Make Sure to Update: iOS 17.4 and iPadOS 17.4 Fix Two Major Security Vulnerabilities

[jjudson]

Still there. What a joke this company is becoming…

 

[0134168]

What's wrong with watchOS 10? When you get a new Watch, you'll have to use it (or whatever the OS is by then..)

Yes, I know, but for the time being, I will hold my Ultra 1 as much as I can (watchOS 9). watchOS 10 is horrible for me compared to watchOS 9. Don´t like that degraded colors at all all over the system. New gestures are a mess. Widgets are nonsense on a watch. More or less, I agree with this guy,

 

[0134168]

where do you get that idea from? why would 17.4 force an watchOS update?

Cause iOS 17.4 can´t comunicate with your watchOS 9.

 

[0134168]

The best way to avoid that is to disagree with the terms and conditions of watchOS10. I used to get nagged every night and one time it tried to update over night and asked me to agree to the T&C. I said no. I have gotten a nag since and am still happily on watchOS 9. So just disagree with the Terms & Conditions.

I have deactivated automatic updates, but everytime I charged the Apple Watch, a reminder appears in my display, "watchOS 10 is a available", when I haven´t asked for that. I don´t like it at all.

Even, some time ago the Apple Watch auto updated while night, don´t know how, I suppose I was playing with a Beta, I had to send the watch to Apple for they downgrade it again to watchOS 9.

 

[Rafagon]

I'm happy about the security updates, sure, but highly distraught that the elusive new "hello" screen isn't showing up for me after iOS updates. I was promised that the new "hello" screen would show my Apple ID account photo. A couple of beta updates and now this official update have all let me down. Is anyone seeing the new "hello" screen with their Apple ID photograph?

 

[jz0309]

Cause iOS 17.4 can´t comunicate with your watchOS 9.

Is that documented somewhere, link? I do not recall reading about that in any of the MR articles about 17.4

 

[0134168]

Is that documented somewhere, link? I do not recall reading about that in any of the MR articles about 17.4

I suffered it myself, if that is enough for you. Had to downgrade from 17.4. You can try and see it.
Anyway, a new discusion is now on reddit.

https://www.reddit.com/r/AppleWatch/comments/1b7gabr

 

[Hank001]

I’ve never had a bug in iOS that really bothered me much aside from one that made my watch battery drain and therefore not last a day.

Oh dear, yes, a battery drain would cause me to upgrade as well.

 

[Hank001]

 

[Jim Lahey]

With increasing police state threats from the likes of the UK's impending amendments to its Investigatory Powers Act currently being read in the House of Lords - that would see it as the worldwide clandestine arbiter of big tech software updates - I think I'll take my chances with the mean old hackers. Never installing anything newer than iOS16, and even that's probably a bit too new.

 

[svish]

Will be updating my devices this weekend.

 

[Reverend Benny]

Do those two security vulnerabilities exist in iOS 16.7.5, which was released 40 days ago?

Seems like iOS 15 and 16 received updates today as well, can only assume its security patches for the same or similar vulnerabilities.

 

[bogdanw]

Fun fact: The Accessibility vulnerability fixed in iOS 17.4 (CVE-2024-23243) was reported by a high school student.
“CVE-2024-23243: Cristian Dinca of "Tudor Vianu" National High School of Computer Science, Romania”
https://support.apple.com/HT214081
http://portal.lbi.ro/2023/03/02/capture-the-flag-vianu-2023-etapa-locala-cybersecurity/

 

[bzgnyc2]

"An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections."

Does anyone know what this means? More specifically, if an attacker already has arbitrary kernel read and write capability, what more access can get they get? Back in my day, if an attacker had kernel access it was already game over...

 

[I7guy]

Looks like apple is learning from Microsoft by making the OS so closely intertwined with the web browser.🤣

Safari is not the only apple app integrated into the operating system. And Microsoft does the same thing with other core functionality.

 

[AiPone12mini]

Can these bugs give later possibility for jailbreak? perhaps holding back if that is the case. Better than EU sideloading if possible?

 

[Johnny Jackhammer]

I do. Because when you update, for bug fixes, you'll get new bugs. Otherwise there wouldn't be any bug fixes in an update.

They should separate the bug fixes from sw updates / added sw or emoji type of updates. That way some people could simply download bug fixes without any unasked for sw updates which should result, at some point, a bug-free OS.

Do you mean every time you write new code you introduce a new bug? I would agree with that statement. The more features your device has the more attack surface for hackers. I worry when Apple updates are described like this:

macOS Sonoma 14.4 introduces new emoji as well as other features, bug fixes, and security updates for your Mac.

When "new emoji" is listed before the "other features" like an afterthought - "security updates" seem less important to Apple. It reveals something about Apple. Either they are misjudging what people really care about or they are throwing in emoji to get kids to keep their phones up to date - like a free piece of candy if you update your phone. Who knows why they do this. I would prefer a totally secure phone. The fact that secure phones do exist for certain people and that the status quo for citizens is not that - it makes you wonder why nothing has changed over the past decade.

There is an opportunity for Apple here. They could market a minimalist iPhone that focuses on security and no fluff.

 

[chrfr]

When "new emoji" is listed before the "other features" like an afterthought - "security updates" seem less important to Apple.

You can be sure that more people are interested in new emoji than security updates. Leading with these as a feature makes a lot of sense for the vast majority of users. Documentation on enterprise-related and security updates is available for those who want it.

 

[Mother Nature]

Lol need a whole system update to fix a Safari bug? For everything holy Apple please learn from Android and move Safari to the App Store.

We get an update almost every month and when they need to address an urgent bug they drop updates immediately. Google has had bugs in their core OS apps (that are on the Google Play Store) and they don't address them quicker.

Actually it looks like they repeatedly forget to address those.

 

[Mother Nature]

sloppy coding by apple, their "improved validation" means that they fixed a coding problem. they should have A.I. look over their code for vulnerabilities before releasing a beta to developers to test. crazy that this type of stuff continues to be an issue in todays programming world.

forcing users to update the entire OS for a security patch, I thought we were past this, by enabling a "secure patch" model that let the current OS patch security issues, or were they only able to do this on macOS.

none the less -- apple, stop releasing new Emoji's, no one cares, also, fix your sloppy coding. I continue to see so many bugs of the U.I. and apps that obviously have been poorly programed... eh hem "Home.app", feels like a Hypercard app.

Again, Apple does not add new emojis!!!!
They just adapt the UNICODE standard. AI does not programm very well, A.I. often provides wrong lines of code for simple things, how is A.I. going to detect more complex code? lol

 

[bogdanw]

CISA Adds Two Known Exploited Vulnerabilities to Catalog
"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
CVE-2024-23225 Apple iOS and iPadOS Memory Corruption Vulnerability
CVE-2024-23296 Apple iOS and iPadOS Memory Corruption Vulnerability
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. "
https://www.cisa.gov/news-events/al...s-two-known-exploited-vulnerabilities-catalog

 

[Hank001]

Do you mean every time you write new code you introduce a new bug? I would agree with that statement. The more features your device has the more attack surface for hackers. I worry when Apple updates are described like this:



When "new emoji" is listed before the "other features" like an afterthought - "security updates" seem less important to Apple. It reveals something about Apple. Either they are misjudging what people really care about or they are throwing in emoji to get kids to keep their phones up to date - like a free piece of candy if you update your phone. Who knows why they do this. I would prefer a totally secure phone. The fact that secure phones do exist for certain people and that the status quo for citizens is not that - it makes you wonder why nothing has changed over the past decade.

There is an opportunity for Apple here. They could market a minimalist iPhone that focuses on security and no fluff.

Excellent points all around. I have nothing to add to this.