It's nearly 2017 and JPEGs, PDFs, font files can hijack your Apple Mac, iPhone, iPad

Get patching now


Apple has distributed a fresh round of security updates to address remote-code execution holes in iOS, macOS, Safari, and the firmware for Apple Watch and AppleTV.

Miscreants who exploit these flaws can take over the vulnerable device – all a victim has to do is open a JPEG or PDF file booby-trapped with malicious code, so get patching before you're caught out.

The fixes come just days before the Cupertino developer of TextEdit is set to hold a special event to introduce a (presumed) refresh of its Mac product line and potentially new iPad tablets.

For those running iOS, the 10.1 release includes updates to address 12 CVE-listed security vulnerabilities in the firmware for the iPhone, iPad and iPod Touch.

Those flaws include a remote code execution flaw in the handling of JPEG images (CVE-2016-4673), a remote code execution bug in WebKit (CVE-2016-4677), local code execution flaws, and a vulnerability in contacts (CVE-2016-4686) that would let an application pull Address Book details even when access has been revoked.

For macOS Sierra (10.12.1), the update brings fixes for 16 CVE-listed vulnerabilities. Those include the CVE-2016-4673 image-handling bug as well as remote code execution flaws that could be triggered by font files (CVE-2016-4667) and PDF files (CVE-2016-4671). Also released was a fix for a denial of service error in Nvidia graphics card drivers (CVE-2016-4663) and a bug that exposed the length of user passwords (CVE-2016-4670).

Included among the latest fixes for iOS and macOS was CVE-2016-4635, a remote audio eavesdropping vulnerability for FaceTime that Apple had previously attempted to remedy in older versions of iOS and OS X.

Apple did not say whether the flaw was exposed in iOS 10.1 and macOS Sierra, or if the fix was an update to an already-installed security measure.

For those running the Safari browser on Sierra and older versions of OS X, Apple has produced patches to address a trio of WebKit flaws that can allow web pages or applications to achieve remote code execution (CVE-2016-4666, CVE-2016-4677) and pull location information (CVE-2016-4676).

Meanwhile, Apple Watch users are advised to update their arm candy to watchOS 3.1 to get fixes for eight CVE-listed flaws, including two flaws in sandbox profiles (CVE-2016-4664, CVE-2016-4665) that allow third-party applications to view image libraries and sound files without permission.

The AppleTV will also get an update for 10 flaws, including the sandbox profiles flaws (CVE-2016-4664, CVE-2016-4665), the WebKit remote code execution bug (CVE-2016-4677), and the CoreGraphics JPEG bug (CVE-2016-4673) patched in other Apple products. ®

Similar topics


Other stories you might like

  • While the iPhone's repairability is in the toilet, at least the Apple Watch 7 is as fixable as the previous model

    Component swaps still a thing – for now

    Apple's seventh-gen Watch has managed to maintain its iFixit repairability rating on a par with the last model – unlike its smartphone sibling.

    The iFixit team found the slightly larger display of the latest Apple Watch a boon for removal via heat and a suction handle. Where the previous generation required a pair of flex folds in its display, the new version turned out to be simpler, with just the one flex.

    Things are also slightly different within the watch itself. Apple's diagnostic port has gone and the battery is larger. That equates to a slight increase in power (1.094Wh from 1.024Wh between 40mm S6 and 41mm S7) which, when paired with the slightly hungrier display, means battery life is pretty much unchanged.

    Continue reading
  • Better late than never: Microsoft rolls out a public preview of E2EE in Teams calls

    Only for one-to-one voice and video, mind

    Microsoft has finally kicked off the rollout of end-to-end-encryption (E2EE) in its Teams collaboration platform with a public preview of E2EE for one-to-one calls.

    It has been a while coming. The company made the promise of E2EE for some one-to-one Teams calls at its virtual Ignite shindig in March this year (https://www.theregister.com/2021/03/03/microsoft_ups_security/) and as 2021 nears its end appears to have delivered, in preview form at least.

    The company's rival in the conference calling space, Zoom, added E2EE for all a year ago, making Microsoft rather late to the privacy party. COO at Matrix-based communications and collaboration app Element, Amandine Le Pape, told The Register that the preview, although welcome, was "long overdue."

    Continue reading
  • Recycled Cobalt Strike key pairs show many crooks are using same cloned installation

    Researcher spots RSA tell-tale lurking in plain sight on VirusTotal

    Around 1,500 Cobalt Strike beacons uploaded to VirusTotal were reusing the same RSA keys from a cracked version of the software, according to a security researcher who pored through the malware repository.

    The discovery could make blue teams' lives easier by giving them a clue about whether or not Cobalt Strike traffic across their networks is a real threat or an action by an authorised red team carrying out a penetration test.

    Didier Stevens, the researcher with Belgian infosec firm NVISO who discovered that private Cobalt Strike keys are being widely reused by criminals, told The Register: "While fingerprinting Cobalt Strike servers on the internet, we noticed that some public keys appeared often. The fact that there is a reuse of public keys means that there is a reuse of private keys too: a public key and a private key are linked to each other."

    Continue reading

Biting the hand that feeds IT © 1998–2021