iOS 16.1.1 includes fixes for two libxml vulnerabilities • Hacker News Board

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#21

Post by JohnTHaller » Thu, Nov 10, 2022, 2:37 AM UTC

taspeotis wrote: post #20

dustyharddrive wrote: post #8

Earlier quoted context omitted.

Apple doesn’t patch older versions: https://arstechnica.com/gadgets/2022/10/apple-clarifies-secu...

They are still maintaining iOS 12... https://support.apple.com/en-us/HT213428 Published Date: August 31, 2022

IIRC iOS 12 is a special case for a specific device set.

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#22

Post by pjscott » Thu, Nov 10, 2022, 3:26 AM UTC

Thank you, Apple friends! You’ve made the world a better place, and I salute your subtle bug-fixing acumen. These can’t have been easy to find, and you have my completely unironic gratitude.

(I know this sounds extremely corny, but someone should say it.)

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#23

Post by pabs3 » Thu, Nov 10, 2022, 3:48 AM UTC

I note that Debian fixed these a few days earlier. Based on the commits/issues up-thread it sounds like these were embargoed for a while, so I wonder why the difference in release dates between Debian and Apple.

https://www.debian.org/security/2022/dsa-5271

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#24

Post by KerrAvon » Thu, Nov 10, 2022, 5:49 AM UTC

Gigachad wrote: post #13

favorited wrote: post #12

Earlier quoted context omitted.

Because it's just like any other open-source library written in an unsafe language.

With how much money Apple has and how much they promote security. It's quite shocking how we see a major preventable vulnerability come out pretty much every single month. Some credit to them for fixing these things and rolling out the fixes quickly, but at some point we have to question why iOS needs urgent security patches constantly. And you know that all the large governments have troves of these iOS bugs sitting…

There is a Silver Bullet — and here it is.

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#25

Post by worthless-trash » Thu, Nov 10, 2022, 6:17 AM UTC

JohnTHaller wrote: post #21

taspeotis wrote: post #20

Earlier quoted context omitted.

They are still maintaining iOS 12... https://support.apple.com/en-us/HT213428 Published Date: August 31, 2022

IIRC iOS 12 is a special case for a specific device set.

Do you have any details on why this is the case, thats super interesting.

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#26

Post by Fnoord » Thu, Nov 10, 2022, 8:10 AM UTC

taspeotis wrote: post #20

dustyharddrive wrote: post #8

Earlier quoted context omitted.

Apple doesn’t patch older versions: https://arstechnica.com/gadgets/2022/10/apple-clarifies-secu...

They are still maintaining iOS 12... https://support.apple.com/en-us/HT213428 Published Date: August 31, 2022

One would have to do a careful analysis whether iOS 12.x really gets all the security love it requires. Last time I checked (probably 1-2 years ago) the iPhone 5s (a backup smartphone I used) missed security updates.

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#27

Post by theCrowing » Thu, Nov 10, 2022, 8:23 AM UTC

nateb2022 wrote: post #19

parker_mountain wrote: post #9

Earlier quoted context omitted.

Is ios 15 vulnerable? I assume it is, but I can't find a good answer.

Yes, iOS 15 is vulnerable to these and probably others.

Everything is probably vulnerable to other vulnerabilities...

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#28

Post by smcleod » Thu, Nov 10, 2022, 8:52 AM UTC

Seems odd that the macOS update for libxml is 600MB and requires a reboot, not to mention that it requires a reboot on macOS ace Ventura - which was toted as not needing reboots for most security updates.

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#29

Post by pjmlp » Thu, Nov 10, 2022, 3:19 PM UTC

Gigachad wrote: post #13

favorited wrote: post #12

Earlier quoted context omitted.

Because it's just like any other open-source library written in an unsafe language.

With how much money Apple has and how much they promote security. It's quite shocking how we see a major preventable vulnerability come out pretty much every single month. Some credit to them for fixing these things and rolling out the fixes quickly, but at some point we have to question why iOS needs urgent security patches constantly. And you know that all the large governments have troves of these iOS bugs sitting…

Because there is the myth of the perfect C coder, and then there is the hard reality.

Re: iOS 16.1.1 includes fixes for two libxml vulnerabilities

#30

Post by JohnTHaller » Thu, Nov 10, 2022, 4:52 PM UTC

worthless-trash wrote: post #25

JohnTHaller wrote: post #21

Earlier quoted context omitted.

IIRC iOS 12 is a special case for a specific device set.

Do you have any details on why this is the case, thats super interesting.

A bunch of devices lost support with iOS 13. I don't remember offhand but a quick search shows that the iPod Touch 6th Gen was discontinued the latest of the iOS 12 supported devices. It was sold through mid 2019. So I think that's why.