Re:About the security content of iOS 16.2 and iPadOS 16.2
by phs318u on Tuesday December 13, 2022 @09:27PM
(#33979276)
> Note, at this time, these CVEs are not public
I'm not sure what the lag is, but from what I've seen all Apple CVE's are made public at some point. The last one I got before this bunch (from [email protected]) was a month ago (relating to iOS and iPadOS 16.1.1 addressing a libxml2 integer overflow - CVE-2022-40303). If you look up that CVE at mitre.org, it's no longer marked as "RESERVED".
This hides the severity of the problems the patch fixes. The word "fix" is nowhere on that page. Presumably, Apple are releasing these poor-quality release notes in order to protect their public brand. Those corporate objectives are coming at a cost of writing quality and clarity.
Note, at this time, these CVEs are not public, so the savvy user can not search them up themselves.
I think patch notes are important, and reasonable effort should be made to make them clear. Instead, effort was made to obscure. Clarity should be the default!