{"id":8617,"date":"2021-08-09T05:12:44","date_gmt":"2021-08-09T12:12:44","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=8617"},"modified":"2023-03-03T14:29:33","modified_gmt":"2023-03-03T21:29:33","slug":"july-apple-patches-52-security-vulnerabilities","status":"publish","type":"patch_watch","link":"https:\/\/webdev.securin.xyz\/patch_watch\/july-apple-patches-52-security-vulnerabilities\/","title":{"rendered":"July: Apple Patches 52 Security Vulnerabilities"},"content":{"rendered":"<p dir=\"ltr\">Apple had released security patches to address 52 unique vulnerabilities in July, which includes two zero-day exploits. We analyzed these weaknesses and spotlighted the most important vulnerabilities that ought to be fixed on priority.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 800px; height: 568px;\" src=\"\/wp-content\/uploads\/2015\/11\/patch-watch-1-6.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\"><strong>Overview<\/strong><\/h2>\n<p dir=\"ltr\">The 52 vulnerabilities that were patched in July include<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">7 CVEs classified as Remote Code Execution bugs<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">9 CVEs have Privilege Escalation capabilities<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">15 CVEs linked to Buffer Overflow<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">2 CVEs with Denial of Service<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">14 CVEs are Arbitrary Code Execution<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\">Interestingly, CISA had issued three alerts this July urging all Apple users to address and update the recently patched security vulnerabilities in multiple products.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 550px; height: 338px;\" src=\"\/wp-content\/uploads\/2015\/11\/patch-watch-2-8.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\"><strong>Zero-Day Vulnerabilities<\/strong><\/h2>\n<p dir=\"ltr\">This July, Apple released an update for a dangerous new zero-day bug (CVE-2021-30807) that exists in iOS 14.7. This vulnerability is described as a memory corruption issue that determines how an application manager controls the display of a device. For instance, any malware that resides in an application can leverage and take complete control of the device.<\/p>\n<p dir=\"ltr\">CVE-2021-30807 is considered to be the thirteenth zero-day flaw covered by Apple in 2021. Given the public availability of a proof-of-concept (PoC) exploit, users should upgrade their devices to the most recent version as soon as possible to minimize the risk associated with the issue.<\/p>\n<p dir=\"ltr\"><img decoding=\"async\" style=\"width: 442px; height: 385px;\" src=\"https:\/\/lh5.googleusercontent.com\/tUxZm0JyO7VJVuCK1CybEaAfPfT2B3g1t3kYSLu0ZX7X18iLBc37GfqkRqlrXeBBfIXEXV6L4Ng4J8qc3ZYHvqarcYejzWoJqdXCQosnpP36mWTn8UyX5hXm6i1zZDYsl0M6ktoy\" \/><\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\">Another zero-day vulnerability in iOS tracked as CVE-2021-30800 was fixed. This vulnerability is named \u201cWIFIDemon\u201d and is considered to be a severe bug that could lead to denial of service or arbitrary code execution. Therefore, we recommend you immediately update your iOS device to iOS 14.7 to secure it from WiFiDemon attacks.<\/p>\n<p>It&#8217;s also a zero-click vulnerability that allows a threat actor to infect a device without requiring any user input, although it does require the setting to be enabled to join Wi-Fi networks automatically.<\/p>\n<p>Additionally, two more zero-day (CVE-2021-30761, CVE-2021-30762) vulnerabilities that were patched in early June received a second patch this July. These two vulnerabilities are found in Webkit Storage that leads to arbitrary code execution.<\/p>\n<h2><strong>Old Vulnerabilities<\/strong><\/h2>\n<p dir=\"ltr\">We have seven old vulnerabilities patched in Apple this July, ranging from the year 2018 to 2020.<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">All of these vulnerabilities have been rated critical and accredited with a CVSS v3 score of 9.1 to 9.8.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">6 CVEs are classified as Buffer Overflow bugs and one is of Remote Code Execution.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">Of these, 6 CVEs are categorized under the <a href=\"https:\/\/cwe.mitre.org\/top25\/archive\/2021\/2021_cwe_top25.html\">2021 CWE Top 25 Most Dangerous Software Weaknesses<\/a> published by MITRE.<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" style=\"width: 600px; height: 518px;\" src=\"\/wp-content\/uploads\/2015\/11\/apple_v2.jpg\" alt=\"\" \/><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrH2uWgP6n5MdxUT?backgroundColor=purple&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p dir=\"ltr\"><strong>Table: Apple July 2021 Patches\u00a0<\/strong><\/p>\n<p dir=\"ltr\">On 27 July 2021, CISA issued an alert urging the users to address the multiple vulnerabilities in macOS Big Sur 11.5.1, iOS 14.7.1, and iPadOS 14.7.1. Therefore, all Apple users can\u00a0to continue to install the latest updates manually, if the automatic update option is disabled.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apple had released security patches to address 52 unique vulnerabilities in July, which includes two zero-day exploits. We analyzed these weaknesses and spotlighted the most important vulnerabilities that ought to be fixed on priority. Overview The 52 vulnerabilities that were patched in July include 7 CVEs classified as Remote Code Execution bugs 9 CVEs have [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14435,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[289,288,291],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch\/8617"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/14435"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=8617"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_category?post=8617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}