Apple Inc. has released security updates for all its products, including iOS, macOS, Safari, Apple Watch and AppleTV to patch a range of vulnerabilities, including a number that allow for remote code execution attacks.

The main vulnerability targeted by the release, known as the CoreGraphic bug (CVE-2016-4673) allows an attacker to take over an Apple device simply by having a victim display a JPEG or PDF file that includes malicious code.

For those who own an Apple computer, macOS Sierra (10.2.1) delivers patches for 16 Common Vulnerabilities and Exposures (CVE) listed vulnerabilities including the aforementioned CVE-2016-4673, along with a bug that could allow remote execution through font files (CVE-2016-4667).

iPhone and iPad users receive iOS 10.1 with 12 patches including one for the CoreGraphic bug along with a patch for a vulnerability in WebKit that could allow remote code execution (CVE-2016-4677) and a fix for a issue in contacts that would allow another application to gather data from it even if a user had revoked access to that app (CVE-2016-4686).

Both iOS and macOS received a patch for CVE-2016-4635, which is described as a vulnerability that would allow hackers to gain audio access in Apple’s Facetime messaging software.

The firmware update for the Apple Watch, watchOS 3.1, included patches for eight CVE-listed flaws, including two that are said to allow third-party applications to view image libraries and sound files without permission (CVE-2016-4664, CVE-2016-4665).

AppleTV users received tvOS 10.0.1 with patches for 10 CVE-listed vulnerabilities, including the previously mentioned CoreGraphic bug, along with CVE-2016-4664 that allowed applications installed on an Apple TV to obtain information from a tethered phone without permission.

Safari obtains its own specific security update with Apple addressing WebKit flaws that would allow a third party to deliver malicious code from a website then take control of the device Safari was installed on.

Install now

If you own an Apple device, it’s highly recommended that you install the updates available as soon as possible given the risks many of the vulnerabilities patched present to users. Security engineer Micha Lee makes the case as simple as possible, tweeting “Upgrade to iOS 10.1 right now. It fixes a remote code execution vulnerability that’s exploited by getting you to open a malicious JPEG.” Upgrades are available via individual devices.

Image credit: Tree Frog/Wikimedia Commons/CC by SA 4.0