The Safari WebKit bug that allowed cross-origin tracking of users' browsing on the internet has also been patched by Apple, with improved input validation for the IndexedDB application programming interface storage component. 'They didn't answer me for like two months, so I decided to report to Apple directly,' Firouzi said.įirouzi said his work on Apple-related security is a hobby.Īpple's set of security updates address several serious vulnerabilities, many of which can be used to execute arbitrary code with high level privileges. The security researcher reported the vulnerability through Trend Micro's Zero Day Initative three months ago, but did not receive a response.

Proof-of-concept code for the zero-day has been published by Firouzi and Aeri.įirouzi explained that the vulnerability he discovered would be part of an exploit chain.Īn attacker would need to get remote code execution via NSO Group's PDF exploit, and 'then use my vulnerability to get more access to the device,' Firouzi said. Security Update 2010-005 is available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.4, Mac OS X Server v10.6.4 via Software Update or direct download. The vulnerability, indexed as CVE-2022-22587, was reported to Apple independently by an anonymous researcher, Siddharth Aeri and Meysam Firouzi.įirouzi, who works at the Mercedes-Benz Innovation Lab on car security, told iTnews that he came across the vulnerability by fuzzing the kernel and doing static analysis.Īpple's security advisory said the bug is due to a memory corruption issue in iOS and macOS.Ī malicious application abusing the flaw could execute arbitrary code with high kernel privileges. Apple has issued security patches for iOS and iPadOS 15.3, and for macOS Monterey 12.2, to plug a vulnerability that the company said is being exploited in the wild.

Mac os security patches