• Sat. Sep 24th, 2022


Bank Of America CISCO Mcast news

Apple’s iOS and Google Chrome Updates Repair Severe Safety Flaws


Aug 31, 2022

August was a bumper month for safety patches, with Apple, Google, and Microsoft among the many companies issuing emergency fixes for already exploited vulnerabilities. The month additionally noticed some large fixes arriving from the likes of VMWare, Cisco, IBM, and Zimbra.

Right here’s every thing it is advisable to know concerning the essential safety fixes issued in August.

Apple iOS 15.6.1

After a two-month patch hiatus, adopted by a number of fixes in July, Apple launched an emergency safety replace in August with iOS 15.6.1. The iOS replace mounted two flaws, each of which have been being utilized by attackers within the wild.

It’s thought that the vulnerabilities in WebKit (CVE-2022-32893) and the Kernel (CVE-2022-32894) have been being chained collectively in assaults, with severe penalties. A profitable assault might permit an adversary to take management of your iPhone and entry your delicate information and banking particulars.

Combining the 2 flaws “usually gives all of the performance wanted to mount a tool jailbreak,” bypassing nearly all Apple-imposed safety restrictions, Paul Ducklin, a principal analysis scientist at Sophos, wrote in a weblog analyzing the vulnerabilities. This might doubtlessly permit adversaries to “set up background spy ware and hold you below complete surveillance,” Ducklin defined.

Apple at all times avoids giving out particulars about vulnerabilities till most individuals have up to date, so it’s laborious to know who the assault targets have been. To make sure you are protected, it is best to replace your units to iOS 15.6.1 immediately.

Apple additionally launched iPadOS 15.6.1, watchOS 8.7.1, and macOS Monterey 12.5.1, all of which it is best to replace on the subsequent alternative.

Google Chrome

Google launched a safety replace in August to repair its fifth zero-day flaw this yr. In an advisory, Google listed 11 vulnerabilities mounted in August. The patches embrace a use-after-free flaw in FedCM—tracked as CVE-2022-2852 and rated as essential—in addition to six extremely rated points and three classed as having a medium influence. One of many extremely rated vulnerabilities has been exploited by attackers, CVE-2022-2856.

Google hasn’t supplied any element concerning the exploited flaw, however since attackers have gotten ahold of the small print, it’s a good suggestion to replace Chrome now.

Earlier in August, Google launched Chrome 104, fixing 27 vulnerabilities, seven of which have been rated as having a excessive influence.

Google Android

The August Android safety patch was a hefty one, with dozens of fixes for severe vulnerabilities, together with a flaw within the framework that might result in native privilege escalation with no extra privileges wanted. In the meantime, a difficulty within the media framework might result in distant data disclosure, and a flaw within the system might result in distant code execution over Bluetooth. A vulnerability in kernel elements might additionally result in native escalation of privileges.

The Android safety patch was late in August, however it’s now accessible on such units as Google’s Pixel vary, the Nokia T20, and Samsung Galaxy units (together with the Galaxy S collection, Galaxy Notice collection, Galaxy Fold collection, and Galaxy Flip collection).


Microsoft’s August Patch Tuesday mounted over 100 safety flaws, of which 17 are rated as essential. Among the many fixes was a patch for an already exploited flaw tracked as CVE-2022-34713, also called DogWalk.

The distant code execution (RCE) flaw within the Home windows Assist Diagnostic Device (MDST) is rated as having a excessive influence as a result of exploiting it may end up in a system compromise. The vulnerability, which impacts all customers of Home windows and Home windows Server, was first uncovered over two years in the past in January 2020, however Microsoft didn’t contemplate it a safety challenge on the time.


VMWare mounted a bunch of flaws in August, together with a essential authentication bypass bug tracked as CVE-2022-31656. On releasing the patch, the software program agency warned that public exploit code is out there.

VMWare additionally mounted an RCE vulnerability in VMware Workspace ONE Entry, Identification Supervisor, and Aria Automation (previously vRealize Automation), tracked as CVE-2022-31658 with a CVSS rating of eight. In the meantime, a SQL injection RCE vulnerability present in VMware Workspace ONE Entry and Identification Supervisor additionally acquired a CVSS rating of eight. Each require an attacker to have administrator and community entry earlier than they’ll set off distant code execution.

Supply hyperlink

Leave a Reply

Your email address will not be published.