High Threat Security Alert (A26-03-12): Multiple Vulnerabilities in Apple Products

Description:

Apple has released iOS 16.7.15, iPadOS 16.7.15, iOS 15.8.7, iPadOS 15.8.7 to fix the vulnerabilities in various Apple devices. The list of vulnerabilities information can be found at:
https://support.apple.com/en-us/126632
https://support.apple.com/en-us/126646

Reports indicated that remote code execution vulnerabilities (CVE-2023-41974 and CVE-2024-23222) and a denial of service vulnerability (CVE-2023-43000) are being exploited in the wild. System administrators are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

Affected Systems:

• iPhone 6s and later, SE (1st generation), iPhone X
• iPad 5th generation and later, iPad Air 2 and later, iPad mini (4th generation) and later, iPad Pro 9.7-inch, iPad Pro 12.9-inch 1st generation
• iPod touch (7th generation)

For detailed information of the affected systems, please refer to the corresponding security advisories at vendor's website.

Impact:

Depending on the vulnerabilities exploited, a successful attack could lead to remote code execution, denial of service or elevation of privilege on an affected system.

Recommendation:

Patches for affected products are available. Users of affected systems should follow the recommendations provided by the vendor and take immediate actions to mitigate the risk.

The updates can be obtained through the auto-update mechanism. Users of affected systems should follow the recommendations provided by the vendor and take immediate actions to mitigate the risk.

More Information:

• https://support.apple.com/en-us/126632
• https://support.apple.com/en-us/126646
• https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20230922
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41974
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43000
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43010
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23222