![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2019\/03\/ios-software-update-available-icon-600x300-e1558142227486.png\"){kind=icon}
<\/p>\n<\/p>\n
On Tuesday, December 13, Apple released updates for its operating systems. These included iOS and iPadOS 16.2 as well as macOS Ventura 13.1, introducing new features as well as bug and security fixes. An “actively exploited” (i.e. zero-day, in-the-wild) vulnerability was fixed for most operating systems.<\/p>\n
Let’s take a look at some of the new features, bug fixes, and security patches included in these updates.<\/p>\n
In this article:<\/p>\n
First let’s take a look at the zero-day vulnerability that Apple addressed for multiple operating systems. Apple says of the update:<\/p>\n
WebKit
\n<\/strong>Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1.
\nDescription: A type confusion issue was addressed with improved state handling.
\nCVE-2022-42856: Cl\u00e9ment Lecigne of Google’s Threat Analysis Group<\/p><\/blockquote>\nThirteen days earlier, Apple addressed this vulnerability in iOS 16.1.2<\/a>, released on November 30. It was the only security issue that Apple has (so far) indicated was addressed in that update. Strangely, iPadOS didn’t receive an update at the time, and the release notes for this week’s iPadOS 16.2 update do not list this vulnerability as having been addressed.<\/p>\n
However, several other operating systems received a fix for this vulnerability in this Tuesday’s patch update cycle:<\/p>\n
\n
- macOS Ventura 13.1<\/li>\n
- macOS Monterey and macOS Big Sur (addressed in Safari 16.2)<\/li>\n
- iOS 15.7.2 and iPadOS 15.7.2<\/li>\n
- tvOS 16.2<\/li>\n<\/ul>\n
For unknown reasons, the following operating systems are absent from that list:<\/p>\n
\n
iPadOS 16.2\u00a0<\/del> Update: Apple acknowledged on December 22 that iPads received this fix in iPadOS 16.2.<\/em><\/li>\n- watchOS 9.2<\/li>\n
- watchOS 8.7.x for Apple Watch Series 3 (which Apple still sells refurbished)<\/li>\n
- Windows (not addressed in iCloud for Windows 14.1<\/a>, which was also released this week and addressed three other vulnerabilities, including two in WebKit)<\/li>\n<\/ul>\n
It is unclear why these operating systems seemingly remain unpatched. Perhaps the vulnerability does not exist on these operating systems, or perhaps it exists but Apple does not believe it is exploitable. Or perhaps the issue was addressed but Apple just neglected to mention it. Alternatively, perhaps these operating systems remain vulnerable. Any of these scenarios is plausible.<\/p>\n
Intego has reached out to Apple for comment. If Apple replies, this article will be updated with the company’s response. Update: Apple publicly acknowledged on December 22<\/a> that iPads received this fix in iPadOS 16.2. However, Apple has not yet responded regarding whether watchOS or Windows systems remain vulnerable.<\/em><\/a><\/p>\n
macOS Ventura 13.1<\/h3>\n
Available for:<\/strong>
\nMac Studio (2022), Mac Pro (2019 and later), MacBook Air (2018 and later), MacBook Pro (2017 and later), Mac mini (2018 and later), iMac (2017 and later), MacBook (2017), and iMac Pro (2017)<\/p>\nNew features:<\/strong><\/p>\n
\n
- Freeform<\/a>, a new app for working creatively with friends or colleagues on Mac, iPad, and iPhone<\/li>\n
- Advanced Data Protection for iCloud<\/a>, an opt-in feature that can enable end-to-end encryption for more iCloud data categories on all devices associated with your Apple ID<\/li>\n<\/ul>\n
Enterprise:<\/strong><\/p>\n
Enterprise users see the welcome return of Network Locations, reliability improvements when using DHCPv6, a resolution for an issue causing printers to be removed after a software update, and more<\/a>.<\/p>\n
Improvements and bug fixes:<\/strong><\/p>\n
\n
- Improved search in Messages allows you to find photos based on their content, like a dog, car, person, or text<\/li>\n
- Participant Cursors in Notes allow you to see live indicators as others make updates in a shared note<\/li>\n
- Play sound in Find My app can now help you pinpoint the location of nearby AirTags, AirPods Pro (2nd generation) case, and Find My network accessories<\/li>\n
- Fixes an issue that causes some notes not to sync with iCloud after updates are made<\/li>\n
- Fixes an issue where you may lose keyboard and mouse input in some apps and games<\/li>\n<\/ul>\n
Security-related fixes and updates:<\/strong>
\nAt least 36 vulnerabilities were addressed in this update. Here are a few notable ones:<\/p>\nAccounts
\n<\/strong>Impact: A user may be able to view sensitive user information
\nDescription: This issue was addressed with improved data protection.<\/p>\n<\/p>\n
AppleMobileFileIntegrity, CoreServices and Printing
\n<\/strong>Impact: An app may be able to bypass Privacy preferences
\nDescription: This issue was addressed by enabling hardened runtime.<\/p>\n<\/p>\n
Kernel
\n<\/strong>Impact: An app may be able to break out of its sandbox
\nDescription: This issue was addressed with improved checks.<\/p>\n<\/p>\n
Safari
\n<\/strong>Impact: Visiting a website that frames malicious content may lead to UI spoofing
\nDescription: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.<\/p><\/blockquote>\nOf the 36 identified fixes, five are for the kernel (the core of the OS) and 10 are for WebKit (the page-rendering engine used by Safari and other apps). This includes the vulnerability mentioned above that may have been actively exploited. The complete list can be seen here<\/a>.<\/p>\n
This may also be the first version of macOS Ventura that supports Rapid Security Responses<\/a>, which Apple describes as “a mechanism for shipping security fixes to users more frequently,” but this has not yet been confirmed.<\/p>\n
You can get this new macOS update by going to System Preferences<\/strong> > Software Update<\/strong>, where compatible Macs running macOS Mojave or newer will see the Ventura update appear. If your Mac is running macOS High Sierra or older, look for macOS Ventura in the App Store and download it from there.<\/a><\/p>\n
macOS Monterey 12.6.2<\/h3>\n
Available for:<\/strong>
\nAll supported Macs currently running macOS Monterey<\/p>\nSecurity-related fixes and updates:<\/strong>
\nAt least 13 vulnerabilities were addressed in this update, most of which were also addressed in macOS Ventura 13.1. For the full list of security patches included in Monterey 12.6.2, have a look here<\/a>.<\/p>\nOne notable vulnerability, which Apple disclosed as previously having been silently patched in macOS Ventura 13, was also addressed for both macOS Monterey 12.6.2 and macOS Big Sur 11.7.2:<\/p>\n
BOM
\n<\/strong>Impact: An app may bypass Gatekeeper checks
\nDescription: A logic issue was addressed with improved checks.
\nCVE-2022-42821: Jonathan Bar Or of Microsoft<\/p><\/blockquote>\nFor additional details about the Gatekeeper bypass vulnerability, see our featured article<\/a> about it.<\/p>\n