Apple has fixed more than 50 separate vulnerabilities in iOS, including several serious flaws that could have allowed attackers to execute arbitrary code on an iPhone and another that enables surreptitious access to a device’s microphone.
The bug that affects the iPhone’s microphone is one of the more serious vulnerabilities patched in iOS 12.2, which Apple released Monday. An attacker could exploit that vulnerability to turn on the microphone on a vulnerable iPhone remotely, allowing him to listen to the victim’s conversations or any others nearby.
“A malicious application may be able to access the microphone without indication to the user. An API issue existed in the handling of microphone data. This issue was addressed with improved validation,” Apple said.
This vulnerability would be quite useful for certain types of adversaries, including intelligence agencies, who are interested in listening to targets’ conversations surreptitiously. A second vulnerability repaired in iOS 12.2 could be used to track the location of a victim’s device without her knowledge. That bug is a result of iOS broadcasting the MAC address of the device, which an attacker could use to track the device without the victim’s knowledge. The combination of the microphone API vulnerability and the passive-tracking bug could be quite dangerous for targeted users.
Among the other critical flaws patched in this release is an issue with the way that iOS handles some geolocation data. A bug in the GeoServices component of the operating system could allow an attacker to execute arbitrary code by enticing a victim into clicking a malicious link in an SMS message. This kind of one-click access vulnerability is pretty rare in iOS and would be highly prized by attackers, given that it would only require the victim’s phone number.
The release of iOS 12.2 also fixed several other memory corruption issues, including a number in WebKit that could lead to arbitrary code execution.
Apple also released a new version of macOS that fixes dozens of vulnerabilities. The new macOS Mojave 10.14.4 fixes some of the same WebKit vulnerabilities repaired in iOS, along with a number of serious weaknesses in the kernel. There’s also a patch for a problem with the AppleGraphicsControl component of macOS that could allow a malicious app to run arbitrary code.
“A malicious application may be able to execute arbitrary code with kernel privileges. A buffer overflow was addressed with improved size validation,” Apple said.