Most of the flaws affect the web rendering engine WebKit, an attacker could trick victims into opening a maliciously crafted web content to execute arbitrary code, disclose sensitive user information, bypass sandbox restrictions, or launch universal cross-site scripting attacks on the device.
The WebKit vulnerability tracked as CVE-2019-6222 could be exploited by an attacker to set up a malicious website to potentially access an iOS device microphone without the “microphone-in-use” indicator being shown.
“A website may be able to access the microphone without the microphone use indicator being shown” reads the security advisory published by Apple.
“A consistency issue was addressed with improved state handling.”
Another flaw in WebKit, tracked as CVE-2019-8503, could be exploited to execute scripts in the context of another site.
Another troubling issues is a ReplayKit API bug, tracked as CVE-2019-8566, that could be exploited by a malicious application to access the microphone on vulnerable devices.
“A malicious application may be able to access the microphone without indication to the user.” reads the advisory published by Apple.
“An API issue existed in the handling of microphone data. This issue was addressed with improved validation.”
Apple also fixed a critical vulnerability (CVE-2019-8553) in earlier iOS versions that could lead to arbitrary code execution just by tricking victims into clicking a malicious SMS link.
The CVE-2019-8553 flaw affects iPhone 5s and later, iPad Air and later, and iPod touch 6th generation devices.
Apple addressed a total of six vulnerabilities in iOS kernel. The CVE-2019-8527 flaw could be exploited by a remote attacker to cause the unexpected termination of the system or corrupt kernel memory, while the CVE-2019-8514 flaw could be exploited to elevate privileges.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Apple, iOS 12.2)
[adrotate banner=”5″]
[adrotate banner=”13″]
Nation-state actor UAT4356 has been exploiting two zero-days in ASA and FTD firewalls since November…
A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute…
The Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned four Iranian nationals for their…
A cyber attack on Leicester City Council resulted in certain street lights remaining illuminated all…
The National Police Agency in South Korea warns that North Korea-linked threat actors are targeting…
The U.S. Department of State imposed visa restrictions on 13 individuals allegedly linked to the…
This website uses cookies.