iOS 12.2 update addresses some troubling vulnerabilities

This week Apple released iOS 12.2 to address 51 security vulnerabilities in the popular mobile operating system running on iPhone 5s and later, iPad Air and later, and iPod touch 6th generation.

Most of the flaws affect the web rendering engine WebKit, an attacker could trick victims into opening a maliciously crafted web content to execute arbitrary code, disclose sensitive user information, bypass sandbox restrictions, or launch universal cross-site scripting attacks on the device.

The WebKit vulnerability tracked as CVE-2019-6222 could be exploited by an attacker to set up a malicious website to potentially access an iOS device microphone without the “microphone-in-use” indicator being shown.

“A website may be able to access the microphone without the microphone use indicator being shown” reads the security advisory published by Apple.

“A consistency issue was addressed with improved state handling.”

Another flaw in WebKit, tracked as CVE-2019-8503, could be exploited to execute scripts in the context of another site.

Another troubling issues is a ReplayKit API bug, tracked as CVE-2019-8566, that could be exploited by a malicious application to access the microphone on vulnerable devices.

“A malicious application may be able to access the microphone without indication to the user.” reads the advisory published by Apple.

“An API issue existed in the handling of microphone data. This issue was addressed with improved validation.”

Apple also fixed a critical vulnerability (CVE-2019-8553) in earlier iOS versions that could lead to arbitrary code execution just by tricking victims into clicking a malicious SMS link.

The CVE-2019-8553 flaw affects iPhone 5s and later, iPad Air and later, and iPod touch 6th generation devices.

Apple addressed a total of six vulnerabilities in iOS kernel. The CVE-2019-8527 flaw could be exploited by a remote attacker to cause the unexpected termination of the system or corrupt kernel memory, while the CVE-2019-8514 flaw could be exploited to elevate privileges.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Apple, iOS 12.2)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.