If you don’t update the news, update the security errors they resolve

Apple has released iOS 17.5 for iPhone, the fifth major update of iOS 17 which arrives on the eve of the presentation of iOS 18 at WWDC which will be held in early June. This is an update with many new features, including the ability to download applications to the iPhone directly from the web without going through any store, the so-called Side loading.

But iOS 17.5 doesn’t just bring new features, also fixes major security bugs. As revealed by Apple itself, up to 15 serious errors have been fixed in this update. Many of these issues have been actively exploited.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until an investigation has taken place and patches or releases are available. Recent versions are listed on Apple’s Security Releases page.

The 15 security issues fixed by iOS 17.5

All these security issues affected the iPhone 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later. AND from iOS 17.5 they are resolved:

AppleAVD

• Impact: An application may be able to execute arbitrary code with kernel privileges
• Description: The issue has been resolved with better memory management.
• CVE-2024-27804: Meysam Firouzi (@R00tkitSMM)

AppleMobileFileIntegrity

• Impact: an attacker can access user data
• Description: Fixed a logic issue with improved checks.
• CVE-2024-27816: Mickey Jin (@patch1t)

AVEVideoEncoder

• Impact: An application may be able to reveal kernel memory
• Description: The issue has been resolved with better memory management.
• CVE-2024-27841: An anonymous researcher

Seek

• Impact: A malicious application may be able to determine a user’s current location
• Description: Fixed a privacy issue by moving sensitive data to a more secure location.
• CVE-2024-27839: Alexander Heinrich, SEEMOO, TU Darmstadt (@Sn0wfreeze) and Shai Mishali (@freak4pc)

Core

• Impact: an attacker can cause an application to stop unexpectedly or execute arbitrary code.
• Description: The issue has been resolved with better memory management.
• CVE-2024-27818: pattern-f (@pattern_F_) by Ant Security Light-Year Lab

Lib System

• Impact: An application may be able to access protected user data
• Description: A permissions issue was resolved by removing vulnerable code and adding additional checks.
• CVE-2023-42893: An anonymous researcher

Plans

• Impact: An application may be able to read sensitive location information
• Description: Fixed a route management issue with improved validation.
• CVE-2024-27810: LFY@secsys from Fudan University

Market Kit

• Impact: A maliciously crafted web page may be able to distribute a script that tracks users across other web pages.
• Description: Fixed a privacy issue with improved client ID handling for alternative app markets.
• CVE-2024-27852: Talal Haj Bakry and Tommy Mysk of Mysk Inc. (@mysk_co)

Notes

• Impact: An attacker with physical access to an iOS device can access notes from the lock screen.
• Description: This problem was resolved through better state management.
• CVE-2024-27835: AndréEss

Remote Viewing Services

• Impact: an attacker can access user data
• Description: Fixed a logic issue with improved checks.
• CVE-2024-27816: Mickey Jin (@patch1t)

Screenshot

• Impact: An attacker with physical access may be able to share items from the lock screen.
• Description: Fixed a permissions issue with improved validation.
• CVE-2024-27803: An anonymous researcher

Shortcuts

• Impact: A shortcut can generate sensitive user data without consent
• Description: Fixed a route management issue with improved validation.
• CVE-2024-27821: Kirin (@Pwnrin), zbleet and Csaba Fitzl (@theevilbit) from Kandji

Sync Services

• Impact: An app may be able to bypass privacy preferences
• Description: This issue is fixed with improved checks
• CVE-2024-27847: Mickey Jin (@patch1t)

voice command

• Impact: an attacker may be able to elevate their privileges
• Description: The issue has been resolved with improved checks.
• CVE-2024-27796: ajajfxhj

Web Kit

• Impact: An attacker with arbitrary read and write capabilities may be able to bypass pointer authentication.
• Description: The issue has been resolved with improved checks.
• WebKit bug: 272750
• CVE-2024-27834: Manfred Paul (@_manfp) working with Trend Micro’s Zero-Day initiative

THE It is recommended to install iOS 17.5 on your iPhone as soon as possible to fix all these bugs, just like iPadOS 17.5 on your iPad. In addition to the improvements, you will be more protected.