iOS 15.3 fixes 10 dangerous security vulnerabilities

This article may contain affiliate links. Learn more on our Partner Program page.

Apple released iOS 15.3, iPadOS 15.3 and more to users worldwide this evening, fixing a total of 10 dangerous security vulnerabilities, including the Safari web browsing issue and a vulnerability that could allow malicious apps to gain root privileges, and more.

The Safari web browsing problem that could leak search history and Google ID was already known. But iOS 15.3 and Co. fix significantly more vulnerabilities, as Apple has now announced. In addition to the security hole in the Safari web browser, other security problems have also been fixed, such as apps gaining root privileges, executing arbitrary code with kernel privileges, accessing user files through an iCloud error and more. Below we have the list that Apple has fixed in the meantime. published has attached. (Photo by blackboard / Bigstockphoto)

• iOS 15: How to use the native iPhone 2FA code generator

iOS 15.3, macOS 12.2 and Co. fix many vulnerabilities

ColorSync

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted file may lead to arbitrary code execution.
• Description: A memory corruption issue was fixed with improved validation.
• CVE-2022-22584: Mickey Jin (@patch1t) from Trend Micro

Crash Reporter

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to gain root privileges
• Description: A logic issue was fixed through improved validation.

iCloud

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: An application may be able to access a user's files
• Description: There was an issue in the path validation logic for symlinks. This issue was resolved with improved path cleanup.
• CVE-2022-22585: Zhipeng Huo (@R3dF09) from Tencent Security Xuanwu Lab (https://xlab.tencent.com)

IOMobileFrameBuffer

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
• Description: A memory corruption issue was fixed with improved input validation.
• CVE-2022-22587: an anonymous researcher, Meysam Firouzi (@R00tkitSMM) of MBition – Mercedes-Benz Innovation Lab, Siddharth Aeri (@b1n4r1b01)

Kernel

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to execute arbitrary code with the privileges of the kernel
• Description: A buffer overflow was fixed through improved memory handling.
• CVE-2022-22593: Peter Nguyễn Vũ Hoàng from STAR Labs

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted STL file may lead to an unexpected application termination or arbitrary code execution.
• Description: An information disclosure issue was addressed through improved state management.
• CVE-2022-22579: Mickey Jin (@patch1t) from Trend Micro

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted email message may result in arbitrary JavaScript execution.
• Description: A validation issue was fixed with improved input sanitization.
• CVE-2022-22589: Heige of the KnownSec 404 Team (knownsec.com) and Bo Qu of Palo Alto Networks (paloaltonetworks.com)

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to arbitrary code execution
• Description: A use-after-free issue was resolved through improved memory management.
• CVE-2022-22590: Toan Pham of Team Orca from Sea Security (security.sea.com)

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may prevent enforcement of the Content Security Policy
• Description: A logical issue was resolved through improved state management.
• CVE-2022-22592: Prakash (@1lastBr3ath)

WebKit storage

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A website may be able to track sensitive user data
• Description: A cross-lineage issue in the IndexDB API was resolved with improved input validation.
• CVE-2022-22594: Martin Bajanik from FingerprintJS