About the security content of iOS 18.1 and iPadOS 18.1 – Apple Support

About the security content of iOS 18.1 and iPadOS 18.1 - Apple Support

October 28, 2024 at 12:06PM

Apple will release iOS 18.1 on October 28, 2024, addressing multiple vulnerabilities affecting devices such as iPhone XS and later. Key issues include improved authentication for physical access vulnerabilities, better handling of symlinks, and enhanced input validation to prevent memory corruption and unauthorized access to sensitive data.

### Meeting Takeaways

**Apple ID**: 121563
**Release Date**: October 28, 2024

**Affected Product**: Security content for iOS 18.1 and iPadOS 18.1.
**Update Availability**: For devices including iPhone XS and later, various models of iPad Pro, iPad Air, iPad, and iPad mini from specific generations onward.

#### Key Issues Addressed:
1. **CVE-2024-44274**: Improved authentication to prevent sensitive data viewing by attackers with physical device access.

2. **CVE-2024-44255**: Enhanced path handling; malicious apps might run shortcuts without user consent.

3. **CVE-2024-44273**: Improved symlink handling; malicious apps may access private info.

4. **CVE-2024-44240 & CVE-2024-44302**: Enhanced checks to prevent memory disclosure while processing malicious fonts.

5. **CVE-2024-44282**: Improved checks to prevent memory disclosure while processing malicious images.

6. **CVE-2024-44297**: Enhanced bounds checks to mitigate denial-of-service via malicious messages.

7. **CVE-2024-44285**: Improved memory management to avoid system crashes or kernel memory corruption.

8. **CVE-2024-40867**: Improved URL scheme handling to prevent remote attacks bypassing web content sandboxing.

9. **CVE-2024-44239**: Enhanced data redaction to shield sensitive kernel state from application leaks.

10. **CVE-2024-44258 & CVE-2024-44252**: Improved file handling to prevent malicious backups from modifying protected system files.

11. **CVE-2024-44277**: Enhanced memory handling to prevent unexpected terminations and kernel memory corruption.

12. **CVE-2024-44259**: Improved state management to prevent exploitation of trust relationships for downloading malicious content.

13. **CVE-2024-44229**: Additional validation to prevent private browsing history leaks.

14. **CVE-2024-44218 & CVE-2024-44254**: Enhanced redaction of sensitive information to prevent unauthorized access by apps.

15. **CVE-2024-44269, CVE-2024-44194, CVE-2024-40851, CVE-2024-44263**: Improved state management to prevent apps from accessing sensitive user data.

16. **CVE-2024-44278 & CVE-2024-44251**: Improved state management to mitigate the risk of viewing restricted content from the lock screen.

17. **CVE-2024-44235**: Enhanced checks to prevent access to restricted content by attackers.

18. **CVE-2024-44261 & CVE-2024-44296**: Improved checks related to Content Security Policy enforcement against malicious web content.

19. **CVE-2024-44244**: Enhanced input validation to prevent process crashes caused by malicious web content.

This update is crucial for maintaining device security against various attack vectors and enhancing the overall integrity of user data. Users are encouraged to update their devices to the latest versions as soon as they become available.

Full Article