It’s very rare for them to go public like this, which means everyone should take this threat seriously and update as soon as they are able.” “Apple usually rely on software updates to keep their platforms safe and hope that any bugs go largely unnoticed between releases. “Sometimes platform providers release functions that are so dangerous they need to be fixed immediately to protect applications and devices, and that appears to be the case here,” he said. Unlike Microsoft, Apple does not adhere to any specific schedule for disclosing vulnerabilities or publishing fixes for them, but Comparitech’s Brian Higgins said the fact that Apple had taken the step of issuing an advisory for the two zero-days made them highly impactful. The relevant patches update macOS Monterey to version 12.5.1, iOS and iPadOS to version 15.6.1, and Safari to version 15.6.1 for macOS Big Sur and macOS Catalina. Users can check their update status and download patches through Apple Menu – About this Mac – Software Update on a Mac, or Settings – General – Software Update on an iPhone or iPad. Kernel vulnerabilities are among some of the most dangerous security issues that a device can face, and so these patches should be prioritised for deployment by organisations running Apple estates.Ĭonsumer users will also be at risk of compromise, but should bear in mind that Apple devices can and do take such updates automatically so they may already have applied the patches. In layman’s terms, this could give them total control of the device.ĬVE-2022-32894 enables a threat actor to use a malicious application to execute arbitrary code with kernel privileges, with the end effect again being to gain control of the target device. Successfully exploited, CVE-2022-32893 enables a threat actor to achieve arbitrary code execution if the targeted user visits a maliciously crafted website. Apple said it was aware of reports that both vulnerabilities may already have been actively exploited in the wild – making the need to patch more urgent.

Both are out-of-bounds write issues that affect the Safari WebKit web browser extension, and the OS kernel, respectively.

Apple mac security update