When Apple dropped iOS 18.2 today, the headlines were mostly focused on big changes, including new Apple Intelligence features like Image Playground and Genmoji. But the quiet side of any Apple software release surrounds its security patches. iOS 18.2 is no exception: The company dropped 20 fixes for security flaws affecting iPhone running iOS 18.1.1 and older. And while none of them appear to be actively exploited at this time, they underscore the importance of updating your device as soon as possible.
Apple fixed issues with call muting, Lock Screen privacy, and malicious processing
When I scrolled through the list of fixes, a few jumped out to me in particular. First is the fix for an Audio flaw in which muting a call while its ringing might mean the mute function fails. It goes without saying that you should be able to trust the mute button when on a call, so any issue that might result in that mute button failing is concerning. Luckily, Apple says it fixed an “inconsistent user interface” to address the issue. Another concerning flaw affects VoiceOver: Via a flaw in this screen reader function, an attacker would be able to read your notifications on your Lock Screen, when normally these alerts would be hidden until your iPhone was unlocked.
There are also a number of fixes that prevent malicious apps, images, files, and web content from wreaking havoc on your device. An AppleMobileFileIntegrity flaw, for example, allows a malicious app to access your private information, while a SceneKit flaw allows a malicious file to lead to a denial of service, which could lock an authorized user out of the device.
The good news is it appears no one has been in active danger of being attacked with any of these flaws: Apple did not disclose that any have been actively exploited, which suggests malicious users either don’t know about the flaws, or don’t know how to take advantage of them. That said, now that these flaws are exposed, it’s only a matter of time before bad actors figure out how to exploit them, so updating your iPhone as soon as possible is still the smart move.
You can see the full list of flaws below:
-
AppleMobileFileIntegrity (CVE-2024-54526): A malicious app may be able to access private information. The issue was addressed with improved checks.
-
AppleMobileFileIntegrity (CVE-2024-54527): An app may be able to access sensitive user data. This issue was addressed with improved checks.
-
Audio (CVE-2024-54503): Muting a call while ringing may not result in mute being enabled. An inconsistent user interface issue was addressed with improved state management.
-
Crash Reporter (CVE-2024-54513): An app may be able to access sensitive user data. A permissions issue was addressed with additional restrictions.
-
FontParser (CVE-2024-54486): Processing a maliciously crafted font may result in the disclosure of process memory. The issue was addressed with improved checks.
-
ImageIO (CVE-2024-54500): Processing a maliciously crafted image may result in disclosure of process memory. The issue was addressed with improved checks.
-
Kernel (CVE-2024-54494): An attacker may be able to create a read-only memory mapping that can be written to. A race condition was addressed with additional validation.
-
Kernel (CVE-2024-54510): An app may be able to leak sensitive kernel state. A race condition was addressed with improved locking.
-
Kernel (CVE-2024-44245): An app may be able to cause unexpected system termination or corrupt kernel memory. The issue was addressed with improved memory handling.
-
libexpat (CVE-2024-45490): A remote attacker may cause an unexpected app termination or arbitrary code execution. This is a vulnerability in open source code and Apple Software is among the affected projects.
-
libxpc (CVE-2024-54514): An app may be able to break out of its sandbox. The issue was addressed with improved checks.
-
libxpc (CVE-2024-44225): An app may be able to gain elevated privileges. A logic issue was addressed with improved checks.
-
Passwords (CVE-2024-54492): An attacker in a privileged network position may be able to alter network traffic. This issue was addressed by using HTTPS when sending information over the network.
-
Safari (CVE-2024-44246): On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website. The issue was addressed with improved routing of Safari-originated requests.
-
SceneKit (CVE-2024-54501): Processing a maliciously crafted file may lead to a denial of service. The issue was addressed with improved checks.
-
VoiceOver (CVE-2024-54485): An attacker with physical access to an iOS device may be able to view notification content from the lock screen. The issue was addressed by adding additional logic.
-
WebKit (CVE-2024-54479/CVE-2024-54502): Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved checks.
-
WebKit (CVE-2024-54508): Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling.
-
WebKit (CVE-2024-54505): Processing maliciously crafted web content may lead to memory corruption. A type confusion issue was addressed with improved memory handling.
-
WebKit (CVE-2024-54534): Processing maliciously crafted web content may lead to memory corruption. The issue was addressed with improved memory handling.
Apple also released security updates for iPadOS, macOS Sequoia, macOS Sonoma, macOS Ventura, watchOS, tvOS, and visionOS. If you have any of these devices, you should update them as soon as possible as well.
