iOS 16.4.1 fixes two security vulnerabilities

Apple has released iOS 16.4.1 with a warning that users should update immediately, because iOS 16.4.1 fixes two security vulnerabilities—both of which are being used in real-life attacks.

It should be stressed that both vulnerabilities fixed in iOS 16.4.1 are extremely serious. While it’s impossible to know the details of the attacks and who they target, Apple has issued this update on a weekend, which is very rare.

Apple usually reserves important updates for Mondays or Tuesdays, so the company must have decided the iOS 16.4.1 upgrade was too important to leave, considering that it’s also only just over a week since the release of iOS 16.4.

The iOS 16.4.1 update also fixes some minor bugs, specifically where the pushing hands emoji does not show skin tone variations.

In addition, iOS 16.4.1 fixes an issue where Siri wasn’t responding in some cases.

iOS 16.4.1 Security Fixes

iOS 16.4.1 fixes 2 security issues, the first being an already-exploited flaw in WebKit, the engine that powers Apple’s Safari browser, could allow an attacker to execute code on your device,

The second flaw fixed in iOS 16.4.1, CVE-2023-28206 is an issue in the IOSurfaceAccelerator that could enable an app to execute arbitrary code with kernel privileges.

In both cases, Apple says it is aware of a report that both issues may have been actively exploited.

WebKit

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Description: A use after free issue was addressed with improved memory management.

IOSurfaceAccelerator

Impact: An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

Description: An out-of-bounds write issue was addressed with improved input validation.