Apple has patched two significant zero-day vulnerabilities in its devices that allowed attackers to gain access to internal portions of your operating system and steal data.
Zero-day attacks are defects for which no patch exists since the creators were ignorant of their existence prior to the vulnerability being exploited.
Apple has released security patches for macOS Monterey 12.3.1 and 15.4.1 for iOS and iPadOS, which address known vulnerabilities like as CVE-2022-22674 and CVE-2022-22675.
The first vulnerability, CVE-2022-22674, which affects macOS Monterey, stems from a reading problem outside the system’s bounds, according to Apple’s support page.
This can lead to unrestricted access to kernel memory, allowing hackers to run malicious programs. It was fixed in this situation by enhancing input validation.
CVE-2022-22675, on the other hand, affects iPhone 6s and subsequent models, all iPad Pro models, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch 7th generation, as well as macOS Monterey and iOS 15.4.1 and iPadOS 15.4.1.
Because of a write out of limits bug, an application could execute arbitrary code with kernel privileges in this instance.
In this example, the problem was remedied by strengthening the verification of the restrictions, despite the fact that the technology manufacturer admitted to actively exploiting both flaws.
Last February, Apple published another security patch with versions iOS 15.3.1 and iPadOS 15.3.1 to address a vulnerability (CVE-2022-22620) discovered in the WebKit web browser engine.
In addition, towards the end of January, the manufacturer released a new security patch to prevent the leakage of users’ personal information.
It did so with a third update to iOS 15.3 and iPadOS 15.3, which addressed a vulnerability in the IndexedDB application programming interface (API), which affected both its native web browser and any other browser that used WebKit in iOS 15 and iPadOS 15.