full-disclosure - [FD] APPLE-SA-04-16-2025-1 iOS 18.4.1 and iPadOS 18.4.1

Open Source and information security mailing list archives

Message-id: <868BD210-48BA-4E6D-A1E2-D7CDB3925598@lists.apple.com>
Date: Wed, 16 Apr 2025 13:52:47 -0700
From: Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-04-16-2025-1 iOS 18.4.1 and iPadOS 18.4.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-04-16-2025-1 iOS 18.4.1 and iPadOS 18.4.1

iOS 18.4.1 and iPadOS 18.4.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/122282.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

CoreAudio
Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 13.9-inch
3rd generation and later, iPad Pro 11-inch 1st generation and later,
iPad Air 3rd generation and later, iPad 7th generation and later, and
iPad mini 5th generation and later
Impact: Processing an audio stream in a maliciously crafted media file
may result in code execution. Apple is aware of a report that this issue
may have been exploited in an extremely sophisticated attack against
specific targeted individuals on iOS.
Description: A memory corruption issue was addressed with improved
bounds checking.
CVE-2025-31200: Apple and Google Threat Analysis Group

RPAC
Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 13.9-inch
3rd generation and later, iPad Pro 11-inch 1st generation and later,
iPad Air 3rd generation and later, iPad 7th generation and later, and
iPad mini 5th generation and later
Impact: An attacker with arbitrary read and write capability may be able
to bypass Pointer Authentication. Apple is aware of a report that this
issue may have been exploited in an extremely sophisticated attack
against specific targeted individuals on iOS.
Description: This issue was addressed by removing the vulnerable code.
CVE-2025-31201: Apple

This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/

iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting
Don't Install will present the option the next time you connect
your iOS device.

The automatic update process may take up to a week depending on
the day that iTunes or the device checks for updates. You may
manually obtain the update via the Check for Updates button
within iTunes, or the Software Update on your device.

To check that the iPhone, iPod touch, or iPad has been updated:

* Navigate to Settings
* Select General
* Select About. The version after applying this update will be
"iOS 18.4.1 and iPadOS 18.4.1".

All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmgABJUACgkQX+5d1TXa
IvpmrBAAvPKa5est/R0ZnkwiAbKUnEXebC6C2L071LnPaO2oeSpVZLj8bXRo5Fq3
XB4N0Z5viDB9yNadV0bSmpOnNZP1drq5TAg04SbX4D94ltCPViWCUCfBLhIPafNM
Oh/f5jE15My4DDegAJEcljoNmLhrwM3UClIUYjgdmI4v9bVV4FbYWGvzvKhgzB1H
+HoD2HMxx7XYf5cRE1SeAXF779Jno8kuG/an+K5luIIIrO2a1QIJ4Kfe5HXBrnXF
sPgb2jZhPWhvjeD6EdEycb0ZIYBvBbytTHEfIQG8NadgOoj7kWEmE3QITbShRltT
aCUTNqKIFj+vXQxz+QT26rjK7bRje2ThqgCAx/KUOPwL+X4cB1KlGtiUXON7gdT0
W00YKjkIyD79SH5dOpsZjpTJxawenSGDCoKAbTa/haiIgW2+zRqKn6fdYXd0XHSV
s01BRFcK3Ho616AT8VBUfByWt0FFn8cmibmcbAWKH0rvidU+ryWTdoEcdpmTS5DN
hyeKgoFY6he3h4ltg/F1tDcc+h12SCGdvRqxLrVlWyG+kRAwqVa82/M4qj/Y/7rA
C7sOD5lCzkktBr7VEzpdp/FiBWn7H3xECJ1hWVBGQvAn3agILIRIjYh7AtY1kKb4
L/TgKjdqIj0llLvGiEApDs4mNKAc8A/BCdplUWOP2zNERrXDaGU=
=qBMo
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives