Apple out-of-band patches fix remote code execution bugs in iOS and macOS

Apple released out-of-band patches for iOS and macOS to fix a couple of code execution vulnerabilities in the libxml2 library.

Apple released out-of-band patches for iOS and macOS to address two code execution flaws, tracked as CVE-2022-40303 and CVE-2022-40304, in the libxml2 library for parsing XML documents.

The two vulnerabilities were discovered by Google Project Zero security researchers.

A remote attacker can trigger the vulnerabilities to cause unexpected app termination or arbitrary code execution.

The CVE-2022-40303 flaw is an integer overflow that was addressed through improved input validation. The issue was discovered by Maddie Stone of Google Project Zero.

The CVE-2022-40304 flaw was discovered by Ned Williamson and Nathan Wachholz of Google Project Zero, Apple addressed it with improved checks.

“When an entity reference cycle is detected, the entity content is cleared by setting its first byte to zero. But the entity content might be allocated from a dict. In this case, the dict entry becomes corrupted leading to all kinds of logic errors, including memory errors like double-frees.” reads the description for this issue.

The IT giant fixed the issues with the release of macOS Ventura 13.0.1 and iOS 16.1.1 and iPadOS 16.1.1.

The good news is that Apple is not aware of attacks in the wild exploiting the two flaws, despite a proof-of-concept (PoC) code for the CVE-2022-40303 is available online.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, iOS)

[adrotate banner=”5″]

[adrotate banner=”13″]