Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

PSA: Safari Security Flaw 'Actively Exploited,' Update Your Apple Devices Now

Why is this getting so heavily publicized this time around? I'm not saying it's not worth informing people, but just, why this specific update? Apple patches (seemingly) similarly exploitive kernel and WebKit vulnerabilities all the time; no one's made any case for this being more novel than the others. Heck, Apple provided similarly-worded disclosure notes for a WebKit vulnerability in iOS 15.6 and AppleAVD in 15.4.1, and neither of those were paraded around as some critical, 'update now!!!' patches. Yet this one is all over the place.
 
  • Like
Reactions: BiscoDino and Boyyai
Avenged110 said:
Why is this getting so heavily publicized this time around? I'm not saying it's not worth informing people, but just, why this specific update? Apple patches (seemingly) similarly exploitive kernel and WebKit vulnerabilities all the time; no one's made any case for this being more novel than the others. Heck, Apple provided similarly-worded disclosure notes for a WebKit vulnerability in iOS 15.6 and AppleAVD in 15.4.1, and neither of those were paraded around as some critical, 'update now!!!' patches. Yet this one is all over the place.
Click to expand...
It's even been on the mainstream news this evening in the UK. Got my (non-techy) mum and dad in a right spin this evening!
 
  • Haha
  • Like
Reactions: Wokis and George Dawes
Is Apple going to do the standard 4 week delayed rollout for lazy people relying on Automatic Updates or will they force push this one?
 
Shirasaki said:
I’ve had other issues with safari lately that just disrupts workflow annoyingly. Now with security issues like this one, I feel I hate safari a bit more from today. Sure, I’m using Ventura beta so it should be fixed eventually, but still.

And apple refuses to allow third party web browser kernels being used on iOS devices. Other than protecting their bottom line, I can’t think of any other reason why they refuse to allow other rendering engine on iOS etc.
Click to expand...
Is that the rendering engine that is used in Safari? Or the rendering engine that is used in the Mail app? Or the rendering engine that is used in the iTunes Store App? Or the rendering engine that is used by numerous third party iOS apps? Or is it all of the above?

Is that the rendering engine that gets fixed when Apple provide an update? Or is it the engine that doesn't get updated by a lazy third party developer in his web app?

It's not quite so simple a choice, you see...
 
Is Apple forcing this update? My wife claimed that she tapped "update later" and it immediately rebooted and began updated. I poo-poo'ed her wild crazy tale and told her to stay out of the cooking sherry until the same thing happened to me on my iPhone and iPad: I tapped "update later" and they both proceeded to install the update. o_O
 
  • Haha
  • Like
Reactions: Boyyai, Shirasaki and brucemr
xxray said:
Uhh is this fixed in the iOS/iPadOS/macOS 16 betas??
Click to expand...

Probably not yet but you shouldn’t be using betas on devices with anything that matters on them anyway. Security is not part of the beta experience.

It’ll be fixed by final release.

Someone disagrees? How could they possibly keep on top of security bugs in a beta release? That’s not the point of these releases. It’ll be fixed in the next beta and definitely in the RC.

Furthermore think of all the security bugs likely introduced and then fixed throughout the beta process. They don’t get CVEs because it’s not production software.
 
Last edited:
  • Disagree
Reactions: jhfenton
Avenged110 said:
Why is this getting so heavily publicized this time around? I'm not saying it's not worth informing people, but just, why this specific update? Apple patches (seemingly) similarly exploitive kernel and WebKit vulnerabilities all the time; no one's made any case for this being more novel than the others. Heck, Apple provided similarly-worded disclosure notes for a WebKit vulnerability in iOS 15.6 and AppleAVD in 15.4.1, and neither of those were paraded around as some critical, 'update now!!!' patches. Yet this one is all over the place.
Click to expand...
It feels as though Apple pushed news agencies to heavily encourage installation of this update. Perhaps the implications of what could happen are particularly severe.
 
  • Like
Reactions: brucemr
I decided to go for the update, my Mini 6 seems to be running faster than before and the storage bug has gone. Provided it charges without issue (on 36%, so I’ll find out soon-ish) it’s thumbs up from me. As I posted above it didn’t mention 15.6.1 being a security update but it did say security update when I updated an Air 5. I don’t know if Apple have realised this and updated the description across the board or it displays a different description on different devices.
 
MBA and Phone updated fine, i didn't realise my Mac mini was still on Big Sur so doesn't seem an update for that yet.
 
Avenged110 said:
Why is this getting so heavily publicized this time around? I'm not saying it's not worth informing people, but just, why this specific update? Apple patches (seemingly) similarly exploitive kernel and WebKit vulnerabilities all the time; no one's made any case for this being more novel than the others. Heck, Apple provided similarly-worded disclosure notes for a WebKit vulnerability in iOS 15.6 and AppleAVD in 15.4.1, and neither of those were paraded around as some critical, 'update now!!!' patches. Yet this one is all over the place.
Click to expand...
Well, the point releases come out on a fairly regular schedule in any case. A double-point patch implies a little more urgency. :)
 
chkay said:
You knew perfectly well when you bought your device that software updates are only provided for so long. It's not a new thing.
Click to expand...
That's a weird take. All it does is push people away from Safari and onto alternatives like Chrome or Firefox or Edge that will not have this vulnerability.

"People should accept software vulnerabilities" is not a marketing slogan any successful company will run with.

At the very least, Apple should disable Safari on devices it is not going to fix. Allowing people to use buggy software is just going to harm the user and put a bad taste in their mouth. Not everyone reads MR. I doubt 1% of users are going to know about this vulnerability unless Apple warns them or pushes a fix.

The bottom line is if Apple won't fix their browser, people will switch to browsers that are secure. A shame, as Safari is my browser of choice.
 
Crowbot said:
That's just the reality of technology. At some point it becomes financially prohibitive to update older devices. Ironically, the hardware is so well made that it lasts longer than its firmware viability does.
Click to expand...
This is why we need Right to Repair.

Because customers want to keep using the things they've bought after companies want to (or are able to) support them.

Just because the original company doesn't want to support something anymore shouldn't mean it's garbage now. Customers should be free to fix it themselves, and if there's enough people out there who want a fix, it should be possible for a business to be started around providing that fix.

(This does have major implications for how companies should be handling source code, build/dev tools, and documentation... I'd say that when software reaches EOL, it needs to be made open source. Like ID Software has always done.)
 
dantracht said:
I’ve moved to Edge, which work far far better than Safari has been lately on my M1 fleet.
Click to expand...
I'd be very wary using Edge.
I switched to Edge for my windows machine, and for a while it seemed ok, but became more and more intrusive (and this is with me turning on a lot of privacy settings).

First they banned several privacy plugins like AdNausem from working.

Then they changed the password save feature to "Automatically save every password I type into edge"

Then they added some super-spy feature, where I will do a search on a travel site, and then open a new tab and it will ask "Do you want me to input your Atlanta to Boston flight search into United.com"? NO, and I don't want you spying on my travel searches either.

I've switched to Ungoogled Chromium on PC, sticking with Safari on mac.
 
  • Like
Reactions: planteater
Ash Pole said:
Why in the first place, does Safari have kernel privileges? .....other browsers don't.
Personally, I'm deferring the update until I see actual reports of compromised phones from actual iOS users.
Click to expand...
It doesn't have kernel privileges. However, there is a bug in the low level code that enables one to break out of the "sandbox" and then use that to gain privileged access.
 
  • Disagree
Reactions: ProfessionalFan
ArtOfWarfare said:
This is why we need Right to Repair.

Because customers want to keep using the things they've bought after companies want to (or are able to) support them.

Just because the original company doesn't want to support something anymore shouldn't mean it's garbage now. Customers should be free to fix it themselves, and if there's enough people out there who want a fix, it should be possible for a business to be started around providing that fix.

(This does have major implications for how companies should be handling source code, build/dev tools, and documentation... I'd say that when software reaches EOL, it needs to be made open source. Like ID Software has always done.)
Click to expand...
Would you like Apple to release iOS source code to third parties so that they can provide fixes into the distant future? Because there are some really really important security implications around that...
 
*~Kim~* said:
I decided to go for the update, my Mini 6 seems to be running faster than before and the storage bug has gone. Provided it charges without issue (on 36%, so I’ll find out soon-ish) it’s thumbs up from me. As I posted above it didn’t mention 15.6.1 being a security update but it did say security update when I updated an Air 5. I don’t know if Apple have realised this and updated the description across the board or it displays a different description on different devices.
Click to expand...
The storage bug was actually the malware taking up that space LOL
 
dantracht said:
While the security fixes are always important and appreciated, I’ve moved to Edge, which work far far better than Safari has been lately on my M1 fleet.
Click to expand...
Yup, it's really good at monitoring what you do and injecting shopping suggestions.

When they started doing that I moved back to Firefox and Safari.

BTW, on iOS it's a webkit bug, so all browsers are impacted.
 
  • Wow
  • Like
Reactions: katbel and War833
RedDeliciousPinkLady said:
And if our devices are so old that they can't reach those OS versions, we're supposed to just not use them anymore, right? It sounds like a sarcastic question, but is that actually, in the grand scheme of security, what we're supposed to be doing?
Click to expand...
Yes. Devices on an OS version that no longer receives security updates and can't be updated, should no longer be used for internet access.

That's true for anything - Mac, Windows, Android, TV's, toasters, baby cams, etc. I'd go even further and say that any device that *never* get's updates (like cheap IOT devices) shouldn't be used to begin with.

I know that's costly and harsh, but it's the reality of the world we live in today.
 
  • Angry
Reactions: Shirasaki
GoYankees said:
Which guide do you suggest for this project? Is there anything not working?
Click to expand...
No guide is needed unless you want to change the icons and theme. If you just want the macOS type of Dock try this. Just go into settings --> appearance --> Dock and disable panel mode. The panel then looks similar to macOS Big Sur and has a slight transparent look to it. You can move the Dock to the right, left or bottom of the screen. You can also download icons to make it look even more like macOS.

Here are a few guides:

itslinuxfoss.com

How to Make Ubuntu 22.04 Look Like Mac OS

Operating Systems are significant parts of electronics devices such as PC, mobiles, Tab, and much more. It offers major services and functionalities, and Mac OS is one of them. Because...
itslinuxfoss.com itslinuxfoss.com

How to Make Ubuntu 22.04 Look Like Mac OS

Ubuntu 22.04 has quite interactive interface alongside various customization options. This article demonstrates the steps to make Ubuntu 22.04 look like macOS.
linuxhint.com

(How to make Ubuntu look like macOS Monterrey)
 
Last edited:
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back