site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-01-27-2025-2 iOS 18.3 and iPadOS 18.3 iOS 18.3 and iPadOS 18.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/122066. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An attacker with physical access to an unlocked device may be able to access Photos while the app is locked Description: An authentication issue was addressed with improved state management. CVE-2025-24141: Abhay Kailasia (@abhay_kailasia) from C-DAC Thiruvananthapuram India AirPlay Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An attacker on the local network may be able to cause unexpected system termination or corrupt process memory Description: An input validation issue was addressed. CVE-2025-24126: Uri Katz (Oligo Security) AirPlay Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may cause an unexpected app termination Description: A type confusion issue was addressed with improved checks. CVE-2025-24129: Uri Katz (Oligo Security) AirPlay Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An attacker in a privileged position may be able to perform a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2025-24131: Uri Katz (Oligo Security) AirPlay Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved input validation. CVE-2025-24177: Uri Katz (Oligo Security) AirPlay Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution Description: A type confusion issue was addressed with improved checks. CVE-2025-24137: Uri Katz (Oligo Security) ARKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Parsing a file may lead to an unexpected app termination Description: The issue was addressed with improved checks. CVE-2025-24127: Minghao Lin (@Y1nKoc), babywu, and Xingwei Lin of Zhejiang University CoreAudio Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Parsing a file may lead to an unexpected app termination Description: The issue was addressed with improved checks. CVE-2025-24160: Google Threat Analysis Group CVE-2025-24161: Google Threat Analysis Group CVE-2025-24163: Google Threat Analysis Group CoreMedia Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Parsing a file may lead to an unexpected app termination Description: The issue was addressed with improved checks. CVE-2025-24123: Desmond working with Trend Micro Zero Day Initiative CVE-2025-24124: Pwn2car & Rotiple (HyeongSeok Jang) working with Trend Micro Zero Day Initiative CoreMedia Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2. Description: A use after free issue was addressed with improved memory management. CVE-2025-24085 ImageIO Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing an image may lead to a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2025-24086: DongJun Kim (@smlijun) and JongSeong Kim (@nevul37) in Enki WhiteHat, D4m0n Kernel Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A malicious app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2025-24107: an anonymous researcher Kernel Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: A validation issue was addressed with improved logic. CVE-2025-24159: pattern-f (@pattern_F_) LaunchServices Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved redaction of sensitive information. CVE-2025-24117: Michael (Biscuit) Thomas (@biscuit@social.lol) libxslt Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This issue was addressed through improved state management. CVE-2025-24166: Ivan Fratric of Google Project Zero Managed Configuration Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Restoring a maliciously crafted backup file may lead to modification of protected system files Description: This issue was addressed with improved handling of symlinks. CVE-2025-24104: Hichem Maloufi, Hakim Boukhadra Passkeys Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An app may gain unauthorized access to Bluetooth Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2024-9956: mastersplinter Safari Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Visiting a malicious website may lead to address bar spoofing Description: The issue was addressed by adding additional logic. CVE-2025-24128: @RenwaX23 Safari Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Visiting a malicious website may lead to user interface spoofing Description: The issue was addressed with improved UI. CVE-2025-24113: @RenwaX23 SceneKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Parsing a file may lead to disclosure of user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2025-24149: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Time Zone Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An app may be able to view a contact's phone number in system logs Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2025-24145: Kirin (@Pwnrin) WebContentFilter Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write was addressed with improved input validation. CVE-2025-24154: an anonymous researcher WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: A maliciously crafted webpage may be able to fingerprint the user Description: The issue was addressed with improved access restrictions to the file system. WebKit Bugzilla: 283117 CVE-2025-24143: an anonymous researcher WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing web content may lead to a denial-of-service Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 283889 CVE-2025-24158: Q1IQ (@q1iqF) of NUS CuriOSity and P1umer (@p1umer) of Imperial Global Singapore. WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 284159 CVE-2025-24162: linjy of HKUS3Lab and chluo of WHUSecLab WebKit Web Inspector Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Copying a URL from Web Inspector may lead to command injection Description: A privacy issue was addressed with improved handling of files. WebKit Bugzilla: 283718 CVE-2025-24150: Johan Carlsson (joaxcar) Additional recognition Accessibility We would like to acknowledge Abhay Kailasia (@abhay_kailasia) from LNCT Bhopal and C-DAC Thiruvananthapuram India for their assistance. Audio We would like to acknowledge Google Threat Analysis Group for their assistance. CoreAudio We would like to acknowledge Google Threat Analysis Group for their assistance. CoreMedia Playback We would like to acknowledge Song Hyun Bae (@bshyuunn) and Lee Dong Ha (Who4mI) for their assistance. Files We would like to acknowledge Chi Yuan Chang of ZUSO ART and taikosoup for their assistance. Notifications We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi Narain College of Technology Bhopal India, Xingjian Zhao (@singularity-s0) for their assistance. Passwords We would like to acknowledge Talal Haj Bakry and Tommy Mysk of Mysk Inc. @mysk_co for their assistance. Phone We would like to acknowledge Abhay Kailasia (@abhay_kailasia) from C-DAC Thiruvananthapuram India and an anonymous researcher for their assistance. Screenshots We would like to acknowledge Yannik Bloscheck (yannikbloscheck.com) for their assistance. Sleep We would like to acknowledge Abhay Kailasia (@abhay_kailasia) from LNCT Bhopal and C-DAC Thiruvananthapuram India for their assistance. Static Linker We would like to acknowledge Holger Fuhrmannek for their assistance. VoiceOver We would like to acknowledge Bistrit Dahal, Dalibor Milanovic for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 18.3 and iPadOS 18.3". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmeYAKEACgkQX+5d1TXa IvoIlRAAjpPcJgVj+XHC5TxQS97uydbuUy2tUFwOvg1HUEqNwjWevlBxQpotGfWi 6B/n5eWJgShCh1QsShVmd5xH2QBU0seVRtDzRFObL66eXalfXuUClbw6rCPpsCtf m+zRokoGMTg8VbEMSPQpx8NUwe/s0U7ZJsm59eZW8nUwKam9+DrKy8dUg0LtrHIU 6gZO2KGRV5HtFYOzSA3zNIG5CxpmCkyS/nMKNrrYflPVkziTaPhCZ4EUnXOvUhRw 7nbMYPi9xosuIqeDsPijm59980Fa9ZLorBYujiyZj94WOWteK1g9aXZjb/Sh7fex +ibHdU4eIKGWSuXB8r+WFGRR04VcyeIF91y4h8BV0VfdndElEOCfV22gdaUlSSrY sWfKH5AMkd08IsMX8Ryf8T0GLq8N6rGO9gwlvrMvW6B9sUqKcdm2NXIpi/xl4SGL akA2HQNivsRFy9YjRa4BvhjffU5pdk2FaZWTNPLL0EX0/P+Joitgwlm2IY51WqOO QK/opRALj1ns34eUBg+Xte9DMBF+aTF2xgf2Wqz7nrIDyzMg8DNhkTIFM9f1afTq a8neEzCYRzJyus0+617mPFsbPQTDxfGUsGuyxLyykOZ479/++jJGej+4wMAGt0wd c8LrkLsnpByj42Hx+U0cJg5Z1yJwY5ovWd221qZC+050B2vmRTw= =kN81 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com