{"uuid": "a8924e52-74a2-4e9a-8ad9-250f1705dc43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22674", "type": "seen", "source": "https://t.me/hacking_Attack/65974", "content": "Black Hat Ethical Hacking\nApple security updates fix 2 zero-days used to hack iPhones\n\nApple security updates fix 2 zero-days used to hack iPhonesPost Views: 3 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple has released emergency security updates today to fix two zero-day vulnerabilities previously exploited by attackers to hack iPhones, iPads, or Macs.Zero-day\u00a0vulnerabilities are security flaws known by attackers or researchers before the software vendor has become aware or been able to patch them. In many cases, zero-days have public proof-of-concept exploits or are actively exploited in attacks.\n\nToday, Apple has released macOS Monterey 12.5.1 and \u00a0iOS 15.6.1/iPadOS 15.6.1 to resolve two zero-day vulnerabilities that are reported to have been actively exploited.\n\nThe two vulnerabilities are the same for all three operating systems, with the first tracked as CVE-2022-32894. This vulnerability is an\u00a0out-of-bounds write vulnerability in the operating system\u2019s Kernel.\n\nThe\u00a0kernel is a program that operates as the core component of an operating system and has the highest privileges in macOS, iPadOS, and iOS.\n\nAn application, such as malware, can use this vulnerability to execute code with Kernel privileges. As this is the highest privilege level, a process would be able to perform any command on the device, effectively taking complete control over it.\n\nThe second zero-day vulnerability is CVE-2022-32893 and is an out-of-bounds write vulnerability in WebKit, the web browser engine used by Safari and other apps that can access the web.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nApple says this flaw would allow an attacker to perform arbitrary code execution and, as it\u2019s in the web engine, could likely be exploited remotely by visiting a maliciously crafted website.\n\nThe bugs were reported by anonymous researchers\u00a0and fixed by Apple in iOS 15.6.1,\u00a0\u00a0iPadOS 15.6.1, and macOS Monterey 12.5.1 with\u00a0improved bounds checking for both bugs.\n\nThe list of devices affected by both vulnerabilities are:\n\n* Macs running macOS Monterey\n* iPhone\u00a06s and later\n* iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\n\nApple disclosed\u00a0active exploitation in the wild, however, it did not release any additional info regarding these attacks.\n\nLikely, these zero-days were only used in targeted attacks, but it\u2019s still strongly advised to install today\u2019s security updates as soon as possible.\nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo\nTrending: OSINT Tool: Blackbird Seven\u00a0zero-days patched by Apple this yearIn March, Apple patched two more zero-day bugs\u00a0that were used in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD\u00a0(CVE-2022-22675) that could also be used to execute code with Kernel privileges.\n\nIn January, Apple patched two more actively exploited zero-days\u00a0that enabled attackers to achieve arbitrary code execution with kernel privileges (CVE-2022-22587) and track web browsing activity and the users\u2019 identities in real-time (CVE-2022-22594).\n\nIn February, Apple released security updates to fix a new zero-day bug\u00a0exploited to hack iPhones, iPads, and Macs, leading to OS crashes and remote code execution on compromised devices after processing maliciously crafted web content.\nTrending: Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:26.240923Z"}