High Threat Security Alert (A23-06-16): Multiple Vulnerabilities in Apple iOS and iPadOS

Description:

Apple has released iOS 15.7.7, iOS 16.5.1, iPadOS 15.7.7 and iPadOS 16.5.1 to fix the vulnerabilities in various Apple devices. The list of vulnerability information can be found at:
https://support.apple.com/en-us/HT213811
https://support.apple.com/en-us/HT213814

Reports indicate that multiple vulnerabilities (CVE-2023-32434, CVE-2023-32435 and CVE-2023-32439) are being actively exploited. Users are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

Apple has released iOS 16.5.1 (a) and iPadOS 16.5.1 (a) to fix a vulnerability in various Apple devices. The details of vulnerability information can be found at:
https://support.apple.com/en-us/HT213823

Apple has released an emergency update to address a new arbitrary code execution vulnerability (CVE-2023-37450) which is being actively exploited. Users are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

Apple announced that the security updates iOS 16.5.1 (a) and iPadOS 16.5.1 (a) might prevent some websites from displaying properly and thus no longer appear available for installation.

Apple has released the security updates iOS 16.5.1 (c) and iPadOS 16.5.1 (c) to address the arbitrary code execution vulnerability (CVE-2023-37450) which is being actively exploited. Users are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

Affected Systems:

• iPhone 6s and later, SE (1st generation)
• iPad 5th generation and later, Air 2 and later, mini (4th generation) and later, Pro (all models)
• iPod touch (7th generation)
• Apple devices running iOS 16.5.1, iOS 16.5.1 (a), iPadOS 16.5.1 and iPadOS 16.5.1 (a)

Impact:

Successful exploitation of the vulnerabilities could lead to arbitrary code execution on an affected device.

Recommendation:

Apple has released new version of iOS and iPadOS to address the issue.

The updates can be obtained through the auto-update mechanism. Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

More Information:

• https://support.apple.com/en-us/HT213811
• https://support.apple.com/en-us/HT213814
• https://support.apple.com/en-us/HT213823
• https://www.hkcert.org/security-bulletin/apple-products-remote-code-execution-vulnerability_20230711
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32434 (to CVE-2023-32435)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32439
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37450