The flaw was patched in October, but older versions of macOS could still be vulnerable.
Here at Macworld, we advise users to update their operating systems as soon as possible after Apple drops one. A recent report from Thijs Alkemade, a security researcher at cybersecurity firm Computestreminds, reminds us of the number one reason why: They often contain critical security patches.
As reported by Wired, the macOS vulnerability was discovered in macOS’s saved state feature, which automatically reopens the apps and files you had open when you restart a Mac. Alkemade, who discovered the hole in December 2020, was able to successfully launch a process injection attack against the Mac’s saved state. He was then able to bypass several other Mac security features and then access the user files, change system settings, and use the webcam. Wired said that there is no evidence that this bug has been used in the real world.
The bug, which is filed as CVE-2021-30873 in the National Vulnerability Database, was fixed with the macOS Monterey 12.0.1 update that was released on October 25, 2021. For macOS Catalina, a support document states that the Security Update 2021-007 released on October 24, 2021 includes a patch for the same vulnerability. There doesn’t appear to be a patch available for Big Sur. Versions of macOS older than Catalina (version 10.14.6 Mojave and older) are considered unsupported or obsolete by Apple. A similar flaw was also patched in iOS 14.5 and iPadOS 14.5.
Read more at MacWorld.com