Manfred Paul exploited Firefox with a two-stage bug that earned him $100,000 ($50,000 for each part), and got into Safari as well, for a further $50,000 bounty. Latest podcast 🎧 Listen now! Firefox & Pwn2Own, Apple and an 0-day… and the mathematics that defeated Pythagoras. Pwn2Own hole closedĪpple has also apparently fixed the bug found by German cybersecurity researcher Manfred Paul at the recent Pwn2Own competition in Canada, back in May 2022. Whether that’s because the bug isn’t as easy to exploit in Safari, or simply because no one has traced back any Safari-specific misbehaviour to this particular flaw, we can’t tell you, but we’re treating it as an “honorary zero-day” vulnerability, and patching zealously as a result. Intriguingly, Apple hasn’t declared any of this month’s vulnerabilities as “reported to be in the wild”, or as “zero-day bugs”, despite the abovementioned patch that was dubbed a zero-day hole by Google. Google patches “in-the-wild” Chrome zero-day – update now! …and if that number sounds familiar, it should, because it’s the same bug that was fixed as a zero-day by Google in Chrome (and by Microsoft in Edge) about two weeks ago: That’s because one of the browser-related patches in this round of updates deals with a vulnerability in WebRTC ( web real-time communications) known as CVE-2022-2294… An honorary zero-dayīy the way, if you’ve got a Mac with an earlier version of macOS, don’t forget about that second download for Safari, because it’s vitally important, at least as far as we can see. APPLE-SA-7: Safari 15.6, details at HT213341Īs usual with Apple, the Safari browser patches are bundled into the updates for the latest macOS (Monterey), as well as into the updates for iOS and iPad OS.īut the updates for the older versions of macOS don’t include Safari, so the standalone Safari update (see HT213341 above) therefore applies to users of previous macOS versions (both Big Sur and Catalina are still officially supported), who will need to download and install two updates, not just one.

APPLE-SA-4: Security Update 2022-005 Catalina, details at HT213343.

APPLE-SA-2: macOS Monterey 12.5, details at HT213345.

The relevant security bulletins, update numbers, and where to find them online are as follows:

Apple has disgorged its latest patches, fixing more than 50 CVE-numbered security vulnerabilities in its range of supported products.

Google chrome download for mac big sur