Last month, Apple released a file of 179 security patches for nearly every one of its products. This month, the Cupertino-based tech giant has released just 28 security patches, just for its iOS and Mac OS X operating systems and Safari, the company's web browser.
Most of the fixes were included with the release of OS X El Capitan 10.11.3, nine to be exact. Some of them address critical issues that allow attackers to execute arbitrary code in the operating system kernel via OS features such as AppleGraphicsPowerManagement, IOAcceleratorFamily, Disk Images, IOHIDFamily, and IOKit.
Additionally, a security issue will be fixed in the OS X kernel, which also allowed arbitrary code execution, after Apple was informed of its presence by a Google engineer from Project Zero.
Other security updates included in OS X El Capitan 10.11.3 address an arbitrary code execution with root privileges during syslog operation, a bug in libxslt that allowed attackers to execute code on the operating system by tricking the user into visiting a malicious website, and an issue with the Mac that allowed a quarantined application to replace the OSA script libraries on the system.
Additionally, Apple released Safari 9.0.3 to fix five security flaws in the WebKit rendering engine that allowed attackers to execute code on the underlying operating system by tricking the user into visiting a malicious website.
In a sixth version of Safari, it involved a privacy situation where websites are able to know if the user has visited a particular link in the past.
For iOS, Apple fixed 13 security bugs with the release of iOS 9.2.1. Twelve of these issues were shared with OS X and Safari, such as those in the kernel, Disk Images, IOKit, IOHIDFamily, libxslt, and syslog utilities.
The only security flaw that was specific to iOS was an issue in WebSheet, which could be exploited by malicious websites to give away a user's cookies.
Between the December 2015 and January 2016 security updates, Apple patched QuickTime on January 7, with the release of version 7.7.9, which addressed nine security vulnerabilities for Windows Vista and Windows 7.
The technical details of exploiting the vulnerabilities and all of these fixes and their CVE identifiers remain secret for now until everyone has a chance to update their operating system.
