Apple Releases iOS 16.5.1 to Fix Zero-Day Vulnerabilities

Apple released yesterday iOS 16.5.1 and its iPad counterpart, iPadOS 16.5.1. The updates fix an issue that prevents charging with the Lightning to USB 3 Camera Adapter, but they also address two zero-day vulnerabilities that may have already been exploited by attackers.

First, Apple fixed a Kernel vulnerability that may allow apps to execute arbitrary code with kernel privileges. “Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7,” the company explained yesterday.

Apple also fixed a WebKit vulnerability that may lead to arbitrary code execution from attackers. Because WebKit is the only rendering engine Apple allows on iOS, the security implications of this arbitrary restriction can be pretty serious. Apple didn’t discuss at WWDC if iOS 17 will finally allow third-party web browsers to use other rendering engines, but both Google and Mozilla are already preparing for this change.

Apple also released macOS Ventura 13.4.1 and watchOS 9.5.2 yesterday to address the same security vulnerabilities. The company also released security updates for iOS 15, iPadOS 15, macOS Monterey, macOS Big Sur, and watchOS 8.

Last but not least, the second developer betas of iOS 17 and iPadOS 17 were also released yesterday. New features include the ability to tap two iPhones together to share content via AirDrop, a slider to control crossfade in Apple Music, and Stage Manager improvements.