Here’s what the Apple Watch can tell us about a titanium iPhone 15 Pro
Among other changes, this year’s iPhone 15 Pro models are rumored to feature a new chassis made out of titanium for the first time. This could make for a lighter design, additional durability, and more. In fact, it could be one of the biggest design changes to the iPhone in years, marking an end to the stainless steel era that started with the iPhone X in 2017. more… The post appeared first on 9to5Mac.

Read more »

9to5Mac Daily: January 31, 2023 – Apple Music Replay, foldable iPad next year
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Enjoy the podcast? Shop to support 9to5Mac Daily! more… The post appeared first on 9to5Mac.

Read more »

Pump up Mac audio quality with new Sound Blaster X5
Creative's new audiophile device is a USB sound card, dual DAC and headphone amp combo sporting a $280 price tag. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Plugable’s new aluminum 8-in-1 USB-C dock doubles as an adjustable iPad stand [Deal]
Plugable today is launching its latest USB-C docking station, this time designing it around Apple’s latest iPads, as well as other tablets for that matter. Sporting a build-in adjustable stand, the new hybrid accessory helps turn your iPadOS machine into a more desktop-caliber computer with 8-in-1 USB-C hub and more ergonomic screen position. Best of all, to celebrate the new release, we detail a down below. more… The post appeared first on 9to5Mac.

Read more »

‘Periscope’ camera might be iPhone 16 Pro Max exclusive
iPhone 16 Pro buyers reportedly won't get the "periscope" camera previous rumors suggested. It will be restricted to only the iPhone 16 Pro Max. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Paramount+ and Showtime streaming services are merging
Paramount Media Networks has announced a plan to merge its Paramount+ and Showtime streaming businesses, and executives warned of layoffs and other changes.Paramount+Streaming channels Paramount+ and Showtime are already combined into one app, and that will now be extended to the businesses. Paramount CEO Bob Bakish announced the move in a memo to staff on Monday afternoon, according to a report from The Hollywood Reporter. Read more...

Read more »

EU mulls charging Apple, Netlfix, other data-heavy streamers for telecom upgrades
The European Union is weighing a proposal to make technology companies that use the most bandwidth, such as Apple, Netflix, and Alphabet… The post appeared first on MacDailyNews.

Read more »

20.5-inch MacBook Pro with foldable display rumored for 2025, no folding iPad in 2024
Rumors continue to collide over how Apple will roll out a foldable product, with the latest from Ross Young suggesting a folding-display 20.5-inch MacBook Pro is in the works for 2025.A folding-display notebook may release before a folding iPhoneThe supply chain seems to be in flux as multiple conflicting reports have come in from reliable leakers. Initial rumors suggested a foldable iPad was coming in 2024, but that has since been challenged. Read more...

Read more »

Why should every small business be using Apple devices?
After a lot of planning, pitching, long nights, working weekends, and all the grinding required to get a business idea off the ground, you’ve finally gotten to the point where now you’re thinking more about hiring new employees, growth opportunities, and expansion strategies, rather than surviving month-to-month.   Congratulations! You’ve already accomplished far more than the great majority of those who try to start a new business. Now, the question is: what’s next? more… The post appeared first on 9to5Mac.

Read more »

Rumors: Foldable iPad in 2024 dismissed, Apple developing 21-inch ‘foldable notebook’
While Ming-Chi Kuo reported on Monday that a foldable iPad with a built-in kickstand could launch in 2024, that may have been a bit optimistic. Since Kuo made this claim, Bloomberg‘s Mark Gurman and analyst Ross Young have both said they’ve heard nothing about such a device being in the pipeline for next year… more… The post appeared first on 9to5Mac.

Read more »

Valentine's Day gift ideas for the tech lover in your life
Valentine's Day is upon us, and instead of busting out the usual roses and chocolates sort of thing, consider spoiling your tech lover with gifts that won't see the bottom of the wastebasket in two days' time.Valentine's Day gift ideas for your sweetie.We've curated a list of the best Valentine's Day gifts for all sorts of budgets, personalities, and needs, whether that special person in your life is next to you, or you're doing the long-distance game. Read more...

Read more »

How many times do we have to tell you not to put HomePod on wooden surfaces?
When the original HomePod launched in 2018, owners quickly found that the smart speaker can leave white rings on some wooden surfaces. You… The post appeared first on MacDailyNews.

Read more »

Kuo: Upgraded optical zoom to be exclusive to iPhone ‘Pro Max’ cameras until at least 2025
Apple is expected to release its first iPhone with a periscope lens with this year’s iPhone 15 lineup, but rumors say it’ll be limited to only the highest-end iPhone 15 Pro Max. According to a new report from Apple analyst Ming-Chi Kuo, the current expectation is that this exclusivity won’t change for the foreseeable future… more… The post appeared first on 9to5Mac.

Read more »

Today in Apple history: Mac clone-maker closes shop
On January 31, 1998, Power Computing shut down for good, bringing an ignominious end to the formerly high-flying maker of Mac clones. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple’s super-expensive Pro Display XDR gets a $300 discount
Looking to buy Apple's 32-inch Pro Display XDR? Amazon is offering a whopping $300 off the stunning display. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Periscope camera exclusive to Ultra iPhone models through 2024
A new note from Ming-Chi Kuo states that Apple will include a periscope camera in only one model through 2025 — the iPhone 15 Ultra and iPhone 16 Ultra.iPhone 15 Ultra to gain periscope lensApple has been rumored to include a super zoom, or periscope camera in its premium iPhones for years. It seems the iPhone 15 Ultra will finally get the feature, and it will remain exclusive to Apple's largest and most premium model through the iPhone 16 cycle. Read more...

Read more »

New HomePod still leaves rings on finished wood surfaces
HomePod has a silicone base for vibration dampening, but this material can react with some wood finishes that will leave a white ring behind.HomePod's silicone base will leave rings on finished woodUsers were quick to discover damaged surfaces under the original HomePod in 2018, and the problem that caused it hasn't changed. The speaker uses a silicone base to absorb vibrations from its large 4-inch woofer, which can chemically interact with some surfaces. Read more...

Read more »

Jason Segel and Harrison Ford are brilliant in Apple TV+ dramedy ‘Shrinking’ – Collider
“Shrinking,” starring Harrison Ford and Jason Segel, follows a grieving therapist (Segel) who starts to break the rules and tell his clients… The post appeared first on MacDailyNews.

Read more »

The 2022 iPad Air is $99 Off
The 2022 iPad Air can be considered a laptop replacement, with enough power and features to run any app or program. Today, the iPad ... Read more The post appeared first on iLounge.

Read more »

Apple Music launches ‘Replay 2023’ playlist
Apple Music has released a new playlist, called ‘Replay 2023’ for subscribers. Users can access ‘Replay 2023’ by opening the Apple Music app or ... Read more The post appeared first on iLounge.

Read more »

Magic Keyboard for 11-inch iPad Pro now $49 off in Tuesday’s best deals, Apple Watch Series 8, more
All of Tuesday’s best deals are now headlined by $49 price cuts on Apple’s 11-inch Magic Keyboard for iPad Pro and iPad Air 5. If you’re looking for a fitness companion instead of a must-have iPad accessory, we’re also tracking all-time lows on Apple Watch Series 8 styles from $349, not to mention Apple’s OG leather MagSafe Wallet at just $25. Hit the jump for all of the best deals and more in the latest 9to5Toys Lunch Break. more… The post appeared first on 9to5Mac.

Read more »

Evolving eSIM technology is a huge boon to iPhone users
It's no exaggeration to say eSIM is the future of cellular. With iPhone 14, Apple went "all in" on eSIM, and you should, too. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

WSJ report says AirTags are not recommended for dogs
A recently published report by the Wall Street Journal details the risks that could happen if AirTags were fitted on dogs. AirTags are only ... Read more The post appeared first on iLounge.

Read more »

Tasmania car accident discovered sooner with Car Crash Detection
ABC News in Australia recently reported how Car Crash Detection allowed responders to get to a Tasmania car accident sooner. On Monday, a truck ... Read more The post appeared first on iLounge.

Read more »

HomePod 2 review roundup: Great sound but no great leap forward
Reviews of the updated HomePod (2nd generation) are sounding off Tuesday. They tend to agree that the new smart speaker sounds excellent but doesn’t break much new ground compared to the original. HomePod 2 is more of an asset in a smart home than before, but its limitation to Siri and AirPlay 2 for music […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple & Google will have to tighten health app requirements, say researchers
New laws mean any App Stores that include health or medical apps must be more rigorous gatekeepers — and perhaps should not distribute its own apps.Apple has already rejected health apps, at times facing lawsuits because of it, but researchers published in "Nature" magazine journal say it — and Google — ought to be doing much more."As a result of changes to EU law which came into effect in May 2021," write the researchers in their paper, "they must now ensure that apps are compliant with medical devices regulation and to inform authorities of serious incidents arising from their use." Read more...

Read more »

Apple’s new HomePod sounds better than the original, offers ‘stunning sound’ in stereo pairs – Forbes
Apple in mid-January announced HomePod (2nd generation), a powerful smart speaker that delivers next-level acoustics in a gorgeous; The post appeared first on MacDailyNews.

Read more »

EU wants to hammer big tech & streamers with 5G build bill
Europe is considering whether companies like Netflix and Apple that use lots of bandwidth should be forced to pay for upgrades to the infrastructure of the internet.With the rise of video streaming services like Netflix and YouTube, the amount of bandwidth required for typical internet tasks has ballooned, forcing infrastructure providers to increase what they offer to internet service providers and other entities. However, the cost of the upgrades could be paid for by major companies like Apple in the future.The European Union is pondering a proposal to coax companies that consume the most bandwidth into paying for the next generation of Internet infrastructure, a document seen by Bloomberg reads. Read more...

Read more »

Vulnerability Summary for the Week of January 23, 2023
Original release date: January 30, 2023 | Last revised: January 31, 2023  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- acrobat_reader Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-01-27 7.8 CVE-2023-22240 MISC adobe -- acrobat_reader Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-01-27 7.8 CVE-2023-22241 MISC adobe -- acrobat_reader Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-01-27 7.8 CVE-2023-22242 MISC assimp -- assimp An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp. 2023-01-20 8.8 CVE-2022-45748 MISC ays-pro -- survey_maker The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action. 2023-01-20 8.8 CVE-2023-23490 MISC cisco -- cx_cloud_agent A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An attacker could exploit this vulnerability by persuading support to update settings which call the insecure script. A successful exploit could allow the attacker to take complete control of the affected device. 2023-01-20 7.3 CVE-2023-20044 MISC cisco -- identity_services_engine A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user input within requests as part of the web-based management interface. An attacker could exploit this vulnerability by manipulating requests to the web-based management interface to contain operating system commands. A successful exploit could allow the attacker to execute arbitrary operating system commands on the underlying operating system with the privileges of the web services user. Cisco has not yet released software updates that address this vulnerability. 2023-01-20 8.8 CVE-2022-20964 MISC cisco -- roomos A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary files on the local system of an affected device. This vulnerability is due to improper access controls on files that are in the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. 2023-01-20 7.1 CVE-2023-20008 MISC contec -- conprosys_hmi_system Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to alter user credentials information. 2023-01-20 7.5 CVE-2023-22331 MISC MISC MISC MISC contec -- conprosys_hmi_system Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction and obtain the server certificate including the private key of the product. 2023-01-20 7.5 CVE-2023-22339 MISC MISC MISC MISC electerm_project -- electerm An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service. 2023-01-20 9.8 CVE-2020-23256 MISC hcltech -- bigfix_mobile HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts. 2023-01-20 7.5 CVE-2021-27782 MISC hospital_management_system_project -- hospital_management_system SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php. 2023-01-20 9.8 CVE-2022-48120 MISC inxedu -- inxedu SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction. 2023-01-20 9.8 CVE-2020-21152 MISC MISC login_with_phone_number_project -- login_with_phone_number The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action. 2023-01-20 8.8 CVE-2023-23492 MISC mangboard -- mangboard_wp SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running. 2023-01-20 9.8 CVE-2021-26644 MISC mariadb -- mariadb MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. 2023-01-20 7.5 CVE-2022-47015 MISC microsoft -- edge Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. 2023-01-24 8.3 CVE-2023-21775 MISC microsoft -- edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2023-21796. 2023-01-24 8.3 CVE-2023-21795 MISC microsoft -- edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2023-21795. 2023-01-24 8.3 CVE-2023-21796 MISC misp-project -- misp In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. 2023-01-20 9.8 CVE-2023-24028 MISC online_food_ordering_system_project -- online_food_ordering_system Multiple SQL Injection vulnerabilies in tourist5 Online-food-ordering-system 1.0. 2023-01-20 9.8 CVE-2020-29297 MISC MISC MISC remoteclinic -- remote_clinic SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php. 2023-01-20 9.8 CVE-2022-48152 MISC reprisesoftware -- reprise_license_manager Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server. 2023-01-20 8.1 CVE-2021-37500 MISC MISC MISC sandhillsdev -- easy_digital_downloads The Easy Digital Downloads WordPress Plugin, version < 3.1.0.4, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action. 2023-01-20 9.8 CVE-2023-23489 MISC solarwinds -- database_performance_analyzer In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext. 2023-01-20 7.5 CVE-2022-38112 MISC MISC solarwinds -- dynamips Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21. 2023-01-20 7.5 CVE-2022-47012 MISC strangerstudios -- paid_memberships_pro The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route. 2023-01-20 9.8 CVE-2023-23488 MISC tenable -- nessus A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host. 2023-01-20 8.8 CVE-2023-0101 MISC MISC tmux_project -- tmux A null pointer dereference issue was discovered in function window_pane_set_event in window.c in tmux 3.0 thru 3.3 and later, allows attackers to cause denial of service or other unspecified impacts. 2023-01-20 7.8 CVE-2022-47016 MISC MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function. 2023-01-20 9.8 CVE-2022-48121 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function. 2023-01-20 9.8 CVE-2022-48122 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function. 2023-01-20 9.8 CVE-2022-48123 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function. 2023-01-20 9.8 CVE-2022-48124 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function. 2023-01-20 9.8 CVE-2022-48125 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function. 2023-01-20 9.8 CVE-2022-48126 MISC tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18893. 2023-01-26 7.8 CVE-2022-42394 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18274. 2023-01-26 7.8 CVE-2022-42395 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18278. 2023-01-26 7.8 CVE-2022-42396 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18327. 2023-01-26 7.8 CVE-2022-42399 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18328. 2023-01-26 7.8 CVE-2022-42400 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in an embedded U3D object can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18632. 2023-01-26 7.8 CVE-2022-42402 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18892. 2023-01-26 7.8 CVE-2022-42403 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18367. 2023-01-26 7.8 CVE-2022-42405 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PGM files. Crafted data in a PGM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18365. 2023-01-26 7.8 CVE-2022-42410 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18366. 2023-01-26 7.8 CVE-2022-42415 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18673. 2023-01-26 7.8 CVE-2022-42416 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18676. 2023-01-26 7.8 CVE-2022-42417 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18677. 2023-01-26 7.8 CVE-2022-42418 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18700. 2023-01-26 7.8 CVE-2022-42419 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18686. 2023-01-26 7.8 CVE-2022-42420 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18703. 2023-01-26 7.8 CVE-2022-42421 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18716. 2023-01-26 7.8 CVE-2022-42423 N/A N/A trendmicro -- maximum_security_2022 A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a specific location and in the process of removal and restoral an attacker could replace an original folder with a mount point to an arbitrary location, allowing a escalation of privileges on an affected system. 2023-01-20 7 CVE-2022-48191 MISC MISC uber -- kraken kraken

Read more »

Apple’s 2023 Mac mini is a Mini Mac Studio
Apple's new M2 Mac mini offers a wide range of configuration options. The post appeared first on The Mac Security Blog.

Read more »

How to protect your Apple ID account with Security Keys on iPhone, iPad, or Mac
You can now protect your Apple ID account with a security key, a hardware device that acts as a second factor for two-factor authentication. But should you? The post appeared first on The Mac Security Blog.

Read more »

The Year in Mac Malware 2022 – Intego Mac Podcast Episode 276
Apple has updated all its operating systems again, and even issued a security update for iOS 12. We discuss new features in the HomePod software, and we look back at the notable Mac malware of 2022. The post appeared first on The Mac Security Blog.

Read more »

Experian Glitch Exposing Credit Files Lasted 47 Days
On Dec. 23, 2022, KrebsOnSecurity alerted big-three consumer credit reporting bureau Experian that identity thieves had worked out how to bypass its security and access any consumer's full credit report -- armed with nothing more than a person's name, address, date of birth, and Social Security number. Experian fixed the glitch, but remained silent about the incident for a month. This week, however, Experian acknowledged that the security failure persisted for nearly seven weeks, between Nov. 9, 2022 and Dec. 26, 2022.

Read more »

The top 20 most notable Mac malware threats of 2022
We recently compiled our list of the top Apple security and privacy stories of 2022. Now we turn our focus specifically to the Mac malware threats of the past year. Here are all of the top malware threats that made headlines each month throughout 2022. Note that most of the dates below relate to when […] The post appeared first on The Mac Security Blog.

Read more »

Apple releases macOS Ventura 13.2, iOS 16.3, and more
Apple released OS updates this week, fixing vulnerabilities and adding features in macOS Ventura 13.2, iOS and iPadOS 16.3, and more. The post appeared first on The Mac Security Blog.

Read more »

Administrator of RSOCKS Proxy Botnet Pleads Guilty
Denis Emelyantsev, a 36-year-old Russian man accused of running a massive botnet called RSOCKS that stitched malware into millions of devices worldwide, pleaded guilty to two counts of computer crime violations in a California courtroom this week. The plea comes just months after Emelyantsev was extradited from Bulgaria, where he told investigators, “America is looking for me because I have enormous information and they need it.”

Read more »

New T-Mobile Breach Affects 37 Million Accounts
T-Mobile today disclosed a data breach affecting tens of millions of customer accounts, its second major data exposure in as many years. In a filing with federal regulators, T-Mobile said an investigation determined that someone abused its systems to harvest subscriber data tied to approximately 37 million current customer accounts.

Read more »

M2 Chip Boost, New Macs, and the Return of the HomePod – Intego Mac Podcast Episode 275
Apple has introduced the latest versions of its M2 chips, and updated three Mac models. They also surprised everyone with a new, full-sized HomePod. We also look at brand-based phishing, Google's AirTag clones, and a trifecta of stories about instant messaging apps. The post appeared first on The Mac Security Blog.

Read more »

Apple Announces M2 Pro & M2 Max Chips, New MacBook Pros, New Mac mini, and New HomePod
Apple's new M2 Pro and M2 Max chips power new Mac mini and MacBook Pro models. The post Apple Announces M2 Pro & M2 Max Chips, New MacBook Pros, New Mac mini, and New HomePod appeared first on The Mac Security Blog.

Read more »

Future Apple iPhone may feature new ‘Periscope’ lens
The Largan and Genius Periscope camera is a new type of camera lens that has been designed specifically for an upcoming Apple iPhone model. It is expected to provide high-quality images and videos with extreme details and clarity, and it will offer superior optical zoom and allow users to capture photos and videos with greater depth. This lens is expected to be exclusive to the […] The post first appeared on MacPrices.net.

Read more »

First significant sale prices on Apple’s new 16″ M2 Pro MacBook Pros appear, save up to $135
Apple retailer Expercom has 16″ M2 Pro MacBook Pros in stock today and on sale for up to $135 off MSRP. In addition to their MacBook Pro sale prices, take $50 off AppleCare+ when purchased along with the MacBook Pro ($349, regularly $399): – 16″ MacBook Pro (12-Core M2 Pro/16GB RAM/512GB SSD/Space Gray): $2374.05 $125 off MSRP – 16″ MacBook Pro (12-Core M2 Pro/16GB RAM/1TB […] The post first appeared on MacPrices.net.

Read more »

Shop Apple iPads using our award-winning iPad Price Trackers
Our Apple award-winning iPad Price Trackers are the best place to find the latest information on iPad sales and deals. We track prices from 20+ Apple retailers, including Apple, Amazon, Best Buy, Walmart, B&H, and many more: – iPads – iPad minis – iPad Airs – 11″ iPad Pros – 12″ iPad Pros You can also find the best price on an iPad accessory: – […] The post first appeared on MacPrices.net.

Read more »

Apple has 13-inch M2 MacBook Pros with 16GB of RAM available today for up to $190 off MSRP
Apple has standard-configuration 13″ MacBook Pros with M2 CPUs and 8GB of memory in stock and available today starting at $1169, Certified Refurbished, and ranging up to $150 off original MSRP. Upgrade to 16GB of RAM, and save up to $190 off MSRP with your choice of 256GB, 512GB, or 1TB of storage. These are the cheapest 13″ M2 MacBook Pros with 16GB of memory […] The post first appeared on MacPrices.net.

Read more »

Apple Magic Keyboard for 11″ iPad Pro/10.9″ iPad Air on sale again for $249, save $50
Amazon has the Black or White Apple Magic Keyboard for the 11″ iPad Pro/10.9″ iPad Air on sale for $249 shipped. Their price is $50 off MSRP, and it’s the lowest price for a new 11″ Magic Keyboard available today. For the latest sales and prices, see our iPad Keyboards Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Take $50 off any Apple Watch Series 8 GPS + Cellular
Amazon has Apple Watch Series 8 GPS + Cellular models on sale for $50 off MSRP, each including free shipping. Their prices are the lowest currently available for cellular-capable Series 8 Watches: – 41mm Apple Watch Series 8 GPS + Cellular (Midnight, Starlight, Silver, Red): $449, save $50 – 45mm Apple Watch Series 8 GPS + Cellular (Midnight, Starlight, Silver, Red): $479, save $50 Note […] The post first appeared on MacPrices.net.

Read more »

Apple to release new iPad with carbon fiber kickstand and folding display — Kuo
According to analyst Ming-Chi Kuo, a new Apple iPad will be the beneficiary of all-new technology featuring a kickstand and folding OLED screen. There will be no new iPads released in the next nine to twelve months as an iPad mini refresh is more likely to begin mass production in early 2024. Kuo’s prediction for 2023 is a year over year sales decline of 10-15%. […] The post first appeared on MacPrices.net.

Read more »

New sale: Apple 10.9″ iPad Airs for $100 off MSRP
Amazon has 10.9″ M1 WiFi iPad Airs on sale for $100 off Apple’s MSRP, with prices starting at $499, for a limited time. Their prices are the lowest available among the Apple retailers we track: – 10.9″ M1 Airs 64GB/WiFi: $499.99 $100 off MSRP – 10.9″ M1 Airs 256GB/WiFi: $649.99 $100 off MSRP – 10.9″ M1 Airs 64GB/WiFi: $649.99 $100 off MSRP – 10.9″ M1 […] The post first appeared on MacPrices.net.

Read more »

Apple may release high-end Reality Pro device in an attempt to move the VR market forward
Mark Gurman, in this weeks’s Power On newsletter, states that Apple may attempt to release a high-end, nearly $3000, Reality Pro device in an attempt to move the VR market forward. With potential sales to be only a fraction of what Apple sold after the introduction of the iPhone and Apple Watch, the Reality Pro device may be more of a proof of concept design […] The post first appeared on MacPrices.net.

Read more »

13″ M2 MacBook Pros available today at Apple for as low as $1169
Apple standard-configuration 13″ MacBook Pros with M2 CPUs in stock and available today starting at $1169, Certified Refurbished, and ranging up to $150 off original MSRP. These are the cheapest 13″ M2 MacBook Pros for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M2 MacBook Pro/8GB/256GB SSD/Space Gray: $1169, $130 off […] The post first appeared on MacPrices.net.

Read more »

Get a 13″ M2 MacBook Air at Apple today for as low as $1079
Apple has standard-configuration 13″ M2 MacBook Airs in stock and on sale starting at only $1079, Certified Refurbished, and ranging up to $150 off MSRP. These are the cheapest M2-powered MacBooks for sale at Apple and also the best deal on MacBooks available anywhere. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M2 MacBook Air/8-Core […] The post first appeared on MacPrices.net.

Read more »

Apple Card special offers for January and February 2023
Apple Card is offering special offers for January & February, 2023 which include a $75 Daily Cash offer for customers who open a new Apple Card through February and a $55 Daily Cash offer for new Apple Card holders who subscribe to a year of Wall Street Journal (WSJ) All Access Digital. Apple also offers 3% unlimited Daily Cash back on all purchases with the […] The post first appeared on MacPrices.net.

Read more »