The security content of iOS 10.3.3

Re:The security content of iOS 10.3.3 by pjmlp on Wednesday July 19, 2017 @04:17PM (#14807521)

2 x "A buffer overflow issue was addressed through improved memory handling."

7 x "A memory corruption issue was addressed with improved bounds checking."

Oh well....

[ Parent | on HN ]

Re:The security content of iOS 10.3.3 by pqdbr on Wednesday July 19, 2017 @04:26PM (#14807595)

With 13x arbitrary code execution, being 5x with either kernel or system privileges.

[ Parent | on HN ]

Re:The security content of iOS 10.3.3 by hellbanner on Wednesday July 19, 2017 @05:36PM (#14808189)

Yes, and previous decimal versions had similarly powerful exploits.

[ Parent | on HN ]

Re:The security content of iOS 10.3.3 by BinaryRage on Thursday July 20, 2017 @02:53AM (#14810504)

They should rewrite in Rust...

[ Parent | on HN ]

Re:The security content of iOS 10.3.3 by pjmlp on Thursday July 20, 2017 @03:40AM (#14810678)

No, they should stop using C or C style coding in C++, and write those parts in a mix of modern C++17 and Swift.

[ Parent | on HN ]

Re:The security content of iOS 10.3.3 by vijayr02 on Wednesday July 19, 2017 @05:03PM (#14807895)

Or maybe... just maybe, an agency belatedly realised the "Defending Our Nation" part of its motto really means something.

[ Parent | on HN ]

Re:The security content of iOS 10.3.3 by PhantomGremlin on Wednesday July 19, 2017 @04:54PM (#14807808)

This is depressing.

I normally shrug off security vulnerabilities in iOS. But so many in such a minor release?

I know it's not a valid extrapolation ... but if there are so many being fixed just today, that means there are hundreds if not thousands of still undiscovered ones remaining.

And Android is probably even worse.

To repeat myself: this is depressing.

[ Parent | on HN ]

Re:The security content of iOS 10.3.3 by ccrush on Wednesday July 19, 2017 @05:39PM (#14808217)

https://technet.microsoft.com/en-us/library/security/ms17-01...

This is Microsoft's patch covering ShadowBrokers-leaked ETERNALBLUE SMB remote code execution 0day. The iOS 10.3.3 is likely the response to either the CIA Vault7 Wikileaks stash or the ShadowBrokers NSA EquationGroup stash. These exploits are probably out there in the hands of many people, and Apple had to respond.

[ Parent | on HN ]

Re:The security content of iOS 10.3.3 by WalterGR on Thursday July 20, 2017 @01:28AM (#14810188)

That Microsoft link lists 6 CVEs.

Apple's security content page lists 48.

That's probably an unfair comparison. How many vulnerabilities have been patched for all of those leaks / stashes by Apple and Microsoft?

It seems like we'd need to know those numbers in order to fairly judge whether PhantomGremlin should feel depressed or not.

[ Parent | on HN ]