Apple, Google and Microsoft released major patches this month to patch several security flaws already exploited in the attacks. May was also an important month for enterprise software, with GitLab, SAP and Cisco releasing fixes for a number of bugs in their products.
Here’s everything you need to know about the security updates released in May.
Apple iOS and iPad OS 16.5
Apple has released its highly anticipated iOS 16.5 patch update, which addresses 39 issues, three of which are already being exploited in real-life attacks. The iOS upgrade fixes vulnerabilities in the kernel at the heart of the operating system and in WebKit, the engine that drives the Safari browser. Three bugs already in use are among the five fixed in WebKit — tracked as CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373.
CVE-2023-32409 is an issue that could allow a remote attacker to escape the Web Content Sandbox, reported by Clément Lesigne of Google’s Threat Analysis Group and Doncha O’Seyrabhail of Amnesty International’s Security Lab. CVE-2023-28204 is a flaw that poses a risk to a user exposing sensitive information. Finally, CVE-2023-32373 is a free-to-use bug that may allow arbitrary code execution.
Earlier this month, Apple released iOS 16.4.1(a) and iPadOS 16.4.1(a) — the iPhone maker’s first Rapid Security Response updates — that fixed two previous exploitable WebKit vulnerabilities, also patched in iOS 16.5 Did.
Apple iOS and iPadOS 16.5 Released with iOS 15.7.6 and iPadOS 15.7.6 for Older iPhones, as well as iTunes 12.12.9, Safari 16.5, macOS Big Sur 11.7.7, macOS Ventura 13.4, and macOS Monterey 12.6 for Windows were done. 6.
Apple also released its first security updates for Beats and AirPods headphones.
Microsoft’s Patch Tuesday, in the middle of the month, fixed 40 security vulnerabilities, two of which were zero-day bugs that had already been used in attacks. The first zero-day vulnerability, CVE-2023-29336, is an elevation of privilege bug in the Win32k driver that could allow an attacker to gain system privileges.
The second serious flaw, CVE-2023-24932, is an issue with bypassing the Secure Boot protection feature that could allow a privileged attacker to execute code. “An attacker who successfully exploits this vulnerability could bypass Secure Boot,” Microsoft said, adding that exploiting the flaw is difficult: “Successful exploitation of this vulnerability would require an attacker to compromise administrative credentials on the device.” Is required.”
The security update isn’t a complete fix: It addresses the vulnerability by updating the Windows boot manager, which could cause problems, the company warned. Additional steps are needed at this time to mitigate the vulnerability, Microsoft said, referring to steps affected users can take to mitigate the problem.
Google has released its latest Android security patches, fixing 40 bugs including an already exploited kernel vulnerability. The update also includes fixes for issues in the Android Framework, System, Kernel, MediaTek, Unisoc, and Qualcomm components.
The most serious of these issues is a very serious vulnerability in a framework component that could allow local privilege escalation, Google said, adding that the exploit required user interaction.
CVE-2023-0266, previously associated with commercial spyware vendors, is a kernel issue that can cause local privilege escalation. User interaction is not required for the exploit.
Stay connected with us on social media platforms for instant updates, Click here to join us Facebook