Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Update Now: iOS 18.3 and macOS Sequoia 15.3 Include 20+ Security Updates

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
67,546
37,890


Along with new features, the iOS 18.3, iPadOS 18.3, and macOS Sequoia 15.3 updates that Apple released today include multiple security fixes, including a fix for vulnerability that may have been actively exploited on some devices.

bug-security-vulnerability-issue-fix-larry.jpg

According to Apple's security support document, there was a CoreMedia bug that could be used to elevate privileges. Apple says that it is aware of a report that the bug could have been actively exploited against versions of iOS before iOS 17.2. Apple fixed the issue with improved memory management.

Apple also addressed over 20 other vulnerabilities. One could allow an attacker with physical access to an unlocked device to access the Photos app even when an iPhone is locked, and there were several issues with AirPlay that could allow attackers to execute code or crash apps.

Two kernel vulnerabilities could let malicious apps gain kernel privileges, and there were a handful of WebKit fixes for Safari.

Because of the number of security issues fixed in the update, it is a good idea to update to the new software right away.

watchOS 11.3 and tvOS 18.3 also have a number of security fixes, so those updates should be installed as well. If you have macOS Sonoma or Ventura, Apple has released macOS 14.7.3 and macOS Ventura 13.7.3 with security improvements.

Article Link: Update Now: iOS 18.3 and macOS Sequoia 15.3 Include 20+ Security Updates
 
Article Link
https://www.macrumors.com/2025/01/27/ios-18-3-macos-sequoia-15-3-security-updates/
  • Like
  • Wow
Reactions: RandomDSdevel, JapanApple, klasma and 2 others
allow an attacker with physical access to an unlocked device to access the Photos app even when an iPhone is locked
Click to expand...
So the unlocked device is not the iPhone in question? 🤔
 
  • Like
Reactions: mitr0001
Biro said:
Hmmm. I have to wonder about the urgency of the security patches. It’s a time-tested method used repeatedly by Apple to get everyone updated. In this case, to download AI that defaults to “on.”
Click to expand...
As is often the case, a number of these security patches are in the general Unix/Linux world, upstream from Apple. I've already seen them in my Linux VMs.
 
  • Like
Reactions: Jumpthesnark, mitr0001 and Two Appleseeds
Howard2k said:
"One could allow an attacker with physical access to an unlocked device to access the Photos app even when an iPhone is locked"

How does this work?
Click to expand...
A phone can be locked or unlocked. An APP can be locked or unlocked (for example - screen time says you've used that app too much, or parental restrictions)

This is the actual quote, not the modified quote written above by a few users:
Impact: An attacker with physical access to an unlocked device may be able to access Photos while the app is locked
 
  • Like
Reactions: I7guy, Nermal, Jumpthesnark and 5 others
Will there be a patch for iOS/iPadOS 17 too? I have devices that aren’t on 18 yet.

Edit: the article says 17.2, but maybe it really means 18.2?
 
bbeagle said:
A phone can be locked or unlocked. An APP can be locked or unlocked (for example - screen time says you've used that app too much, or parental restrictions)

This is the actual quote, not the modified quote written above by a few users:
Impact: An attacker with physical access to an unlocked device may be able to access Photos while the app is locked
Click to expand...


Thanks. That makes far more sense.

Just incorrect wording in the article.
 
  • Like
Reactions: Jumpthesnark
Normally I update as soon as an update is available, just for the security updates. But you know, this time Apple Intelligence will download all of its cruft and enable by default. I’m hesitating until I find a way to not just shut it off, but empty the trash as well.
 
  • Like
Reactions: Westside guy, 01cowherd, Tig_one and 2 others
BigBlur said:
Whatever happened to Rapid Security Responses? We've only seen a couple of them shortly after its debut way back in July 2023. There haven't been any RSRs since iOS/iPadOS 16.5.1 and macOS 13.4.1.
Click to expand...
Why use Rapid Security Responses when Apple can use regular updates to patch security issues and not-so-gently encourage users to update to the OS version they want us on?
 
Biro said:
Why use Rapid Security Responses when Apple can use regular updates to patch security issues and not-so-gently encourage users to update to the OS version they want us on?
Click to expand...
RSRs were only useful for the sorts of patches that did not involve the SSV. But you're right, they do seem to have quietly disappeared.
 
I am generally happy with the bug fix release schedule - I do think the bigger releases do not have to be so rigorously every year, but that's probably a way to sell more phones. What my gripe is may seem minor, but it pisses me off: the amount of time it takes for the WatchOS install is SO MUCH LONGER than any of the OS installs. What gives with that?" It seems to always enter a "verifying" death loop for an hour. It usually comes out of it, but what gives with that? The compute power is all offloaded to the phones, so it's not like it's limited to the watch's hardware.
 
I hope it'll also be more stable.
The release notes don't say anything, really.

Webkit - or Safari's backend - has also received a major update.
 
> Because of the number of security issues fixed in the update, it is a good idea to update to the new software right away.

Quantity of bug fixes alone shouldn't make someone rush to install, especially if there are other concerns that could be introduced in new code, like with Apple Intelligence. Maybe tell us more about the severity of any one bug that's fixed and very likely to be exploited.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back