Apple released iOS 16.3 last month, and when you upgraded to it, there were many new features along for the ride, as well as several security improvements. Apple waited until Monday to release three more updates.
Apple claims it "doesn't disclose, discuss, or confirm security issues until an investigation has taken place or patches or releases are available."
Security Updates for iOS 16.3 and macOS 13.2
The three new updates are the following:
iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
Impact: A user might be able to access arbitrary files as root.
Description: With additional validation, a race condition was addressed.
Cees Elzinga is a CVE-2023-23520.
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to execute arbitrary code out of its sandbox or with certain enhanced privileges.
Description: Improved memory handling helped resolve the issue.
Austin Emmitt, a senior security researcher at Trellix ARC, has been CVE-2023-23530.
Apple iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to execute arbitrary code outside of its sandbox or with certain elevated privileges.
Description: Improved memory handling helped address the problem.
Austin Emmitt, a senior security researcher at Trellix ARC, is the subject of CVE-2023-23531.
Other Security Patches
This week, Apple unveiled a previously unreported security patch for iOS 16.3.1 and macOS 13.2.1.
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later.
Impact: A maliciously crafted certificate might be processed and result in a denial-of-service.
Description: Improved input validation solved a denial-of-service concern.
David Benjamin of Google Chrome has been identified as CVE-2023-23524.
iOS 16.3.1 is now available, which includes all of the features and fixes from iOS 16.3.
