Apple patches pairing flaws, but Brotli remains elsewhere
Apple has now published security updates for 10 vulnerabilities across iOS, iPadOS, macOS, watchOS and visionOS, including fixes for older supported releases.
Several Bluetooth and AirPlay flaws affect pairing protections. Some let a nearby device bypass limits on pairing-code guesses; others can establish a pairing without user interaction. That can make proximity enough to defeat safeguards that would ordinarily require a code. SecurityWeek reports that attackers have targeted the Brotli flaw in the wild, though there is no indication Apple devices were attacked.
Apple’s updates close the flaws in its own software. If an organization also runs non-Apple products that bundle Google Brotli, those copies remain a separate exposure; the reporting does not establish whether their vendors have fixed them.
2 sources · Nov 11
CVEs in this update
10 CVEs
Across Brotli, node.js, brotlicffi, and related packages.