{"uuid": "a3f03dd7-2ab0-44fd-98ef-6e519c1c861c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22675", "type": "seen", "source": "https://t.me/hacking_Attack/48382", "content": "Black Hat Ethical Hacking\nApple emergency update fixes zero-days used to hack iPhones, Macs\n\nApple emergency update fixes zero-days used to hack iPhones, MacsPost Views: 16 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nApple has released security updates on Thursday to address two zero-day vulnerabilities exploited by attackers to hack iPhones, iPads, and Macs.\nZero-day\u00a0security bugs are flaws the software\u00a0vendor is unaware of and\u00a0hasn\u2019t patched. In some cases, they also have publicly available proof-of-concept exploits or may be\u00a0actively exploited in the wild.\n\nIn security advisories\u00a0published today, Apple said that they\u2019re aware of reports the issues \u201cmay have been actively exploited.\u201d\n\nThe two flaws are an out-of-bounds write issue (CVE-2022-22674) in the Intel Graphics Driver that allows apps to read kernel memory and an out-of-bounds read issue (CVE-2022-22675) in the AppleAVD media decoder that will enable apps to execute arbitrary code with kernel privileges.\n\nThe bugs were reported by anonymous researchers\u00a0and fixed by Apple in iOS 15.4.1, iPadOS 15.4.1, and macOS Monterey 12.3.1 with\u00a0improved input validation and\u00a0bounds checking, respectively.\n\nThe list of impacted devices includes:\n\n* Macs running macOS Monterey\n* iPhone\u00a06s and later\n* iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\n\nApple disclosed\u00a0active exploitation in the wild, however, it did not release any additional info regarding these attacks.\n\nWithholding this information is likely designed to allow the security updates to reach as many iPhones, iPads, and Macs as possible before threat actors pick up on the details and start abusing the now-patched zero-days.\n\nEven though these\u00a0zero-days were\u00a0likely only used in targeted attacks, it\u2019s still strongly advised to install today\u2019s security updates as soon as possible to block potential attack attempts.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Five zero-days patched by Apple this yearIn January, Apple patched two more actively exploited zero-days\u00a0that can enable attackers to achieve arbitrary code execution with kernel privileges (CVE-2022-22587) and track web browsing activity and the users\u2019 identities in real-time (CVE-2022-22594).\n\nIn February, Apple released security updates to fix a new zero-day bug\u00a0exploited to hack iPhones, iPads, and Macs, leading to OS crashes and remote code execution on compromised devices after processing maliciously crafted web content.\n\nThese first three zero-days also impacted iPhones (iPhone 6s and up), Macs running macOS Monterey, and multiple iPad models.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The company also had to deal with an almost unending stream of zero-days exploited in the wild\u00a0to target iOS, iPadOS, and macOS devices throughout 2021.\n\nThat list includes multiple flaws used to deploy NSO\u2019s Pegasus spyware\u00a0on iPhones belonging to journalists, activists, and politicians. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Lizard Squad \u2013 the infamous hacking group that brought Xbox and PlayStation networks to their knees. Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:01.546070Z"}