IOS update: Apple fixes security flaws impacting iMessage and Bluetooth

The first flaw could have allowed a remote attacker to insert themselves into a group discussion and access exchanged messages. The second flaw allowed a participant joining a group later to view messages sent before their integration. Apple specifies that it has corrected an authorization issue in the first case and eliminated the vulnerable code in the second.

Corrections are not limited to iMessage. Several flaws also concerned wireless functionality. In some cases, a malicious Bluetooth device could have paired without user intervention. Other anomalies allowed bypassing Bluetooth or AirPlay pairing code attempt limits, particularly in the presence of an attacker nearby or on the same network.

The company also noted a defect susceptible to corrupting the memory of a Bluetooth process, an anomaly related to the processing of compressed data by the “brotli” component, and an authorization issue allowing an application to access sensitive information. The technical details and identifiers of these flaws are available in the security bulletin published on November 9.

It is important to note that Apple has not reported any known active exploitation of these vulnerabilities. The update is therefore a proactive measure, and not a response to an attack already in progress.

The fixes concern iPhone 11 and later models, as well as a variety of iPad Pro, iPad Air, iPad, and iPad mini models. To check the availability of the update, users can consult the settings of their device, then the General and Software Update section.

Companies managing phone fleets should also note that the publication of a new version does not guarantee that all professional devices have been updated.