Apple has patched vulnerabilities in iPhone , iPad, and iPod devices with new updates to iOS and iPodOS. The most serious of the vulnerabilities could have been exploited by an attacker to execute arbitrary code.
The bugs were made known on Wednesday as part of the release of updates for iOS 14 and iPadOS 14. The bugs addressed are a total of 11 and are found in products and components, including AppleAVD, Apple Keyboard, WebKit and Siri.
The security flaws haven't been rated by Apple, but they appear to range from moderate to more serious. A bug in Siri , for example, allows someone with physical access to an iPhone to view notification content from the lock screen. Another bug, called Universal Scene Description (USD), could allow an attacker to execute arbitrary code on certain iOS devices.
According to IBM, one of the most significant bugs that Apple has patched is a privilege escalation vulnerability affecting Apple iOS and iPadOS. Known as CVE-2020-9992, the vulnerability could be exploited if a target is tricked into opening a specially crafted file.
Apple identified the flaw in an IDE component, which is essentially the interfaces used to transmit data from a device's motherboard (or circuit board) to the device's storage component.
Researchers Dany Lisiansky and Nikias Bassen were the first to discover the flaw. In its security bulletin, Apple also thanked Brandon Azad of Google Project Zero for his help. Both Apple and the researchers declined to disclose additional details related to the flaw at this time.
The bug was rated as high severity. Researchers suggested that the flaw is linked to a set of Apple developer tools called Xcode. Apple describes Xcode as “a complete set of developer tools for building apps for Mac, iPhone, iPad, Apple Watch and Apple TV.”
Apple's release of Xcode 12.0 on Wednesday mitigates the vulnerability , according to the company.
