Apple has patched a serious security flaw in WebKit affecting iOS, iPadOS, and macOS that allowed arbitrary code execution on a range of Apple devices, with evidence indicating that the issue has been actively exploited.
Experts have advised all Apple users to update their iPhones and iPads to the latest version (15.3.1) to prevent potential attacks caused by accessing maliciously crafted web content.
The flaw affects iPhones as old as the iPhone 6s, all iPad Pro models, iPad Air 2 and later, iPad 5th generation and later, iPad Mini 4th generation and later, and iPod Touch 7th generation.
The same WebKit issue also affects Safari, which prompted Apple to release security updates for its Mac-based browser, available on macOS Big Sur and macOS Catalina. Macs running the latest macOS Monterey have been issued a patch for the operating system itself, version 12.2.1.
The security vulnerability is tracked as CVE-2022-22620 and was disclosed to Apple by an anonymous researcher. In typical fashion, Apple has offered very few details about the vulnerability but said the issue is related to the use after free class, which means it is related to incorrect use of dynamic memory in applications, Kaspersky said in its analysis.
WebKit is a browser engine developed by Apple and mainly used in its Safari browser but also many other applications on Apple's operating systems. It's also present on Linux, as well as Google Chrome and Mozilla Firefox for iPhone.
Owners of affected Apple devices should check for a software update in their device's settings menu, providing they haven't already received a push notification that an update is ready.
The patches mark the third major security update this year for Apple after January's array of security issues, including two zero-day vulnerabilities, were found to affect iPhones, iPads, and Macs.
The vulnerabilities included serious issues which could have led attackers to execute arbitrary code with kernel privileges with some of them also believed to be actively exploited in the wild.
RELATED RESOURCE
Vulnerability and patch management
Keep known vulnerabilities out of your IT infrastructure
Earlier in January, a separate flaw in WebKit was also found that let websites track user's browsing activity and unique identifiers. Described at the time as a 'privacy violation', the bug was particularly troublesome for Apple given its stance on web tracking.
The company released an anti-tracking App Tracking Transparency feature in 2021 which allowed users to opt-in to a device setting that required installed apps to explicitly ask for their ability to collect data allowing them to track users across other apps and websites. A boon to end-user privacy, Meta recently said the feature will cost its business $10 billion.
It follows what was a tricky 2021 in terms of security for Apple. Throughout the course of last year, the company patched numerous zero-day vulnerabilities as well as other security flaws affecting devices in its ecosystem. Most notable among the patches was a fix for the ForcedEntry exploit used by NSO Group's Pegasus spyware to gain a foothold in iPhones.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
-
The threat prevention buyer's guideWhitepaper Find the best advanced and file-based threat protection solution for you
