7 ms·

iOS 16.1.1 includes fixes for two libxml vulnerabilities

91 points by nateb2022 4y ago

Kikawala 4y ago
CVE-2022-40303: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc... CVE-2022-40304: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433...
- nwellnhof 4y ago
  More details in the original bug reports which I made public yesterday: https://gitlab.gnome.org/GNOME/libxml2/-/issues/381 https://gitlab.gnome.org/GNOME/libxml2/-/issues/381 https://gitlab.gnome.org/GNOME/libxml2/-/issues/401 https://gitlab.gnome.org/GNOME/libxml2/-/issues/401
  - asdfv09s9d80fu9 4y ago
    slay! really great darknet interview too!!! thanks for your amazing work
gruez 4y ago
No love for devices stuck on ios 15? Yes, it's technically out of support, but less than two weeks ago apple released 15.7.1 which is a security patch.
- radicaldreamer 4y ago
  Should still be supported for security updates, maybe it'll be released in a couple of days.
  - dustyharddrive 4y ago
    Apple doesn’t patch older versions: https://arstechnica.com/gadgets/2022/10/apple-clarifies-security-update-policy-only-the-latest-oses-are-fully-patched/ https://arstechnica.com/gadgets/2022/10/apple-clarifies-secu...
    - kobalsky 4y ago
      they release some security updates for older phones and oses they probably do it in a best effort basis and some fixes are skipped when it's too much work to backport.
    - acdha 4y ago
      That’s not what that says. Apple does not commit to updating older versions for EVERYTHING. That does not mean they don’t patch them at all - here’s the official verbiage: “Upgrades are released much less frequently than updates, and can take a while to install because of their large size. Also, older devices may not be eligible for upgrades because they don’t have the space or power to support the new software. Note: Because of dependency on architecture and system changes to any current version of macOS (for example, macOS 13), not all known security issues are addressed in previous versions (for example, macOS 12).” This matches what we’ve seen before where many updates come out for older versions but they’re not making Red Hat-style efforts to back port patches for ages rather then pushing people to make major upgrades.
    - taspeotis 4y ago
      They are still maintaining iOS 12... https://support.apple.com/en-us/HT213428 https://support.apple.com/en-us/HT213428 Published Date: August 31, 2022
      - JohnTHaller 4y ago
        IIRC iOS 12 is a special case for a specific device set.
        worthless-trash 4y ago
        Do you have any details on why this is the case, thats super interesting.
- lapcat 4y ago
  Also missing are macOS Monterey and Big Sur: https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222
- parker_mountain 4y ago
  Is ios 15 vulnerable? I assume it is, but I can't find a good answer.
  - nateb2022 4y ago
    Yes, iOS 15 is vulnerable to these and probably others.
    - theCrowing 4y ago
      Everything is probably vulnerable to other vulnerabilities...
Gigachad 4y ago
Why are core iOS libraries susceptible to integer overflow vulnerabilities? This seems like a more important issue to address than simply fixing this one instance where it was found.
- favorited 4y ago
  Because it's just like any other open-source library written in an unsafe language.
  - Gigachad 4y ago
    With how much money Apple has and how much they promote security. It's quite shocking how we see a major preventable vulnerability come out pretty much every single month. Some credit to them for fixing these things and rolling out the fixes quickly, but at some point we have to question why iOS needs urgent security patches constantly. And you know that all the large governments have troves of these iOS bugs sitting unreported.
    - KerrAvon 4y ago
      There is a Silver Bullet — and here it is.
    - pjmlp 4y ago
      Because there is the myth of the perfect C coder, and then there is the hard reality.
  - dv_dt 4y ago
    Correction: Because it's just like any other library written in an unsafe language.
_boffin_ 4y ago
Question: - Anyone having any issues with charging their iPad Pro 11/12 <<gen>> after upgrading to 16.1?
- Gigachad 4y ago
  My ipad pro 2021 is charging fine after update.
  - _boffin_ 4y ago
    Looks like there’s an issue with a chip on my mobo of the iPad. Womp womp womp
bumblebritches5 4y ago
pjscott 4y ago
Thank you, Apple friends! You’ve made the world a better place, and I salute your subtle bug-fixing acumen. These can’t have been easy to find, and you have my completely unironic gratitude. (I know this sounds extremely corny, but someone should say it.)
pabs3 4y ago
I note that Debian fixed these a few days earlier. Based on the commits/issues up-thread it sounds like these were embargoed for a while, so I wonder why the difference in release dates between Debian and Apple. https://www.debian.org/security/2022/dsa-5271 https://www.debian.org/security/2022/dsa-5271
smcleod 4y ago
Seems odd that the macOS update for libxml is 600MB and requires a reboot, not to mention that it requires a reboot on macOS ace Ventura - which was toted as not needing reboots for most security updates.

91 points by nateb2022 4y ago

CVE-2022-40303: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc... CVE-2022-40304: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433...

nwellnhof 4y ago
More details in the original bug reports which I made public yesterday: https://gitlab.gnome.org/GNOME/libxml2/-/issues/381 https://gitlab.gnome.org/GNOME/libxml2/-/issues/381 https://gitlab.gnome.org/GNOME/libxml2/-/issues/401 https://gitlab.gnome.org/GNOME/libxml2/-/issues/401
- asdfv09s9d80fu9 4y ago
  slay! really great darknet interview too!!! thanks for your amazing work

gruez 4y ago

No love for devices stuck on ios 15? Yes, it's technically out of support, but less than two weeks ago apple released 15.7.1 which is a security patch.

radicaldreamer 4y ago
Should still be supported for security updates, maybe it'll be released in a couple of days.
- dustyharddrive 4y ago
  Apple doesn’t patch older versions: https://arstechnica.com/gadgets/2022/10/apple-clarifies-security-update-policy-only-the-latest-oses-are-fully-patched/ https://arstechnica.com/gadgets/2022/10/apple-clarifies-secu...
  - kobalsky 4y ago
    they release some security updates for older phones and oses they probably do it in a best effort basis and some fixes are skipped when it's too much work to backport.
  - acdha 4y ago
    That’s not what that says. Apple does not commit to updating older versions for EVERYTHING. That does not mean they don’t patch them at all - here’s the official verbiage: “Upgrades are released much less frequently than updates, and can take a while to install because of their large size. Also, older devices may not be eligible for upgrades because they don’t have the space or power to support the new software. Note: Because of dependency on architecture and system changes to any current version of macOS (for example, macOS 13), not all known security issues are addressed in previous versions (for example, macOS 12).” This matches what we’ve seen before where many updates come out for older versions but they’re not making Red Hat-style efforts to back port patches for ages rather then pushing people to make major upgrades.
  - taspeotis 4y ago
    They are still maintaining iOS 12... https://support.apple.com/en-us/HT213428 https://support.apple.com/en-us/HT213428 Published Date: August 31, 2022
    - JohnTHaller 4y ago
      IIRC iOS 12 is a special case for a specific device set.
      - worthless-trash 4y ago
        Do you have any details on why this is the case, thats super interesting.
lapcat 4y ago
Also missing are macOS Monterey and Big Sur: https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222
parker_mountain 4y ago
Is ios 15 vulnerable? I assume it is, but I can't find a good answer.
- nateb2022 4y ago
  Yes, iOS 15 is vulnerable to these and probably others.
  - theCrowing 4y ago
    Everything is probably vulnerable to other vulnerabilities...

Gigachad 4y ago

Why are core iOS libraries susceptible to integer overflow vulnerabilities? This seems like a more important issue to address than simply fixing this one instance where it was found.

favorited 4y ago
Because it's just like any other open-source library written in an unsafe language.
- Gigachad 4y ago
  With how much money Apple has and how much they promote security. It's quite shocking how we see a major preventable vulnerability come out pretty much every single month. Some credit to them for fixing these things and rolling out the fixes quickly, but at some point we have to question why iOS needs urgent security patches constantly. And you know that all the large governments have troves of these iOS bugs sitting unreported.
  - KerrAvon 4y ago
    There is a Silver Bullet — and here it is.
  - pjmlp 4y ago
    Because there is the myth of the perfect C coder, and then there is the hard reality.
- dv_dt 4y ago
  Correction: Because it's just like any other library written in an unsafe language.

_boffin_ 4y ago

Question: - Anyone having any issues with charging their iPad Pro 11/12 <<gen>> after upgrading to 16.1?

Gigachad 4y ago
My ipad pro 2021 is charging fine after update.
- _boffin_ 4y ago
  Looks like there’s an issue with a chip on my mobo of the iPad. Womp womp womp

bumblebritches5 4y ago

pjscott 4y ago

Thank you, Apple friends! You’ve made the world a better place, and I salute your subtle bug-fixing acumen. These can’t have been easy to find, and you have my completely unironic gratitude. (I know this sounds extremely corny, but someone should say it.)

pabs3 4y ago

I note that Debian fixed these a few days earlier. Based on the commits/issues up-thread it sounds like these were embargoed for a while, so I wonder why the difference in release dates between Debian and Apple. https://www.debian.org/security/2022/dsa-5271 https://www.debian.org/security/2022/dsa-5271

smcleod 4y ago

Seems odd that the macOS update for libxml is 600MB and requires a reboot, not to mention that it requires a reboot on macOS ace Ventura - which was toted as not needing reboots for most security updates.