erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: July 20, 2022

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Apple JavaScriptCore CVE-2022-48503: 2022 Bug Now in KEV. Anyone with iPhones or iPads below iOS/iPadOS 15.6, Macs below Monterey 12.5 or Safari 15.6, Apple TVs below tvOS 15.6, Apple Watches below watchOS 8.7, or Linux apps on WebKitGTK or WPE WebKit below 2.38.0.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2022-48503

Apple JavaScriptCore CVE-2022-48503: 2022 Bug Now in KEV

Fixed since July 2022 and irrelevant to any device updated since then, but an iPhone or iPad still on iOS 15.5 or earlier can be compromised by visiting a web page, and the exploit has circulated in a criminal kit.

Must act: Anyone with iPhones or iPads below iOS/iPadOS 15.6, Macs below Monterey 12.5 or Safari 15.6, Apple TVs below tvOS 15.6, Apple Watches below watchOS 8.7, or Linux apps on WebKitGTK or WPE WebKit below 2.38.0.

Can relax: Any Apple device that has installed an update since mid-2022; even the oldest iOS 15 hardware can run iOS 15.8.8, which is far past the fix.

  1. Pull an OS version report from MDM and flag any iPhone or iPad below iOS/iPadOS 15.6; update it to the newest release it supports (at least iOS 15.8.8).
  2. Check Macs, Apple TVs and Apple Watches against the floors: Monterey 12.5 or Safari 15.6, tvOS 15.6, watchOS 8.7.
  3. On Linux and embedded systems, check WebKitGTK or WPE WebKit and update anything below 2.38.0.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.