Path: ...!weretis.net!feeder8.news.weretis.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Jolly Roger Newsgroups: misc.phone.mobile.iphone,comp.sys.mac.system,comp.mobile.ipad Subject: Re: Yet again, Apple forgot to sufficiently test desktop & iOS versions Date: 15 May 2024 03:01:31 GMT Organization: People for the Ethical Treatment of Pirates Lines: 41 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Trace: individual.net A7ga/QoXFIh/DmadlqZNqQtuuBFqH7C+qNsipgGMLELYfbSzzP Cancel-Lock: sha1:ATOuyQ/UQbS8yRFlBU/GJm3clgg= sha256:UuASVtcAP9kCGlpqqGfHs/tveXT3OOgusruipzSnO2Y= Mail-Copies-To: nobody X-Face: _.g>n!a$f3/H3jA]>9pN55*5<`}Tud57>1Y%b|b-Y~()~\t,LZ3e up1/bO{=-) User-Agent: slrn/1.0.3 (Darwin) Bytes: 3089 On 2024-05-15, Andrew wrote: > Yet again, Apple forgot to sufficiently test desktop & iOS versions. Samsung has just released an update for its flagship devices—this includes two ‘critical’ security fixes, one of which is late and should be installed urgently.... Samsung is on a roll, and its flagship Galaxy users are again being given an early look at the new Android monthly security update almost as soon as Google reveals details of the urgent fixes being released this time around. That said, it’s not all smooth running. One critical fix that Google included in its April security release is only just being made available by Samsung now—this Qualcomm modem issue could potentially lead to a memory corruption issue during a secure comms “handshake,” and such memory vulnerabilities open doors to exploitation. The other critical fix for May impacts the phone’s change log process, which could lead to “local escalation of privilege with no additional execution privileges needed.” Details—as ever—remain scarce for now, but Google says the critical tag “is based on the effect that exploiting the vulnerability would possibly have on an affected device.” Such an attack in isolation would require “platform and service mitigations” to be off, but vulnerabilities can be exploited as part of a more sophisticated chain attack. Over the coming days, Galaxy users will see the updates made available as per usual—dependent upon region and carrier. Samsung will focus on its newest, priciest devices first, and then work down the list. Owners of older, cheaper devices may already be on a quarterly schedule—or worse. You can find details here: -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR