You Need to Update iOS, Android, and Chrome Right Now
Credit to Author: Kate O’Flaherty| Date: Fri, 29 Apr 2022 11:00:00 +0000
To revist this article, visit My Profile, then View saved stories.
To revist this article, visit My Profile, then View saved stories.
April has been a big month for security updates, including emergency patches for Apple’s iOS and Google Chrome to fix vulnerabilities already being used by attackers.
Microsoft has released important fixes as part of its mid-April Patch Tuesday, while Android users across multiple devices need to make sure they are applying the latest update when it becomes available.
Here are all the April updates you need to know about.
Just two weeks after the launch of iOS 15.4, Apple issued iOS and iPad 15.4.1 to fix a vulnerability in AppleAVD that’s already being used to attack iPhones. By exploiting the vulnerability, labeled CVE-2022-22675, adversaries could execute arbitrary code with kernel privileges via an app, according to Apple’s support page. This could give an attacker full control over your device, so it’s important to apply the fix.
As an added bonus, iOS and iPadOS 15.4.1 fixes a battery drain issue affecting some iPhones on iOS 15.4. The updates are available for iPhone 6s and later, iPad Pro, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch 7th generation.
Meanwhile, macOS Monterey 12.3.1 fixes the same issue in macOS, as well as another vulnerability in the Intel graphics driver, CVE-2022-22674, which could allow an app to read kernel memory. It’s another important fix—Apple says the issue may have been exploited by attackers.
Apple also released tvOS 15.4.1 and watchOS 8.5.1 including bug fixes.
Apple updates have been coming thick and fast over the past year, with the iPhone maker fixing a number of significant vulnerabilities, including the zero-click issue exploited by the Pegasus spyware, the highly targeted malware developed by Israeli firm NSO Group. This was the subject of a recent report by security researchers at Citizen Lab, who have detailed how Pegasus and other similar zero-click attacks targeted members of the European Parliament, legislators, political activists, and civil society organizations.
A zero-click attack is particularly scary because, as the name implies, it requires no interaction to work. That means an image sent via iMessage could infect your iPhone with spyware.
Citizen Lab detailed a previously undisclosed iOS zero-click vulnerability called HOMAGE used by NSO Group. Some iOS versions prior to iOS 13.2 could be at risk, making it all the more important your iPhone is up to date.
Android users also need to be on alert, as Google has patched 44 flaws in its mobile operating system this month. According to Google’s Android Security Bulletin, the most severe issue in the framework component could allow local privilege escalation without any interaction from the user.
The update is split into two parts: the 2022-04-01 security patch level for most Android devices, and the 2022-04-05 security patch level applying to specific phones and tablets. The later of the two fixes 30 issues in system and kernel components, among other areas. There are also patches for five security issues specific to Google’s Pixel smartphones, one of which could allow an app to escalate privileges and execute code on certain versions of Linux.
To find the update, you’ll need to check your device settings. Devices that have received the Android April update so far include Google’s Pixel devices and some third-party Android phones, including the Samsung Galaxy A32 5G, A51, A52 5G, A53 5G, A71, S10 series, S20 series, Note20 series, Z Flip 5G, Z Flip3, Z Fold, Z Fold2, and the Z Fold3, as well as the OnePlus 9 and OnePlus 9 Pro.
As the world’s biggest browser with over 3 billion users, it’s no surprise attackers are targeting Google Chrome. Browser-based attacks are particularly worrying because they can potentially be chained together with other vulnerabilities and used to take over your device.
It has been a particularly busy month for the team behind Google’s Chrome browser, which has seen several security updates within weeks of each other. The latest, pushed out in mid-April, fixes two issues including a high-severity zero-day vulnerability, CVE-2022-1364, which is already being used by attackers.
The technical details aren’t currently available, but the timing of the fix—just a day after it was reported—indicates it’s pretty serious. If you use Chrome, your browser should now be on version 100.0.4896.127 to include the fix. You’ll need to restart Chrome after the update has installed to ensure it activates.
The Chrome issue also impacts other Chromium-based browsers, including Brave, Microsoft Edge, Opera, and Vivaldi, so if you use one of those, make sure you apply the patch.
But that’s not all. On April 27, Google announced another Chrome update, fixing 30 security vulnerabilities. None of these have been exploited yet, the company says, but seven are rated as being a high risk. The update takes the browser to version 101.0.4951.41.
In mid-April, Oracle released its quarterly Critical Patch Update, including a whopping 520 security fixes. Some of the issues fixed in the update are serious—300 of them can be exploited remotely without authentication, and 75 security issues are rated as critical severity. Some of the Oracle patches address CVE-2022-22965, aka Spring4Shell, a remote code execution (RCE) flaw in the spring framework.
Microsoft had a major Patch Tuesday in April, issuing fixes for over 100 vulnerabilities, including 10 critical RCE flaws. One of the most important, CVE-2022-24521, is already being exploited by attackers, according to the company.
Reported by the NSA and researchers at CrowdStrike, the issue in the Windows Common Log File system driver doesn’t require human interaction to be exploited and can be used to obtain administrative privileges on a logged-in system. Other notable fixes include CVE-2022-26904—a publicly known issue—and CVE-2022-26815, a severe DNS Server flaw.
On April 5, Mozilla released a patch to fix security issues in its Thunderbird email client as well as its Firefox browser. The details are scant, but Thunderbird 91.8 fixes four vulnerabilities rated as having a high impact, some of which could be exploited to run arbitrary code.
Firefox ESR 91.8 and Firefox 99 also fix multiple security issues.
The Elementor website builder plug-in for WordPress has received a big security fix in April for a critical-rated vulnerability that could allow attackers to perform remote code execution and effectively take over a website.
Found by researchers at Plugin Vulnerabilities, the flaw was introduced in the plug-in in version 3.6.0, released on March 22. “We would recommend not using this plugin until it has had a thorough security review and all issues are addressed,” the researchers said.
Although the attacker must be authenticated to exploit the issue, it’s still pretty serious because anyone logged into an affected website can exploit it. The update for Elementor’s 5 million users, version 3.6.3, should be applied as soon as possible.