Apple Patches Everything, Again, (Tue, Nov 4th)

This post was originally published on this site

Apple released its expected set of operating system upgrades. This is a minor feature upgrade that also includes fixes for 110 different vulnerabilities. As usual for Apple, many of the vulnerabilities affect multiple operating systems. None of the vulnerabilities is marked as already exploited. Apple only offers very sparse vulnerability descriptions. Here are some vulnerabilities that may be worth watching:

CVE-2025-43338, CVE-2025-43372: A memory corruption vulnerability in ImageIO. ImageIO is responsible for rendering images, and vulnerabilities like this have been exploited in the past for remote code execution. CVE-2025-43400, a vulnerability affecting FontParser, could have a similar impact.

CVE-2025-43431: A memory corruption issue in WebKit. This could be used to execute code via Safari.

 

iOS 26.1 and iPadOS 26.1 macOS Tahoe 26.1 macOS Sequoia 15.7.2 macOS Sonoma 14.8.2 tvOS 26.1 watchOS 26.1 visionOS 26.1 Safari 26.1 Xcode 26.1
CVE-2025-31199: An app may be able to access sensitive user data.
Affects Spotlight
      x          
CVE-2025-43292: An app may be able to access sensitive user data.
Affects CoreMedia
    x            
CVE-2025-43294: An app may be able to access sensitive user data.
Affects MallocStackLogging
x       x x      
CVE-2025-43322: An app may be able to access user-sensitive data.
Affects Admin Framework
  x x x          
CVE-2025-43334: An app may be able to access user-sensitive data.
Affects sudo
  x x x          
CVE-2025-43335: An app may be able to access user-sensitive data.
Affects Security
  x x x          
CVE-2025-43336: An app with root privileges may be able to access private information.
Affects SoftwareUpdate
  x x x          
CVE-2025-43337: An app may be able to access sensitive user data.
Affects AppleMobileFileIntegrity
    x            
CVE-2025-43338: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Affects ImageIO
      x          
CVE-2025-43348: An app may bypass Gatekeeper checks.
Affects Finder
  x x x          
CVE-2025-43350: An attacker may be able to view restricted content from the lock screen.
Affects Control Center
x                
CVE-2025-43351: An app may be able to access protected user data.
Affects StorageKit
  x              
CVE-2025-43361: A malicious app may be able to read kernel memory.
Affects Audio
    x x          
CVE-2025-43364: An app may be able to break out of its sandbox.
Affects NetFSFramework
  x              
CVE-2025-43372: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Affects ImageIO
      x          
CVE-2025-43373: An app may be able to cause unexpected system termination or corrupt kernel memory.
Affects Wi-Fi
  x x x          
CVE-2025-43377: An app may be able to cause a denial-of-service.
Affects Model I/O
  x x            
CVE-2025-43378: An app may be able to access sensitive user data.
Affects AppleMobileFileIntegrity
  x x            
CVE-2025-43379: An app may be able to access protected user data.
Affects AppleMobileFileIntegrity
x x x x x x x    
CVE-2025-43380: Parsing a file may lead to an unexpected app termination.
Affects sips
  x x x          
CVE-2025-43381: A malicious app may be able to delete protected user data.
Affects CoreServicesUIAgent
  x              
CVE-2025-43382: An app may be able to access sensitive user data.
Affects AppleMobileFileIntegrity
  x x x          
CVE-2025-43383: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Affects Model I/O
x x     x   x    
CVE-2025-43384: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Affects Model I/O
    x            
CVE-2025-43387: A malicious app may be able to gain root privileges.
Affects DiskArbitration
  x x            
CVE-2025-43389: An app may be able to access sensitive user data.
Affects Notes
x x x x     x    
CVE-2025-43390: An app may be able to access user-sensitive data.
Affects AppleMobileFileIntegrity
  x x            
CVE-2025-43391: An app may be able to access sensitive user data.
Affects Photos
x x x x          
CVE-2025-43392: A website may exfiltrate image data cross-origin.
Affects WebKit Canvas
x x     x x x x  
CVE-2025-43393: An app may be able to break out of its sandbox.
Affects quarantine
  x              
CVE-2025-43394: An app may be able to access protected user data.
Affects bootp
  x x x          
CVE-2025-43395: An app may be able to access protected user data.
Affects configd
  x x x          
CVE-2025-43396: A sandboxed app may be able to access sensitive user data.
Affects Installer
  x x x          
CVE-2025-43397: An app may be able to cause a denial-of-service.
Affects SoftwareUpdate
  x x x          
CVE-2025-43398: An app may be able to cause unexpected system termination.
Affects Kernel
x x x x x x x    
CVE-2025-43399: An app may be able to access protected user data.
Affects Siri
  x x            
CVE-2025-43400: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
Affects FontParser
        x x      
CVE-2025-43401: A remote attacker may be able to cause a denial-of-service.
Affects CoreAnimation
  x x x          
CVE-2025-43402: An app may be able to cause unexpected system termination or corrupt process memory.
Affects WindowServer
  x              
CVE-2025-43404: An app may be able to access sensitive user data.
Affects Sandbox
  x              
CVE-2025-43405: An app may be able to access user-sensitive data.
Affects Photos
  x x x          
CVE-2025-43406: An app may be able to access sensitive user data.
Affects Sandbox
  x              
CVE-2025-43407: An app may be able to break out of its sandbox.
Affects Assets
x x x x x   x    
CVE-2025-43408: An attacker with physical access may be able to access contacts from the lock screen.
Affects Share Sheet
  x x x          
CVE-2025-43409: An app may be able to access sensitive user data.
Affects Spotlight
  x x            
CVE-2025-43411: An app may be able to access user-sensitive data.
Affects PackageKit
  x x x          
CVE-2025-43412: An app may be able to break out of its sandbox.
Affects TCC
  x x x          
CVE-2025-43413: A sandboxed app may be able to observe system-wide network connections.
Affects libxpc
x x x x x x x    
CVE-2025-43414: A shortcut may be able to access files that are normally inaccessible to the Shortcuts app.
Affects Shortcuts
  x x x          
CVE-2025-43420: An app may be able to access sensitive user data.
Affects Dock
  x x x          
CVE-2025-43421: Processing maliciously crafted web content may lead to an unexpected process crash.
Affects WebKit
x x         x x  
CVE-2025-43422: An attacker with physical access to a device may be able to disable Stolen Device Protection.
Affects Stolen Device Protection
x                
CVE-2025-43423: An attacker with physical access to an unlocked device paired with a Mac may be able to view sensitive user information in system logging.
Affects Audio
x x x       x    
CVE-2025-43424: A malicious HID device may cause an unexpected process crash.
Affects Multi-Touch
x x              
CVE-2025-43425: Processing maliciously crafted web content may lead to an unexpected process crash.
Affects WebKit
x x     x x x x  
CVE-2025-43426: An app may be able to access sensitive user data.
Affects Contacts
x x              
CVE-2025-43427: Processing maliciously crafted web content may lead to an unexpected process crash.
Affects WebKit
x x     x   x x  
CVE-2025-43429: Processing maliciously crafted web content may lead to an unexpected process crash.
Affects WebKit
x x     x x x x  
CVE-2025-43430: Processing maliciously crafted web content may lead to an unexpected process crash.
Affects WebKit
          x      
CVE-2025-43431: Processing maliciously crafted web content may lead to memory corruption.
Affects WebKit
x x     x x x x  
CVE-2025-43432: Processing maliciously crafted web content may lead to an unexpected process crash.
Affects WebKit
x x     x x x x  
CVE-2025-43434: Processing maliciously crafted web content may lead to an unexpected Safari crash.
Affects WebKit
x x       x x x  
CVE-2025-43436: An app may be able to enumerate a user's installed apps.
Affects CoreServices
x x     x x x    
CVE-2025-43439: An app may be able to fingerprint the user.
Affects On-device Intelligence
x           x    
CVE-2025-43440: Processing maliciously crafted web content may lead to an unexpected process crash.
Affects WebKit
x x     x x x x  
CVE-2025-43442: An app may be able to identify what other apps a user has installed.
Affects Accessibility
x                
CVE-2025-43443: Processing maliciously crafted web content may lead to an unexpected process crash.
Affects WebKit
x x     x x x x  
CVE-2025-43444: An app may be able to fingerprint the user.
Affects Installer
x x     x x x    
CVE-2025-43445: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Affects CoreText
x x x x x x x    
CVE-2025-43446: An app may be able to modify protected parts of the file system.
Affects Assets
  x x x          
CVE-2025-43448: An app may be able to break out of its sandbox.
Affects CloudKit
x x x x x x x    
CVE-2025-43449: A malicious app may be able to track users between installs.
Affects Apple TV Remote
x                
CVE-2025-43450: An app may be able to learn information about the current camera view before being granted camera access.
Affects Camera
x                
CVE-2025-43452: Keyboard suggestions may display sensitive information on the lock screen.
Affects Text Input
x                
CVE-2025-43454: A device may persistently fail to lock.
Affects Siri
x                
CVE-2025-43455: A malicious app may be able to take a screenshot of sensitive information in embedded views.
Affects Apple Account
x x       x x    
CVE-2025-43459: An attacker with physical access to a locked Apple Watch may be able to view Live Voicemail.
Affects Phone
          x      
CVE-2025-43460: An attacker with physical access to a locked device may be able to view sensitive user information.
Affects Status Bar
x                
CVE-2025-43461: An app may be able to access protected user data.
Affects configd
  x              
CVE-2025-43462: An app may be able to cause unexpected system termination or corrupt kernel memory.
Affects Apple Neural Engine
x x     x x x    
CVE-2025-43463: An app may be able to access sensitive user data.
Affects StorageKit
  x              
CVE-2025-43464: Visiting a website may lead to an app denial-of-service.
Affects dyld
  x              
CVE-2025-43465: An app may be able to access sensitive user data.
Affects ATS
  x              
CVE-2025-43466: An app may be able to access sensitive user data.
Affects AppleMobileFileIntegrity
  x              
CVE-2025-43467: An app may be able to gain root privileges.
Affects Installer
  x              
CVE-2025-43468: An app may be able to access sensitive user data.
Affects AppleMobileFileIntegrity
  x x x          
CVE-2025-43469: An app may be able to access sensitive user data.
Affects NSSpellChecker
  x x x          
CVE-2025-43471: An app may be able to access sensitive user data.
Affects Admin Framework
  x              
CVE-2025-43472: An app may be able to gain root privileges.
Affects zsh
  x x x          
CVE-2025-43473: An app may be able to access sensitive user data.
Affects Shortcuts
  x              
CVE-2025-43474: An app may be able to cause unexpected system termination or read kernel memory.
Affects GPU Drivers
  x x x          
CVE-2025-43476: An app may be able to break out of its sandbox.
Affects SharedFileList
  x x x          
CVE-2025-43477: An app may be able to access sensitive user data.
Affects Siri
  x x x          
CVE-2025-43478: An app may be able to cause unexpected system termination.
Affects ASP TCP
  x x x          
CVE-2025-43479: An app may be able to access sensitive user data.
Affects CoreServices
  x x x          
CVE-2025-43480: A malicious website may exfiltrate data cross-origin.
Affects WebKit
x x     x x x x  
CVE-2025-43481: An app may be able to break out of its sandbox.
Affects Disk Images
  x x            
CVE-2025-43493: Visiting a malicious website may lead to address bar spoofing.
Affects Safari
x x         x x  
CVE-2025-43495: An app may be able to monitor keystrokes without user permission.
Affects WebKit
x                
CVE-2025-43496: Remote content may be loaded even when the 'Load Remote Images' setting is turned off.
Affects Mail Drafts
x x x     x x    
CVE-2025-43497: An app may be able to break out of its sandbox.
Affects BackBoardServices
  x              
CVE-2025-43498: An app may be able to access sensitive user data.
Affects FileProvider
x x x x     x    
CVE-2025-43499: An app may be able to access sensitive user data.
Affects Shortcuts
  x x x          
CVE-2025-43500: An app may be able to access sensitive user data.
Affects Sandbox Profiles
x x       x x    
CVE-2025-43502: An app may be able to bypass certain Privacy preferences.
Affects Safari
x x         x x  
CVE-2025-43503: Visiting a malicious website may lead to user interface spoofing.
Affects Safari
x x       x x x  
CVE-2025-43504: A user in a privileged network position may be able to cause a denial-of-service.
Affects lldb
                x
CVE-2025-43505: Processing a maliciously crafted file may lead to heap corruption.
Affects GNU
                x
CVE-2025-43506: iCloud Private Relay may not activate when more than one user is logged in at the same time.
Affects Networking
  x              
CVE-2025-43507: An app may be able to fingerprint the user.
Affects Find My
x x       x x    


Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

AWS Weekly Roundup: Project Rainier online, Amazon Nova, Amazon Bedrock, and more (November 3, 2025)

This post was originally published on this site

Last week I met Jeff Barr at the AWS Shenzhen Community Day. Jeff shared stories about how builders around the world are experimenting with generative AI and encouraged local developers to keep pushing ideas into real prototypes. Many attendees stayed after the sessions to discuss model grounding, evaluation, and how to bring generative AI into real applications.

Community builders showcased creative Kiro-themed demos, AI-powered IoT projects, and student-led experiments. It was inspiring to see new developers, students, and long-time Amazon Web Services (AWS) community leaders connecting over shared curiosity and excitement for generative AI innovation.

Project Rainier, one of the world’s most powerful operational AI supercomputers is now online. Built by AWS in close collaboration with Anthropic, Project Rainier brings nearly 500,000 AWS custom-designed Trainium2 chips into service using a new Amazon Elastic Compute (Amazon EC2) UltraServer and EC2 UltraCluster architecture designed for high-bandwidth, low-latency model training at hyperscale.

Anthropic is already training and running inference for Claude on Project Rainier, and is expected to scale to more than one million Trainium2 chips across direct usage and Amazon Bedrock by the end of 2025. For architecture details, deployment insights, and behind-the-scenes video of an UltraServer coming online, refer to AWS activates Project Rainier for the full announcement.

Last week’s launches
Here are the launches that got my attention this week:

Additional updates
Here are some additional projects, blog posts, and news items that I found interesting:

  • Building production-ready 3D pipelines with AWS VAMS and 4D Pipeline – A reference architecture for creating scalable, cloud-based 3D asset pipelines using AWS Visual Asset Management System (VAMS) and 4D Pipeline, supporting ingest, validation, collaborative review, and distribution across games, visual effects (VFX), and digital twins.
  • Amazon Location Service introduces new API key restrictions – You can now create granular security policies with bundle IDs to restrict API access to specific mobile applications, improving access control and strengthening application-level security across location-based workloads.
  • AWS Clean Rooms launches advanced SQL configurations – A performance enhancement for Spark SQL workloads that supports runtime customization of Spark properties and compute sizes, plus table caching for faster and more cost-efficient processing of large analytical queries.
  • AWS Serverless MCP Server adds event source mappings (ESM) tools – A capability for event-driven serverless applications that supports configuration, performance tuning, and troubleshooting of AWS Lambda event source mappings, including AWS Serverless Application Model (AWS SAM) template generation and diagnostic insights.
  • AWS IoT Greengrass releases an AI agent context pack – A development accelerator for cloud-connected edge applications that provides ready-to-use instructions, examples, and templates, helping teams integrate generative AI tools such as Amazon Q for faster software creation, testing, and fleet-wide deployment. It’s available as open source on the GitHub repository.
  • AWS Step Functions introduces a new metrics dashboard – You can now view usage, billing, and performance metrics at the state-machine level for standard and express workflows in a single console view, improving visibility and troubleshooting for distributed applications.

Upcoming AWS events
Check your calendars so that you can sign up for these upcoming events:

  • AWS Builder Loft – A community tech space in San Francisco where you can learn from expert sessions, join hands-on workshops, explore AI and emerging technologies, and collaborate with other builders to accelerate their ideas. Browse the upcoming sessions and join the events that interest you.
  • AWS Community Days – Join community-led conferences that feature technical discussions, workshops, and hands-on labs led by experienced AWS users and industry leaders from around the world: Hong Kong (November 2), Abuja (November 8), Cameroon (November 8), and Spain (November 15).
  • AWS Skills Center Seattle 4th Anniversary Celebration – A free, public event on November 20 with a keynote, learned panels, recruiter insights, raffles, and virtual participation options.

Join the AWS Builder Center to learn, build, and connect with builders in the AWS community. Browse here for upcoming in-person events, developer-focused events, and events for startups.

That’s all for this week. Check back next Monday for another Weekly Roundup!

Betty

XWiki SolrSearch Exploit Attempts (CVE-2025-24893) with link to Chicago Gangs/Rappers, (Mon, Nov 3rd)

This post was originally published on this site

XWiki describes itself as "The Advanced Open-Source Enterprise Wiki" and considers itself an alternative to Confluence and MediaWiki. In February, XWiki released an advisory (and patch) for an arbitrary remote code execution vulnerability. Affected was the SolrSearch component, which any user, even with minimal "Guest" privileges, can use. The advisory included PoC code, so it is a bit odd that it took so long for the vulnerability to be widely exploited.

Scans for Port 8530/8531 (TCP). Likely related to WSUS Vulnerability CVE-2025-59287, (Sun, Nov 2nd)

This post was originally published on this site

Sensors reporting firewall logs detected a significant increase in scans for port 8530/TCP and 8531/TCP over the course of last week. Some of these reports originate from Shadowserver, and likely other researchers, but there are also some that do not correspond to known research-related IP addresses.