iPadOS 17.7.9 Security Update Advisory (Multiple CVEs)

Critical Vulnerability Information iPadOS 17.7.9 Release Date: July 25, 2023 Vulnerability Details Accessibility Impact: Privacy indicators for microphone or camera access may not be correctly displayed. CVE: CVE-2023-42777 Fix: Addressed by adding additional logic. CFNetwork Impact: An attacker may be able to cause unexpected app termination. CVE: CVE-2023-43222 Fix: Addressed by improving error handling. CFNetwork Impact: A denial of service issue was addressed with improved input validation. CVE: CVE-2023-43723 Fix: Addressed by improving input validation. copyfile Impact: An attacker may be able to access protected user data. CVE: CVE-2023-43220 Fix: Addressed with improved isolation of symbolic links. CoreMedia Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory. CVE: CVE-2023-43262 Fix: Addressed with improved bounds checking. CoreMedia Playback Impact: An attacker may be able to access sensitive data. CVE: CVE-2023-43263 Fix: Addressed with improved bounds checking. Find My Impact: An attacker may be able to locate this user. CVE: CVE-2023-31259 Fix: Addressed with additional restrictions. ICU Impact: An out-of-bounds access issue was addressed with improved bounds checking. CVE: CVE-2023-43250 Fix: Addressed with improved bounds checking. ImageIO Impact: An out-of-bounds read was addressed with improved input validation. CVE: CVE-2023-43226 Fix: Addressed with improved input validation. Kernel Impact: A remote attacker may be able to trigger unexpected system termination. CVE: CVE-2023-42824 Fix: Addressed with improved checks. libxslt Impact: Processing a maliciously crafted XML document may lead to memory corruption. CVE: CVE-2023-43265 Fix: Addressed with improved memory handling. Mail Drafts Impact: Remote content may be loaded when the Load Remote Images setting is turned off. CVE: CVE-2023-31258 Fix: Addressed then again improved state management. Notes Impact: An attacker may be able to access sensitive user data. CVE: CVE-2023-43275 Fix: Addressed with improved cross-relation. Sandbox Profiles Impact: An attacker may be able to read a persistent device identifier. CVE: CVE-2023-43278 Fix: Addressed with additional restrictions. WebKit Impact: Processing a maliciously crafted web content may lead to a denial of service. CVE: CVE-2023-43272 Fix: Addressed with improved memory handling. WebKit Impact: Processing a maliciously crafted web content may lead to an unexpected Safe Browsing crash. CVE: CVE-2023-43261 Fix: Addressed with improved memory management. WebKit Impact: Processing a maliciously crafted web content may lead to an unexpected Safe Browsing crash. CVE: CVE-2023-43260 Fix: Addressed with improved memory management.

Goal Reached Thanks to every supporter — we hit 100%!

iPadOS 17.7.9 Security Update Advisory (Multiple CVEs)