Apple releases large surprise set of security patches

Apple has pushed out another large set of security patches for its mobile, desktop, wearable and TV operating systems, addressing a range of issues.

There are patches for macOS Catalina, Big Sur and Monterey, with the first two operating systems having the Safari web browser updated to version 15.6 which fixes two memory corruption issues, and an infoleak bug that can be triggered by visiting malicious websites.

Monterey, the latest stable version of macOS, is upgraded to version 12.5 with patches for 57 bugs.

Only two of them are said to be remotely exploitable, with one affecting the CoreText font handler, and a memory corruption issue in Monterey's wi-fi driver that can also crash the system.

Apple's iOS and iPadOS are upgraded to version 15.6, addressing one remotely exploitable vulnerability in AppleAVD video and audio system that Google's Project Zero found, on top of the two abovementioned bugs.

Patches are also available for watchOS and tvOS.

None of the vulnerabilities are believed to have been exploited in the wild.

Whereas Apple provides no indication as to how serious the bugs it issues patches for, security vendor SANS Internet Storm Center researcher Johannes Ullrich rated five  vulnerabilities as critical.

These include the AppleAVD buffer overflow condition, indexed as CVE-2022-32788, and the CoreText vulnerability (CVE-2022-32839).

Ullrich also rated CVE-2022-32787 affecting the ICU, the WebKit Bugzilla WebRTC real-time communications component for Safari's rendering engine (no CVE assigned) and a logic flaw in the ImageIO image handling code as critical (CVE-2022-32802).