Re: iOS 16.1.1 Why/how does Android fix apply to iOS on Apple devices?

Y’all seem somewhat unfamiliar with the details of these particular vulnerabilities, and also seemingly unfamiliar with one of the major teams that works on improving security.

Hopefully, the following can help y’all better understand some of this.

Maddy Stone, Ned Williamson and Nathan Wachholz all of Google Project Zero have identified two flaws in a common open source XML processing library libxml2, flaws which have been labeled CVE-2022-40303 and CVE-2022-40304, and Apple and many other vendors using that libxml2 library have then shipped updates.

Apple has not indicated whether these were reportedly being actively exploited (as they sometimes do), and has not detailed the particular risks. Given XML is used all over the place in many platforms including within security-critical code, exploitable flaws here would be bad.

More generally, Project Zero has identified a number of flaws in a number of packages and platforms.

If you’d like to read more about some of the previous work of Project Zero and particularly with Apple product security, here is a fascinating writeup on the JBIG2 vulnerability and a weird machine:

… https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html

For assistance with Android and any use of libxml2 on that platform, and whether any patches might be necessary, best check directly with Google.

What does Android have to do with this?