Updates were released in a frenzy in December as companies like Google and Apple scrambled to release patches in time for the holidays in order to address critical vulnerabilities in their devices.
Giants in enterprise software also released their fair share of fixes; in December, Atlassian and SAP fixed a number of serious bugs. What you should know about the significant updates you may have missed this month is provided here.
iOS for Apple
Apple launched iOS 17.2, a significant point update, in the middle of December. It included 12 security patches along with new features like the Journal app. CVE-2023-42890, a bug in the WebKit browser engine that could allow an attacker to execute code, is one of the issues patched in iOS 17.2.
According to Apple's support page, there is another vulnerability in the iPhone's kernel, identified as CVE-2023-4291, that might allow an app to escape its safe sandbox. In the meantime, code execution may result from two ImageIO vulnerabilities, CVE-2023-42898 and CVE-2023-42899.
According to tests conducted by ZDNET and 9to5Mac, the iOS 17.2 update also implemented a technique to stop a Bluetooth attack using a penetration testing tool called Flipper Zero. An iPhone may experience a barrage of pop-ups and eventually freeze up due to a bothersome denial of service cyberattack.
Along with these updates, Apple also launched tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2, and iOS 16.7.3.
Android by Google
With the fixes for around 100 security problems, the Google Android December Security Bulletin was quite extensive. Two serious Framework vulnerabilities are patched in this update; the most serious of them might result in remote privilege escalation without the requirement for additional privileges. According to Google, user engagement is not required for exploitation.
While CVE-2023-40078 is an elevation of privilege bug with a high impact rating, CVE-2023-40088 is a major hole in the system that could allow for remote code execution.
Additionally, Google has released an update to address CVE-2023-40094, an elevation of privilege vulnerability in its WearOS platform for smart devices. As of this writing, the Pixel Security Bulletin has not been published.
Chrome by Google
Google released an urgent patch for its Chrome browser to cap off a busy December of upgrades in style. The open source WebRTC component contains a heap buffer overflow vulnerability, or CVE-2023-7024, which is the ninth zero-day vulnerability affecting Chrome in 2024. In an advisory, Google stated that is "aware that an exploit for CVE-2023-7024 exists in the wild."
It was not the first update that Google made available in December. In mid-month, the software behemoth also released a Chrome patch to address nine security flaws. Five of the vulnerabilities that were found by outside researchers are classified as high severity. These include four use-after-free problems, a type misunderstanding flaw in V8, and CVE-2023-6702.
Microsoft
More than 30 vulnerabilities, including those that allow remote code execution (RCE), are fixed by Microsoft's December Patch Tuesday. CVE-2023-36019, a spoofing vulnerability in Microsoft Power Platform Connector with a CVSS score of 9.6, is one of the critical solutions. An attacker may be able to deceive the victim by manipulating a malicious link, software, or file. To be compromised, though, you would need to click on a URL that has been carefully constructed.
In the meantime, the Windows MSHTML Platform RCE issue CVE-2023-35628 has a CVSS score of 8.1, making it classified as critical. Microsoft stated that an attacker may take advantage of this vulnerability by sending a specially constructed email that would activate immediately when it is fetched and processed by the Outlook client. This might result in exploitation even before the email is seen in Preview Pane.
