Final Patch Tuesday of 2023 goes out with a bang

It's the last Patch Tuesday of 2023, which calls for celebration – just as soon as you update Windows, Adobe, Google, Cisco, FortiGuard, SAP, VMware, Atlassian and Apple products, of course. Let's start with Apple, since two of the bugs Cupertino disclosed yesterday may have already been used for evil purposes. While the fruit cart's December release fixes all the iThings, there's two especially concerning vulnerabilities in the WebKit (again) web browser engine that affect AppleTVs and Apple Watches, plus some older iPhones and iPads. Both bugs have already been fixed in a ton of other Apple products. CVE-2023-42916 is an out-of-bounds read flaw that could allow miscreants to access sensitive information, and CVE-2023-42917 is a memory corruption vulnerability that can lead to arbitrary code execution. Both were spotted by Clément Lecigne of Google's Threat Analysis Group – which indicates spyware may be involved, given TAG's proclivities. "Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1," the vendor commented about both bugs. And while Cupertino issued emergency fixes at the end of November to fix these security problems in some iPhones, iPads, and Macs, the patches issued address the same CVEs in older iPhones and iPads, as well as AppleTV HD and AppleTV 4K (all models) and Apple Watch Series 4 and later. Microsoft, meanwhile, closed out a very buggy year with just over 30 Windows patches – none of which are list...