In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.
The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw “may have been actively exploited” against previous versions.
The bug (CVE-2022-42856) is a type confusion issue in Apple’s Webkit web browser browsing engine.
The flaw was discovered by Clément Lecigne of Google’s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.
Arbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.
Apple addressed the zero-day vulnerability with improved state handling for the following devices iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).
Patch your iPhones, iPads, and macOS Ventura
While Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.
However, as the vulnerability was discovered by Clément Lecigne of Google’s Threat Intelligence Team, we will likely learn more in a future blog post.
This delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.
Even though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today’s security updates as soon as possible.
This is the tenth zero-day fixed by Apple since the start of the year:
