2025年12月15日星期一

Apple Products Multiple Vulnerabilities

Apple Products Multiple Vulnerabilities

Release Date: 15 Dec 2025

RISK: Extremely High Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Apple Products. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, denial of service condition, elevation of privilege, spoofing, sensitive information disclosure, data manipulation and security restriction bypass on the targeted system.

 

Note:

CVE-2025-14174 is being exploited in the wild. The vulnerability is caused by out of bounds memory access in ANGLE which could lead to memory corruption. It allows remote attackers to trigger out-of-bounds memory access via a malicious HTML page, potentially leading to arbitrary code execution in browsers.

 

CVE-2025-43529 is being exploited in an extremely sophisticated attack against specific targeted individuals. The vulnerability is a WebKit use-after-free remote code execution flaw that can be exploited by processing maliciously crafted web content. 

 

Hence, the risk level is rated as Extremely High Risk.

Impact

  • Denial of Service
  • Elevation of Privilege
  • Security Restriction Bypass
  • Information Disclosure
  • Data Manipulation
  • Spoofing
  • Remote Code Execution

System / Technologies affected

  • Versions prior to iOS 26.2 and iPadOS 26.2
  • Versions prior to iOS 18.7.3 and iPadOS 18.7.3
  • Versions prior to macOS Sonoma 14.8.3
  • Versions prior to macOS Sequoia 15.7.3
  • Versions prior to macOS Tahoe 26.2
  • Versions prior to tvOS 26.2
  • Versions prior to watchOS 26.2
  • Versions prior to visionOS 26.2
  • Versions prior to Safari 26.2

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

  • iOS 26.2 and iPadOS 26.2
  • iOS 18.7.3 and iPadOS 18.7.3
  • macOS Sonoma 14.8.3
  • macOS Sequoia 15.7.3
  • macOS Tahoe 26.2
  • tvOS 26.2
  • watchOS 26.2
  • visionOS 26.2
  • Safari 26.2

Vulnerability Identifier

Source

Related Link

於

沒有留言:

發佈留言

訂閱： 發佈留言 (Atom)

Jenkins 多個漏洞

Jenkins 多個漏洞 發佈日期: 2026年03月20日 風險: 中度風險 類型: 伺服器 - 互聯網應用伺服器 於 Jenkins 發現多...