{"uuid": "81399feb-747a-4bce-b412-0be02332662a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22675", "type": "seen", "source": "https://t.me/hacking_Attack/53719", "content": "Black Hat Ethical Hacking\nApple emergency update fixes zero-day used to hack Macs, Watches\n\nApple emergency update fixes zero-day used to hack Macs, WatchesPost Views: 3 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nApple has released security updates to address a zero-day vulnerability that threat actors can exploit in attacks targeting Macs and Apple Watch devices.\nZero-days are security flaws that the software vendor is unaware of and hasn\u2019t yet patched. In some cases, this type of vulnerability may also have publicly available proof-of-concept exploits before a patch arrives or may be actively exploited in the wild.\n\nIn security advisories\u00a0issued on Monday, Apple revealed that they\u2019re aware of reports this security bug \u201cmay have been actively exploited.\u201d\n\nThe flaw is an out-of-bounds write issue (CVE-2022-22675) in the AppleAVD (a kernel extension for audio and video decoding) that allows apps to execute arbitrary code with kernel privileges.\n\nThe bug was reported by anonymous researchers and fixed by Apple in macOS Big Sur 11.6., watchOS 8.6, and tvOS 15.5\u00a0with improved bounds checking.\n\nThe list of impacted devices includes Apple Watch Series 3 or late,\u00a0Macs running macOS Big Sur,\u00a0Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD.\n\nWhile Apple disclosed reports of active exploitation in the wild, it did not release any extra info regarding these attacks.\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png By withholding information, the company is likely aiming to allow the security updates to reach as many Apple Watches and Macs as possible before attackers pick up on the zero-day\u2019s details and start deploying exploits in other attacks.\n\nAlthough this zero-day was most probably only used in targeted attacks, it\u2019s still strongly advised to install today\u2019s macOS and watchOS security updates as soon as possible to block attack attempts. Five\u00a0zero-days patched in 2022In January, Apple patched two other zero-days exploited in the wild\u00a0to let attackers gain arbitrary code execution with kernel privileges (CVE-2022-22587) and track web browsing activity and user identities in real-time (CVE-2022-22594).\n\nOne month later, Apple released security updates to patch a new zero-day bug\u00a0(CVE-2022-22620) exploited to hack iPhones, iPads, and Macs, which leads to OS crashes and remote code execution on compromised Apple devices.\nSee Also: Attackers Use Event Logs to Hide Fileless Malware See Also: Offensive Security Tool: malicious-pdf In March, two more actively exploited zero-days\u00a0in the Intel Graphics Driver (CVE-2022-22674) and the AppleAVD media decoder (CVE-2022-22675), the latter also backported today in older versions of macOS,\u00a0in watchOS\u00a08.6, and in tvOS 15.5.\n\nThese\u00a0five zero-days impact iPhones (iPhone 6s and up), Macs running macOS Monterey, and multiple iPad models.\n\nThroughout last year, the company also patched a long list of zero-days exploited in the wild\u00a0to target iOS, iPadOS, and macOS devices. Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Write up: Find hidden and encrypted secrets from any website Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackha[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:49.422118Z"}