYFpFlAOmtYklb7e0oGYYrY5QZmQoXoTMmcK/sTcJ
+mBsfHU+zXOXRDQ+XSg/JLtlUy5+jV8JOnT46At+sueVvnRvOyg12Wjuo4dzuzNh
1zDVnmfVRnRRmT6ZXHlTEMcaTmnCk73jZEP00maem6DGHYCjcVAW8MqK3IcHv79U
YKQ+t14ooVbskTPdDHrAzznK3nUQNkC8FytW8Z3bNhdpl1yMKyFJPYROPxRMTJQN
vhZ4nKx1Lz3yaCJsH3dkuKOLvggM9vz/oa3Qv8NKh1loShhj0JU=
=pJSu
-----END PGP SIGNATURE-----
Related news
Red Hat Security Advisory 2024-9680-03 - An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Issues addressed include code execution, out of bounds read, and use-after-free vulnerabilities.
Gentoo Linux Security Advisory 202407-13 - Multiple vulnerabilities have been discovered in WebKitGTK+, the worst of which could lead to arbitrary code execution Versions greater than or equal to 2.44.0:4 are affected.
Ubuntu Security Notice 6631-1 - Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
Debian Linux Security Advisory 5618-1 - Vulnerabilities have been discovered in the WebKitGTK web engine. An anonymous researcher discovered that a maliciously crafted webpage may be able to fingerprint the user. Wangtaiyu discovered that processing web content may lead to arbitrary code execution. Apple discovered that processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited.
For their part, the U.S. did roll out new restrictions on the visas of any foreign individuals who misuse commercial spyware.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2022-48618 (CVSS score: 7.8), concerns a bug in the kernel component. "An attacker with
Apple Security Advisory 01-22-2024-9 - tvOS 17.3 addresses code execution vulnerabilities.
Apple Security Advisory 01-22-2024-7 - macOS Monterey 12.7.3 addresses code execution vulnerabilities.
Apple Security Advisory 01-22-2024-6 - macOS Ventura 13.6.4 addresses bypass and code execution vulnerabilities.
Apple Security Advisory 01-22-2024-3 - iOS 16.7.5 and iPadOS 16.7.5 addresses code execution vulnerabilities.
Apple Security Advisory 01-22-2024-2 - iOS 17.3 and iPadOS 17.3 addresses bypass and code execution vulnerabilities.
Apple Security Advisory 01-22-2024-1 - Safari 17.3 addresses code execution vulnerabilities.
Cyber insurance premiums are expected to rise this year after leveling out in 2023.
Apple has released new security updates for several products including a patch for a zero-day vulnerability which may have been exploited.
Apple on Monday released security updates for iOS, iPadOS, macOS, tvOS, and Safari web browser to address a zero-day flaw that has come under active exploitation in the wild. The issue, tracked as CVE-2024-23222, is a type confusion bug that could be exploited by a threat actor to achieve arbitrary code execution when processing maliciously crafted web content. The tech giant said the problem