Apple rolled out the iOS 18.0.1 and iPadOS 18.0.1 updates for iPhones and iPads on Thursday to patch two critical security vulnerabilities related to the new Passwords app and the microphone.
The first vulnerability, CVE-2024-44204, is related to Apple’s first native password manager, the Passwords app, which affected several iPhones and iPads.
According to the official changelog of the iOS 18.0.1 update, the problem is described as a logic issue that could potentially enable the VoiceOver feature to read aloud a user’s saved passwords.
“A user’s saved passwords may be read aloud by VoiceOver,” Apple said in an update to the Support page, adding that the issue has been resolved with improved validation. The tech giant credited Bistrit Dahal for reporting the flaw.
The vulnerability affected the iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later.
The second vulnerability, CVE-2024-44207, mainly impacted the newly launched iPhone 16 series, including the iPhone 16, iPhone 16 Plus, iPhone 16 Pro, and iPhone 16 Pro Max.
This issue allowed the device to capture audio messages in the iMessage app for a few seconds before the microphone indicator (green indicator) was turned on.
“Audio messages in Messages may be able to capture a few seconds of audio before the microphone indicator is activated,” Apple said, adding that the issue has been addressed with improved checks. The Cupertino giant credited Michael Jimenez and an anonymous researcher for reporting the vulnerability.
To safeguard against potential risks, users are recommended to immediately install the iOS 18.0.1 and iPadOS 18.0.1 updates on their devices.
To download the update, you need to go to Settings > General >Software Update > Check for the update and install.
