Apple patches are out – old iPhones get an old zero-day fix at last! - Naked Security

Last year, connected the past time of August 2022, we wrote with mild astonishment, and possibly adjacent a tiny interaction of excitement, astir an unexpected but alternatively important update for iPhones stuck back connected iOS 12.

As we remarked astatine the time, we’d already decided that iOS 12 had slipped (or possibly been softly pushed) disconnected Apple’s radar, and would ne'er beryllium updated again, springiness that the erstwhile update had been a year earlier that, backmost successful September 2021.

But we had to scrap that determination erstwhile iOS 12.5.6 appeared unexpectedly, fixing a mysterious zero-day bug that had been patched several weeks earlier successful Apple’s different products.

Given that the iOS 12 bug fixed backmost past was successful WebKit, Apple’s web rendering motor that’s utilized successful each web browsers connected iDevices, not conscionable successful Safari; fixed that real-world attackers were already known to beryllium exploiting the hole; fixed that browser bugs astir ever mean that simply looking astatine an seemingly guiltless and unimportant-looking web leafage could beryllium capable to implant spyware connected your telephone successful the background…

…we decided that iOS 12.5.6 was an important update to get:

Updates you thought you’d ne'er spot are important to cheque up on, espeically if you ain an older “backup” iPhone that you don’t usage each time immoderate more, oregon that you’ve passed connected to a little tech-savvy subordinate of your family.

Well, here’s immoderate déjà vu each implicit again: Apple’s latest updates conscionable dropped, and arsenic acold arsenic we tin tell, there’s lone one zero-day fix amongst the updates, and erstwhile again it’s for iOS 12!

In fact, that zero-day is the lone bug fixed successful the iOS 12.5.7 update, and it’s got the authoritative bug fig CVE-2022-42856.

That rings a bell

If the bug fig CVE-2022-42856 rings a bell, that’s astir apt due to the fact that Apple fixed it successful 2 rounds of updates to each its different products successful December 2022.

Firstly, determination was a mysterious circular of updates that turned retired to beryllium not truthful overmuch a circular arsenic a solo effort, patching iOS 16.1 up to iOS 16.2.

No different devices successful the Apple unchangeable got updated, not adjacent iOS 15, the erstwhile mentation of iOS that immoderate users stuck to by choice, and others due to the fact that their older phones couldn’t beryllium upgraded to iOS 16.

Secondly, a fewer weeks later, came the updates that someway felt arsenic though they’d been delayed from the archetypal “round”.

At this point, Apple alternatively curiously (or possibly we mean confusingly?) admitted that the update already published for iOS 16 was, successful fact, a spot against CVE-2022-42856, which had been a zero-day bug each along…

…but a zero-day that applied lone to iOS 15.1 and earlier.

In different words, the aboriginal availability of the iOS 16.1.2 update, though it did nary harm, turned retired to person been a “fix” for the 1 mentation of iOS that didn’t request it.

That aboriginal iOS 16 update would overmuch much usefully person made its archetypal quality arsenic an iOS 15 spot instead.

Now iOS 12 joins the club

As you already know, due to the fact that we mentioned the bug fig above, there’s present a belated zero-day patch, for that precise aforesaid bug, that applies to Apple’s oldest extant iOS flavour, namely iOS 12.

Get this update now, due to the fact that the crooks person known astir this 1 for adjacent to 2 months astatine least.

(We’re guessing that the attackers developed a keen involvement successful fine-tuning their CVE-2022-42856 exploit for iOS 12 arsenic soon arsenic the much widely-used iOS 15 got its updates astatine the extremity of 2022.)

Go to Settings > General > Software Update to cheque if you person the spot already, oregon to unit an update if you don’t:

Lots of different updates, too

For each that the critical iOS 12 zero-day patch fixes 1 and lone 1 listed bug, Apple’s different products get a wide scope of patches, though we didn’t find immoderate that are listed arsenic “already actively exploited”.

In different words, nary of the galore bugs fixed successful immoderate products different than iOS 12 number arsenic zero-days, and truthful by patching close distant you are getting up of the crooks, not simply catching up with them.

The updated mentation numbers you’re looking for after you’ve installed the patches are arsenic follows, with their information bulletin pages for casual reference, and the hardware products they use to:

• Bulletin HT213597: iOS 12.5.7. For iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod interaction (6th generation).
• Bulletin HT213603: macOS Big Sur 11.7.3. Typically utilized connected older Macs that don’t enactment the latest versions, specified arsenic the archetypal 12″ MacBook from 2015.
• Bulletin HT213604: macOS Monterey 12.6.3.
• Bulletin HT213605: macOS Ventura 13.2.
• Bulletin HT213598: iOS 15.7.3 and iPadOS 15.7.3. iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod interaction (7th generation).
• Bulletin HT213606: iOS 16.3 and iPadOS 16.3. iPhone 8 and later, iPad Pro (all models), iPad Air 3rd procreation and later, iPad 5th procreation and later, and iPad mini 5th procreation and later
• Bulletin HT213599: watchOS 9.3: Apple Watch Series 4 and later.

As usually happens with Mac updates, there’s a caller mentation of the WebKit rendering motor and the Safari browser, dubbed Safari 16.3, presumably to lucifer the biggest merchandise mentation fig connected the database above, namely iOS 16.3 and iPadOS 16.3

If you person the latest mentation of macOS, namely macOS Ventura 13, this caller Safari mentation arrives on with the macOS update, truthful that’s each you request to download and install.

But if you’re inactive connected macOS 11 Big Sur oregon macOS 12 Monterey, the Safari patches travel arsenic a abstracted download, truthful determination volition beryllium 2 updates waiting for you, not one. (That 2nd update isn’t 1 you forgot from past time!)

• Bulletin HT213600: Safari 16.3. For macOS Big Sur and macOS Monterey.

What to do?

On macOS, use: Apple menu > About this Mac > Software Update…

As mentioned above, connected iPhones and iPads, use: Settings > General > Software Update.

Don’t delay, particularly if you’re inactive moving an iOS 12 device…

…please bash it today!