iOS 14.4.2, iPadOS 14.4.2 and watchOS 7.3.3

enaph

enaph

Level 30
Verified
Honorary Member
Top Poster
Well-known
Forum Veteran
Released March 26, 2021

WebKit

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited.

Description: This issue was addressed by improved management of object lifetimes.

CVE-2021-1879: Clement Lecigne of Google Threat Analysis Group and Billy Leonard of Google Threat Analysis Group
Click to expand...
 
I would honestly jump on these "dot release" updates where the changelog basically only mentions 1 or 2 security bugs that are "actively exploited". That seems to be Apple speak for "drive by exploits". The releases that have a bunch of features/improvements mentioned are worth holding off on a little, but as a security minded person, these should be treated the same way you'd treat an out-of-band Microsoft security update.
 
Divine_Barakah said:
Updated my iPhone XS Max to iOS 14.4.2

Downloaded the full software from Download iOS Firmware for iPhone, iPad, iPod Touch, Apple Watch, Apple TV and HomePod / IPSW Downloads and then updated using iTunes. That way I can download the software files using IDM for the best download speed.
Click to expand...
It doesn't make sense doing this. Loading full update instead of OTA need more time and consume more power for no advantage.
Using external tools for important OS updates is also a lot higher attack surface ❗

This should never be done over PC if not necessary.
 
SecurityNightmares said:
It doesn't make sense doing this. Loading full update instead of OTA need more time and consume more power for no advantage.
Using external tools for important OS updates is also a lot higher attack surface ❗

This should never be done over PC if not necessary.
Click to expand...
I have been using iPhones since 2015 and installing updates over OTA has always caused issues and bugs, at least for me. The site, which I have been using for years, fetches updates directly from Apple, and iTunes does verify the update file which is signed by Apple. I am not sure if you thought that I used “external tools” meaning sth other than iTunes, but what I did is sth that consumes time but spares me from annoying bugs and unwanted issues.
 
I understand that Apple has also patched iOS 12 due to this issue, presumably to help protect unsupported devices.
So I think this security update must be pretty important. It also suggests that iOS has been vulnerable for several years.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top