Apple Releases Rapid Security Response Updates for iOS 16.5.1 and macOS 13.4.1 to Fix Actively Exploited Vulnerability [Updated]

[roger6106]

Not sure if they will fix it or be like everyone should update their websites to parse their non-standard version with a letter between parentheses...

They shouldn't be parsing this to determine browser support. That is a dated approach that breaks browsers that work fine, as seen here. Instead, the modern* approach is to do feature detection.

* To be clear, I don't mean modern as in recent. This has been the recommended practice for many years already.

 

[msackey]

[delete; never mind ]

 

[Tdude96]

Yup this breaks Facebook. Maybe that's the security fix?

Also breaks Instagram.

Also breaks Zoom.

Facebook, Instagram, Zoom? Apple's really going all-in for Privacy First!

 

[tywebb13]

And Safari update for Big Sur and Monterey are available.

Indeed. Here they are (version 16.5.2):

https://swcdn.apple.com/content/downloads/49/30/042-13470-A_QHI7886JLL/r3w7tzr9kucqnyk7eet73qi7qfzsjaoh8g/Safari16.5.2MontereyAuto.pkg

https://swcdn.apple.com/content/downloads/05/43/042-14628-A_F3X9OLFNO3/wdf7prpd26wy37bwftdsxfjxc2rnrvfbak/Safari16.5.2BigSurAuto.pkg

 

[Kebabselector]

And now Facebook is giving me an unsupported browser error. Was working fine before.

Disabled extensions and ran Onyx to clean things out. No change.

Same here, no massive loss at the moment. I assume it'll be fixed at some point - I also couldn't log on to instagram via a browser either, not sure if that's related (user agent change fixed Facebook as a temp measure).

 

[AgentOSX]

Part of me really likes FB bring broken. It is like Apple is doing us a favor. Maybe the (b) security update can delete Instagram and Threads accounts automatically.

 

[DrKarl]

Same Facebook problem reported early on in this thread. Since nobody had posted a screenshot of the issue... and the redirected URL, here's that for posterity:

 

[addamas]

I must say I am impressed by the progress they did from “could not download” for several hours to 1,4 - 2,8 MB size download and restart in very short time.

About Facebook- probably they exploited it as they do on every single site with tracking pixels and all background user tracking

 

[mdriftmeyer]

This is good, but Apple need to work on a way for RSRs to NOT require a restart if possible. Even better would be automatic background installation with no restart, or a restart scheduled for the middle of the night (e.g., 3 AM). Having to chase people to get them to update their phones is a real drag.

Any time there is a reboot it means the kernel was patched.

 

[mdriftmeyer]

Safari Technology Preview is unaffected.

 

[jwolf6589]

Apple today released Rapid Security Response (RSR) updates that are available for iPhone and iPad users running the iOS and iPadOS 16.5.1 updates and the macOS Ventura 13.4.1 update.

Rapid Security Response updates are designed to provide iOS and macOS users with security fixes without the need to install a full software update. Today's updates address an actively exploited WebKit vulnerability, so it is a good idea to update as soon as possible.

iOS Security Response 16.5.1 is available through the standard Software Update mechanism in the iPhone or iPad Settings app, but is a quick update, requiring just a couple of minutes to download the update and then a quick restart for the install process. The macOS update can be installed through System Settings.

Once the Rapid Security Response update is installed, iOS 16.5.1 users and macOS Ventura 13.4.1 users will see an updated version of the software, and tapping on the version in the About section of Settings will display information about the installed OS version and the Rapid Security Response update. Those who want to disable Rapid Security Response updates on iPhone can do so by following our how to. The updates can also be disabled on the Mac.

Apple has been testing the Rapid Security Response feature since last year, with RSRs first introduced with the launch of iOS 16 and macOS Ventura.

Article Link: Apple Releases Rapid Security Response Updates for iOS 16.5.1 and macOS 13.4.1 to Fix Actively Exploited Vulnerability

Know Facebook on Safari no longer works properly. I get this message eveyrtime I log on. I DO NOT want to use Firefox or Chrome. I only use these browsers if I am forced too.

 

[tywebb13]

build numbers:

Ventura 13.4.1 (a) 22F770820b (pre WWDC 2023 macs)

Ventura 13.4.1 (a) 22F770830b (for WWDC 2023 macs)

iOS 16.5.1 (a) 20F770750b

iPad 16.5.1 (a) 20F770750b

 

[lkrupp]

And now Facebook is giving me an unsupported browser error. Was working fine before.

Disabled extensions and ran Onyx to clean things out. No change.

And as you should know by now RSRs are removable. Have you tried removing the RSR update?

 

[lkrupp]

I hope they release it for iPhoneOS 16.5!

Not a chance since 16.5.1 is current.

 

[dmrowley]

It has broken Spark and the App Store for me.... AdGuard Pro is broken.

 

[Don MC]

And as you should know by now RSRs are removable. Have you tried removing the RSR update?

Removal on my iPad failed. iPhone was a success. FB works again on my phone at least.
EDIT: iPad success on second try.

 

[MrRom92]

Should’ve just released a .2

 

[lkrupp]

Safari version is now 16.5.2 (a) after the update, that's why it's reporting problems on number of websites I suspected.

For me it’s only Facebook that defaults to the mobile version. Every other website I visit is normal. I suspect Facebook is the one who needs to adjust their code.

 

[Abthevolfan92]

It has broken Spark and the App Store for me.... AdGuard Pro is broken.

if you don't mind me asking what is wrong with your app store on it?

 

[lkrupp]

macOS Ventura 13.4.1 (a)​

Released July 10, 2023
WebKit
Available for: macOS Ventura 13.4.1
Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: The issue was addressed with improved checks.
CVE-2023-37450: an anonymous researcher

So this has to do with webkit. I think it’s Facebook that will have to be addressing this, not Apple. Who knows what kind of games Facebook plays with its website. Apple may have just closed one of their doors into your data.

 

[Reverend Benny]

What about older OS versions?

Guessing now but if you are on 15.7.7 you might not be affected by the issue or it will be corrected in 15.7.8 since rapid response was released for the 16.4 version.

 

[tomscott1988]

Since I updated my MacBook air with this safari is acting funny.

When I go on Facebook it now says it's an unsupported browser. Anyone got any solutions?

 

[tywebb13]

Anyone got any solutions?

Delete facebook.

 

[Don MC]

Since I updated my MacBook air with this safari is acting funny.

When I go on Facebook it now says it's an unsupported browser. Anyone got any solutions?

https://forums.macrumors.com/threads/apple-releases-rapid-security-response-updates-for-ios-16-5-1-and-macos-13-4-1-to-fix-actively-exploited-vulnerability.2395527/?post=32309172#post-32309172

 

[vanc]

Safari version is now 16.5.2 (a) after the update, that's why it's reporting problems on number of websites I suspected.

The extra `(a)` might have broken Facebook's user-agent detection.