Stuck inside with nothing to do? Apple fires out security fixes for iOS, macOS, wrist-puters... and something weird called iTunes for Windows
- Reference: 1585119431
- News link: https://www.theregister.co.uk/2020/03/25/apple_patch_update/
- Source link:
The seven updates address dozens of CVE-listed flaws in the firmware and software components of Cupertino's portables and desktops. Since you're stuck inside by the coronavirus pandemic, now's a great time to get patching.
For the flagship iOS, [1]the 13.4 update includes fixes for 30 security holes.
Among the most serious are the bugs in WebKit, the browser engine at the heart of iOS. They include remote code execution (CVE-2020-3897, CVE-2020-9783, CVE-2020-3901, CVE-2020-3895, CVE-2020-3900, CVE-2020-3899), information disclosure (CVE-2020-3894), and cross-site scripting (CVE-2020-3902) blunders.
The iOS kernel also has a potentially serious arbitrary code execution bug (CVE-2020-9785) and an information disclosure flaw (CVE-2020-3914). Both require an attacker to already be running code on a device.
Locally-exploitable arbitrary code execution flaws in Image Processing (CVE-2020-9768), IOHIDFamily (CVE-2020-3919) were also patched. As was a lock screen bypass flaw in Messages (CVE-2020-3891) and two info disclosure flaws in Safari (CVE-2020-9775, CVE-2020-9781) along with a traffic intercept bug in BlueTooth (CVE-2020-9770).
The [2]macOS update (Catalina 10.15.4, security update 2020-002 for Mojave and High Sierra) has fixes for 26 CVE bugs. Among the more interesting are a sudo bug (CVE-2019-19232) that allows commands to be run "as a non-existent user" and a restricted memory access flaw in the Intel Graphics Driver (CVE-2019-14615) as well as what was only described as "multiple issues" in Vim (CVE-2020-9769).
Mac users will also get fixes for the above-mentioned kernel and IOHIDFamily flaws, a sign of just how close iOS and macOS have become. All of the iOS WebKit flaws are also present in the desktop Safari 13.1 [3]update , which is no surprise as the engine powers both the desktop and mobile browsers.
Owners of other Apple gear will also want to check for updates as Apple has posted fixes [4]for watchOS (17 CVE-listed bugs), [5]tvOS (20 CVE entries), and [6]iTunes for Windows (remember that baffling thing? It has 12 bugs fixed.)
Users can get the fixes via the Software Update option. ®
[1] https://support.apple.com/kb/HT211102
[2] https://support.apple.com/en-us/HT211100
[3] https://support.apple.com/en-us/HT211104
[4] https://support.apple.com/en-us/HT211103
[5] https://support.apple.com/en-us/HT211101
[6] https://support.apple.com/en-us/HT211105
Re: Memoji
Are Memoji something to do with that weak version of Bucks fizz the Americans drink?
I'll get my coat
iTunes is still a thing ?
But, we [1]were told that Apple was replacing it and banishing it from its OS.
I guess it's still good enough for Windows users, though.
[1] http://theconversation.com/the-end-is-nigh-for-apples-itunes-as-the-tech-giant-targets-separate-audio-and-video-markets-118257
Re: iTunes is still a thing ?
Obviously they've already proved themselves to be masochists by running Windows
(CVE-2019-19232) that allows commands to be run "as a non-existent user"
sudo developers disputed it was a bug, although added an option to disable it. But my question is: how a non existent user could run commands? It looks to me there are far deeper issues if it is able to run commands.
Re: (CVE-2019-19232) that allows commands to be run "as a non-existent user"
I can only think that if you can run a program as a UID that doesn’t exist on a local machine of some sort you can use that to exploit another machine of some kind.
I don’t really believe that this is a vulnerability and it certainly doesn’t deserve its CVSS score.
iTunes is the new Flash?
Everyone hates it, everyone can't wait for it to die. Yet there is still people using and needing it.
Re: iTunes is the new Flash?
I still use it. I've tried several of the alternatives and none are as convenient, or the ones that are as convenient to use won't play as nicely with all of my music. And running it on the PC is more user-friendly than on mobile devices. Lossless or HBR rips are fine through the attached amp.
I am, however, mightily pissed off at some of the changes as they try to deprecate it. It was a good, central console for controlling the content on my household's various iDevices. However Apple are now trying to make this more difficult.
Books are a particular peeve. I put all of my manuals on my mobile devices, as (obviously) the only times I'm ever going to need them are going to be the times when everything has gone to shit and I'm away from the sources. These are all in PDF, which played nicely with all the other books in the Books reader. However the recent changes have made managing PDFs a right PITA, as I can no longer just add them to my central library and have them propagate everywhere I want them. Instead I have to add them individually to each device, often one book at a time. Of course, Apple's response is "the books you've purchased from the iTunes Store will be automatically downloaded to all of your devices". Thank you very much, that's really helpful.
I'm on it
The best part is they have new Memoji stickers and don't require much of a nasal swab. You never can have too many of those, whatever they are, Memojis that is.