Apple is confirming today’s iOS and iPadOS updates to fix the Coruna exploit

Apple has detailed the security content of iOS 16.7.15, iOS 15.8.7, iPadOS 16.7.15, and iPadOS 15.8.7, confirming that the updates address the Coruna vulnerability disclosed last week by Google and iVerify. Here are the details.

Apple moved quickly after the Corona exploit became public

A few days ago, Google and iVerify published information on Coruna, an exploit that bound many vulnerabilities to target iPhones running older versions of iOS.

In summary, the exploit uses five full iOS chains and 23 vulnerabilities on vulnerable devices running iOS 13 through iOS 17.2.1.

Earlier today, Apple released iOS 16.7.15, iOS 15.8.7, iPadOS 16.7.15, and iPadOS 15.8.7, saying only that the system updates contain “important security fixes”.

Now, Apple has published the security content of the updates, confirming that they address kernel and WebKit vulnerabilities related to the Coruna exploit, and that they are fixing it “on devices that cannot update to the latest version of iOS.”

Here is the full security content for iOS 15.8.7 and iPadOS 15.8.7:

The Kernel

Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation)

Impact: The application may be able to execute arbitrary code with kernel permissions. This fix related to the Coruna exploit was shipped with iOS 17 on September 18, 2023. This update brings that fix to devices that cannot upgrade to the latest version of iOS.

Description: An issue with running after free was addressed with improved memory management.

CVE-2023-41974: Félix Poulin-Bélanger

WebKit

Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation)

Impact: Processing poorly designed web content may lead to improper coding. This fix related to the Coruna exploit was shipped with iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot upgrade to the latest version of iOS.

Description: A confounding type problem was addressed with improved testing.

WebKit Bugzilla: 267134

CVE-2024-23222

WebKit

Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation)

Impact: Processing poorly designed web content can lead to memory corruption. This fix related to the Coruna exploit was shipped with iOS 16.6 on July 24, 2023. This update brings that fix to devices that cannot upgrade to the latest version of iOS.

Description: An issue with running after free was addressed with improved memory management.

WebKit Bugzilla: 255951

CVE-2023-43000: Apple

WebKit

Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation)

Impact: Processing poorly designed web content can lead to memory corruption. This fix related to the Coruna exploit was shipped with iOS 17.2 on December 11, 2023. This update brings that fix to devices that cannot upgrade to the latest version of iOS.

Description: The problem was addressed with improved memory management.

WebKit Bugzilla: 260913

CVE-2023-43010: Apple

And here is the full security content for iOS 16.7.15 and iPadOS 16.7.15:

WebKit

Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation

Impact: Processing poorly designed web content can lead to memory corruption. This fix related to the Coruna exploit was shipped with iOS 17.2 on December 11, 2023. This update brings that fix to devices that cannot upgrade to the latest version of iOS.

Description: The problem was addressed with improved memory management.

WebKit Bugzilla: 260913

CVE-2023-43010: Apple

To learn more about Apple’s security releases, follow this link. And if you have an older device that can’t run the latest versions of iOS and iPadOS, it’s very important to check if they’re still up to date.

It’s worth checking out on Amazon