Posted in Uncategorized

iOS 10.3.2 is Out


Apple has just released iOS 10.3.2. To update your compatible iOS device, tap Settings > General > Software Update. Make sure you make a back up first.

The only information currently available is that the update improves the security of your iOS device and includes bug fixes.

According to Apple, the security updates includes:

Released May 15, 2017

AVEVideoEncoder

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: An application may be able to gain kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-6989: Adam Donenfeld (@doadam) of the Zimperium zLabs Team

CoreAudio

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2017-2502: Yangkang (@dnpushme) of Qihoo360 Qex Team

iBooks

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: A maliciously crafted book may open arbitrary websites without user permission

Description: A URL handling issue was addressed through improved state management.

CVE-2017-2497: Jun Kokatsu (@shhnjk)

iBooks

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: An application may be able to execute arbitrary code with root privileges

Description: An issue existed within the path validation logic for symlinks. This issue was addressed through improved path sanitization.

CVE-2017-6981: evi1m0 of YSRC (sec.ly.com)

IOSurface

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: An application may be able to gain kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-6979: Adam Donenfeld of Zimperium zLabs

Kernel

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A race condition was addressed through improved locking.

CVE-2017-2501: Ian Beer of Google Project Zero

Kernel

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2017-2507: Ian Beer of Google Project Zero

CVE-2017-6987: Patrick Wardle of Synack

Notifications

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: An application may be able to cause a denial of service

Description: A denial of service issue was addressed through improved memory handling.

CVE-2017-6982: Vincent Desmurs (vincedes3), Sem Voigtlander (OxFEEDFACE), and Joseph Shenton of CoffeeBreakers

Safari

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Visiting a maliciously crafted webpage may lead to an application denial of service

Description: An issue in Safari’s history menu was addressed through improved memory handling.

CVE-2017-2495: Tubasa Iinuma (@llamakko_cafe) of Gehirn Inc.

Security

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Update to the certificate trust policy

Description: A certificate validation issue existed in the handling of untrusted certificates. This issue was addressed through improved user handling of trust acceptance.

CVE-2017-2498: Andrew Jerman

SQLite

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: A maliciously crafted SQL query may lead to arbitrary code execution

Description: A use after free issue was addressed through improved memory management.

CVE-2017-2513: found by OSS-Fuzz

SQLite

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: A maliciously crafted SQL query may lead to arbitrary code execution

Description: A buffer overflow issue was addressed through improved memory handling.

CVE-2017-2518: found by OSS-Fuzz

CVE-2017-2520: found by OSS-Fuzz

SQLite

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: A maliciously crafted SQL query may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-2519: found by OSS-Fuzz

SQLite

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved input validation.

CVE-2017-6983: Chaitin Security Research Lab (@ChaitinTech) working with Trend Micro’s Zero Day Initiative

CVE-2017-6991: Chaitin Security Research Lab (@ChaitinTech) working with Trend Micro’s Zero Day Initiative

TextInput

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Parsing maliciously crafted data may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-2524: Ian Beer of Google Project Zero

WebKit

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-2496: Apple

CVE-2017-2505: lokihardt of Google Project Zero

CVE-2017-2506: Zheng Huang of the Baidu Security Lab working with Trend Micro’s Zero Day Initiative

CVE-2017-2514: lokihardt of Google Project Zero

CVE-2017-2515: lokihardt of Google Project Zero

CVE-2017-2521: lokihardt of Google Project Zero

CVE-2017-2525: Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative

CVE-2017-2526: Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative

CVE-2017-2530: an anonymous researcher

CVE-2017-2531: lokihardt of Google Project Zero

CVE-2017-2538: Richard Zhu (fluorescence) working with Trend Micro’s Zero Day Initiative

CVE-2017-2539: Richard Zhu (fluorescence) working with Trend Micro’s Zero Day Initiative

CVE-2017-2544: 360 Security (@mj0011sec) working with Trend Micro’s Zero Day Initiative

CVE-2017-2547: lokihardt of Google Project Zero, Team Sniper (Keen Lab and PC Mgr) working with Trend Micro’s Zero Day Initiative

CVE-2017-6980: lokihardt of Google Project Zero

CVE-2017-6984: lokihardt of Google Project Zero

WebKit

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue existed in the handling of WebKit Editor commands. This issue was addressed with improved state management.

CVE-2017-2504: lokihardt of Google Project Zero

WebKit

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue existed in the handling of WebKit container nodes. This issue was addressed with improved state management.

CVE-2017-2508: lokihardt of Google Project Zero

WebKit

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue existed in the handling of pageshow events. This issue was addressed with improved state management.

CVE-2017-2510: lokihardt of Google Project Zero

WebKit

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue existed in the handling of WebKit cached frames. This issue was addressed with improved state management.

CVE-2017-2528: lokihardt of Google Project Zero

WebKit

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues with addressed through improved memory handling.

CVE-2017-2536: Samuel Groß and Niklas Baumstark working with Trend Micro’s Zero Day Initiative

WebKit

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue existed in frame loading. This issue was addressed with improved state management.

CVE-2017-2549: lokihardt of Google Project Zero

WebKit Web Inspector

Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation

Impact: An application may be able to execute unsigned code

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-2499: George Dan (@theninjaprawn)

Posted in Tips

iWork Collaboration


With the release of iOS 10.3, MacOS 10.12.4, and updated iWork apps, collaboration is now even better. It is now possible to collaborate – work with others – on various iWork documents.

Apple Inc.

From your iOS device, you can “share” or collaborate with others using iCloud and the iWork apps in real time.

In the iOS iWork document, tap on the 3 dots and select “Collaborate With Others” and choose the way you want to share document. You can “Add People” to collaborate and choose a way to send the invitation to collaborate. You can invite people via Messages, Mail, and other methods.

Make sure you choose “Share Options”  which allows you to set the permissions of who can access and what they can do with the document – edit v. read. The options you select determine who can read the shared document as well as who can edit it. Choose the parameters you want.

While working, you can see who you are working with and view changes in real time. PC users can access the documents via a PC web browser.

To read more about collaboration with iWork documents, click here.

Posted in Commentary

iOS 10.3 Update


iOS 10.3 has just been released. It is a big deal. To download, tap on Settings > Software Update and then download and install. Don’t forget to backup first.

The list of features and abilities as set forth by Apple include:

iOS 10.3 introduces new features including the ability to locate AirPods using Find my iPhone and more ways to use Siri with payment, ride booking and automaker apps.

Find My iPhone
View the current or last known location of your AirPods
Play a sound on one or both AirPods to help you find them

Siri
Support for paying and checking status of bills with payment apps
Support for scheduling with ride booking apps
Support for checking car fuel level, lock status, turning on lights and activating horn with automaker apps
Cricket sports scores and statistics for Indian Premier League and International Cricket Council

CarPlay
Shortcuts in the status bar for easy access to last used apps
Apple Music Now Playing screen gives access to Up Next and the currently playing song’s album
Daily curated playlists and new music categories in Apple Music

Other improvements and fixes
Rent once and watch your iTunes movies across your devices
New Settings unified view for your Apple ID account information, settings and devices
Hourly weather in Maps using 3D Touch on the displayed current temperature
Support for searching “parked car” in Maps
Calendar adds the ability to delete an unwanted invite and report it as junk
Home app support to trigger scenes using accessories with switches and buttons
Home app support for accessory battery level status
Podcasts support for 3D Touch and Today widget to access recently updated shows
Podcast shows or episodes are shareable to Messages with full playback support
Fixes an issue that could prevent Maps from displaying your current location after resetting Location & Privacy
VoiceOver stability improvements for Phone, Safari and Mail.

More discussion on individual features to follow.

Posted in App

Apple Store App


The Apple Store app keeps getting better. Whether you want to order a new device, check on the status of an order, book a genius appointment or get reviews of products, Apple has made this app simple and efficient. It works with your iOS devices and Apple Watch to help you with a personal shopping experience.

If you are in an Apple Store you can scan an item to check the price or purchase it. If you need to look back on orders, you can pull up your history of purchases as well. If you search for upcoming workshops to learn skills with various Apple apps too.

Download the Apple Store app to order, review and keep up with your Apple purchases.

Posted in App

Notes Plus Updated


Notes Plus continues to be the go to app for handwriting notes or jotting drawings to get my ideas down quickly. The app was recently updated to improve or fix the following:

User experience improvements and bug fixes:
– Better handle Apple Pencil with small strokes when palm is conflicting with multi-tasking and control center
– Add notebook covers for 2017
– Fix overflowing text bugs in text mode
– Fix crashes with unknown VGA output devices
Update to latest Wacom SDK, now support Wacom’s Bamboo Fineline 3 stylus

If you are looking for a digital app to replicate the hand writing experience with the bonus of searching, text conversion, shape conversion and more, check out Notes Plus.

Posted in App

LiquidText PDF Reader Improvements


LiquidText PDF Document Reader: Annotate & Excerpt app is a fun and cool way to markup and gather together annotations from one or more PDFs. The most recent improvements include:

• Improved Highlight Rendering: highlights better maintain text contrast to improve readability.

BUG FIXES

• Fixed bug that could cause a crash when scrolling with scrollbar while holding document in place with other finger.

• Fixed bug that could cause a crash when tapping a link button on an excerpt or comment while in portrait mode.

• Fixed bug that could prevent the table of Contents from displaying correctly in some circumstances.

LiquidText GIF

This productivity app is free. However, you can purchase additional functionality via an in app purchase.

LIQUIDTEXT’S COMPLETE FEATURE SET INCLUDES:

► MULTIDOCUMENT USERS RECEIVE (requires one-time in-app purchase):

Work with multiple documents and webpages in a single workspace
• Pull together excerpts from different documents.
• Search across all the documents in a LiquidText workspace.
• Compare documents in parallel.
• Make comments that refer to multiple documents.

Global Keyword Search (Requires iOS 10)
• Search for keywords across all your LiquidText files.
• Search from LiquidText home screen, or from Spotlight.
• Find keywords in title or text of your documents.

► ALL USERS RECEIVE:

View
• Read and interact with text in a flexible environment
• Compatible with PDF, Word, and PowerPoint documents and web pages
• Import from Dropbox, iCloud Drive, Box, email, and more
• Import content from webpage or send to LiquidText directly from Safari

Interact
• Workspace area for writing notes and pulling out excerpts
• Organize and group excerpts and notes
• Tap comments and excerpts to find original source
• Pinch document to compare different sections
• Collapse text to see annotated parts side-by-side
• Collapse text to view search term(s) side-by-side
• Scroll to navigate through pages
• Scrollbar shows where highlights, comments, excerpts, and search results are located

Annotate
• Highlight text, images, comments, excerpts, and notes
• Add margin notes/comments to text, images, notes, and excerpts
• Comment on two or more selections simultaneously

Share
• Export file as notes only, highlights only, notes and highlights, or entire document with annotations
• Export as LiquidText file, PDF, or DOCX (supported by most word processors)
• Send files by email or to Dropbox, iCloud, Box, and more

LiquidText allows for active highlighting of PDFs and organizing ideas from them.