{"id":7087,"date":"2022-01-27T01:48:08","date_gmt":"2022-01-27T01:48:08","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/27\/apple-update-patches-serious-safari-vulnerability-that-exposes-user-data\/"},"modified":"2022-01-27T01:48:08","modified_gmt":"2022-01-27T01:48:08","slug":"apple-update-patches-serious-safari-vulnerability-that-exposes-user-data","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/27\/apple-update-patches-serious-safari-vulnerability-that-exposes-user-data\/","title":{"rendered":"Apple update patches serious Safari vulnerability that exposes user data"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Apple Inc. has released a software update for iPhones, iPads and Apple Watch users that patches several security issues.<\/p>\n

iOS 14.3, iPadOS 14.3 and watchOS 8.4 first and foremost address a serious vulnerability that was revealed Jan. 17<\/a>. In Apple\u2019s Safari and related WebKit code, the vulnerability could leak a users\u2019 identity and website history.<\/p>\n

The vulnerability related to\u00a0Safari 15\u2019s implementation of the IndexedDB application programming interface. IndexedDB is a browser API for client-side storage designed to hold significant amounts of data and is found in many browsers.<\/p>\n

The implementation involved Apple\u00a0violating the \u201csame-origin\u201d policy that prevents documents and scripts in one location from interacting with content from another. As a result, a malicious website could find Google LLC account information and history from open tabs and windows.<\/p>\n

Apple describes the Safari\/WebKit patch in its iOS 15.3 release notes<\/a> as \u201ca website may be able to track sensitive user information\u201d with the fix described as \u201ca\u00a0cross-origin issue in the IndexDB API was addressed with improved input validation.\u201d<\/p>\n

The\u00a0IndexedDB vulnerability wasn\u2019t the only thing patched in the release. Three other WebKit vulnerabilities were addressed along with issues with Model I\/O, kernel, IOMobile Frame Buffer, iCloud, Crash Reporter and ColorSync.<\/p>\n

\u201cApple\u2019s recent security patches address vulnerabilities found not just in their laptop OS but their mobile operating systems as well,\u201d\u00a0Mike Parkin, engineer at enterprise cyber risk remediation company Vulcan Cyber Ltd.<\/a>, told SiliconANGLE. \u201cWhile many organizations don\u2019t always consider mobile operating systems part of their threat surface, with the increase in remote work, mobile devices are very much something they need to consider.\u201d<\/p>\n

John Bambenek, principal threat hunter at IT and security operations firm Netenrich Inc<\/a>. notes that zero-day vulnerabilities that allow remote code execution on mobile devices are among the most dangerous there are.<\/p>\n

\u201cOften, these types of bugs are used by this with significant ill-intent or by governments engaged in human rights abuses,\u201d Bambenek added. \u201cUnfortunately, we will likely see more of these bugs as the year goes on.\u201d<\/p>\n

iPhone and iPad users should go to the Settings app > General> Software Update and tap Install Now to install the update, CNet reports. Apple Watch users should go to\u00a0Settings app > General > Software Update.<\/p>\n

Image: Apple<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n