Last week, Apple released a series of small updates to its various operating systems, including iOS 16.3.1, which included a particularly nasty vulnerability that had been exploited by hackers. Apple has now revised its security content document to include another fix for a creepy bug.
The vulnerability, which was also fixed in macOS 13.2.1, tvOS 16.3.1 and watchOS 9.3.1 by Monday’s updated CVE entries, is a denial of service issue discovered by a researcher from the Google Chrome team. :
Security
- Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, iPad mini 5th generation and later
- Impact: Processing a maliciously crafted certificate may lead to denial of service
- Description: A denial of service issue has been resolved with improved input validation.
- CVE-2023-23524: Google Chrome’s David Benjamin
The vulnerability was presumably not exploited in the wild, but is serious enough that Apple waited a week to disclose its contents. Apple says it will not disclose, discuss, or confirm security issues until an investigation has taken place and patches or releases are available.
