Apple Released Security Update for iOS 12.0.1 & iCloud for Windows

Apple released a security update for its products including iOS 12.0.1 & iCloud for windows along with fixes for 21 critical vulnerabilities.

In this Apple security updates covered mainly iCloud for Windows 7.7 where there are 19 vulnerabilities are reported and 2 vulnerabilities are reported under iOS 12.0.1 by various companies and individuals that affect WebKit.

Ivan Fratric of Google Project Zero alone reported 9 critical vulnerabilities and his findings are playing a major role in this Apple security updates.

Apple Releases Security Updates for iCloud, iOS https://t.co/Sq6OGne376 #NCCIC #cyber #cybersecurity #infosec
— US-CERT (@USCERT_gov) October 8, 2018

iCloud for Windows 7.7 0 – WebKit

CVE-2018-4191 – A memory corruption issue was addressed with improved validation
Impact – Unexpected interaction causes an ASSERT failure in Windows 7 and later version

CVE-2018-4311 -The issue was addressed by removing origin information.
Impact – Cross-origin Security Errors includes the accessed frame’s origin in Windows 7 and later version

CVE-2018-4316 – A memory corruption issue was addressed with improved state management.
Impact: Processing maliciously crafted web content may lead to arbitrary code execution in Windows 7 and later version.

CVE-2018-4299, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359 – Multiple memory corruption issues were addressed with improved memory handling.
Impact: Processing maliciously crafted web content may lead to arbitrary code execution

CVE-2018-4319 -A cross-origin issue existed with “iframe” elements. This was addressed with improved tracking of security origins.
Impact: A malicious website may cause unexpected cross-origin behavior

CVE-2018-4309 – A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation.
Impact – A malicious website may be able to execute scripts in the context of another website

CVE-2018-4197, CVE-2018-4306, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4317, CVE-2018-4318 – A use after free issue was addressed with improved memory management.
Impact: Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2018-4345 – A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation.
Impact: A malicious website may exfiltrate image data cross-origin

iOS 12.0.1 – VoiceOver & Quick Look

CVE-2018-4380 –A lock screen issue allowed access to photos and contacts on a locked device. This issue was addressed by restricting options offered on a locked device
Impact: A local attacker may be able to view photos and contacts from the lock screen

CVE-2018-4379 – A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device.
Impact: A local attacker may be able to share items from the lock screen

Learn how to update the iOS software on your iPhone, iPad, or iPod touch.