High Threat Security Alert (A23-01-14): Multiple Vulnerabilities in Apple iOS and iPadOS

Description:

Apple has released iOS iOS 12.5.7, iOS 15.7.3, iOS 16.3, iPadOS 15.7.3 and iPadOS 16.3 to fix the vulnerabilities in various Apple devices. The list of vulnerability information can be found at:
https://support.apple.com/en-us/HT213597
https://support.apple.com/en-us/HT213598
https://support.apple.com/en-us/HT213606

Reports indicate that an arbitrary code execution vulnerability (CVE-2022-42856) is being actively exploited. Users are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

Affected Systems:

• iPhone 5s and later, SE (1st generation)
• iPad 5th generation and later, Air and later, mini 2 and later, Pro (all models)
• iPod touch (6th generation and later)

Impact:

Depending on the vulnerability exploited, a successful exploitation could lead to arbitrary code execution, denial of service, information disclosure, privilege escalation or security restriction bypass on an affected device.

Recommendation:

Apple has released new version of iOS and iPadOS to address the issue.

The updates can be obtained through the auto-update mechanism. Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

More Information:

• https://support.apple.com/en-us/HT213597
• https://support.apple.com/en-us/HT213598
• https://support.apple.com/en-us/HT213606
• https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20230126
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42856
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23496
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23498 (to CVE-2023-23500)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23502 (to CVE-2023-23505)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23511 (to CVE-2023-23512)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23517 (to CVE-2023-23519)