-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-10-28-2024-2 iOS 17.7.1 and iPadOS 17.7.1 iOS 17.7.1 and iPadOS 17.7.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121567. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An attacker with physical access to a locked device may be able to view sensitive user information Description: The issue was addressed with improved authentication. CVE-2024-44274: Rizki Maulana (rmrizki.my.id), Matthew Butler, Jake Derouin CoreText Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: The issue was addressed with improved checks. CVE-2024-44240: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CVE-2024-44302: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative Foundation Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Parsing a file may lead to disclosure of user information Description: An out-of-bounds read was addressed with improved input validation. CVE-2024-44282: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative ImageIO Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing an image may result in disclosure of process memory Description: This issue was addressed with improved checks. CVE-2024-44215: Junsung Lee working with Trend Micro Zero Day Initiative ImageIO Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted message may lead to a denial- of-service Description: The issue was addressed with improved bounds checks. CVE-2024-44297: Jex Amro Kernel Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An app may be able to leak sensitive kernel state Description: An information disclosure issue was addressed with improved private data redaction for log entries. CVE-2024-44239: Mateusz Krzywicki (@krzywix) Managed Configuration Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Restoring a maliciously crafted backup file may lead to modification of protected system files Description: This issue was addressed with improved handling of symlinks. CVE-2024-44258: Hichem Maloufi, Christian Mina, Ismail Amzdak MobileBackup Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Restoring a maliciously crafted backup file may lead to modification of protected system files Description: A logic issue was addressed with improved file handling. CVE-2024-44252: Nimrat Khalsa, Davis Dai, James Gill (@jjtech@infosec.exchange) Safari Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Maliciously crafted web content may violate iframe sandboxing policy Description: A custom URL scheme handling issue was addressed with improved input validation. CVE-2024-44155: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India) Safari Downloads Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An attacker may be able to misuse a trust relationship to download malicious content Description: This issue was addressed through improved state management. CVE-2024-44259: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India) SceneKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: A buffer overflow was addressed with improved size validation. CVE-2024-44144: 냥냥 SceneKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted file may lead to heap corruption Description: This issue was addressed with improved checks. CVE-2024-44218: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Shortcuts Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: A malicious app may use shortcuts to access restricted files Description: A logic issue was addressed with improved checks. CVE-2024-44269: an anonymous researcher Siri Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: A sandboxed app may be able to access sensitive user data in system logs Description: An information disclosure issue was addressed with improved private data redaction for log entries. CVE-2024-44278: Kirin (@Pwnrin) VoiceOver Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: An attacker may be able to view restricted content from the lock screen Description: This issue was addressed by restricting options offered on a locked device. CVE-2024-44261: Braylon (@softwarescool) WebKit Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: The issue was addressed with improved checks. WebKit Bugzilla: 278765 CVE-2024-44296: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India) Additional recognition Security We would like to acknowledge Bing Shi, Wenchao Li and Xiaolong Bai of Alibaba Group for their assistance. Spotlight We would like to acknowledge Paulo Henrique Batista Rosa de Castro (@paulohbrc) for their assistance. WebKit We would like to acknowledge Eli Grey (eligrey.com) for their assistance. This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 17.7.1 and iPadOS 17.7.1". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmcf/ygACgkQX+5d1TXa Ivp70A//T4cT9o2AwfLjB9L//65uQu1OEDEoX/dzeVg+V8TDPtTrWCQPhum7J0Dj m133fcAFJKoAe65cc3u9C5LH1sNqR9LkMyHVDLavL5cFZRgyHKBJ6JR0AGRRBP6G zGHeU/O5xT7yrJHl31EGODyezzTb+0P5TJ7pCY7SmJNRjrQV0Vhhk87c5bp6dBQa vXIIQNKxJU4Z1jPX3XhKaNQ+UwJONWcDMiDLsuuILsZ5bd1DEfviUiw28NmhLSXF crQjk5qh0/Cago8EYSs/m6geHrLQk+clT1g5UpVBncSyJAY76iUzzrPfgp8lS8mO QztYw5VV9eR+qxpLlJEmROZRg2bOsIMRygmCaA3Z1Eh4sq00jMpS7V7M0BHKBoeR bw2I0asAc0emU1ap/xH4vHGSHEwoPGl36Wl12p3KXNhWIQ3t7jLkQRkq+hvAi9Yu cBWd84xEq1tbJEImNifiqc4Xe83+QlZfSDmNkavfpxYEKfiojtn2mFQu2FypkZz7 +Avrk3F1iY/FFzZqzjr3rOc+tGxHlPPj7lLsjfGRu5iiifC/3H9oRQ6C6KVxS/zD NnaHZDxQkUFOCCOxtSWeCq8ajKyM5wLdqGKRjWS57rwxJM5qxwfWVe/Z76mkSnNm 4UnyPu1zHT3vmwXS7uhmkkL+nV3OncIhqF0dGc+abYlSGbFi+rs= =+rNo -----END PGP SIGNATURE-----