Apple Releases iOS 14.6 for iPhone, Introduces Voice Unlock After Restart, Apple Card Family, Podcast Subs & More

Apple released the latest version of its iPhone OS, iOS 14.6, today, Monday, May 24. This latest update (build number 18F72) introduces new features like unlocking your iPhone with Voice Control after a restart, Apple Card Family support for up to five people, and subscription support for shows in Podcasts.

While iOS 14.6 does introduce a number of new features and changes, it's not nearly as major an update as iOS 14.5. That update brought over 60 fun features to iPhone, including more than 200 new emoji, support for PS5 and Xbox Series X controllers, and AirTag support, just to name a few.

• More Info: All the Cool iOS 14.5 Features for iPhone You Need to Check Out Right Now

Still, 14.6 is a notable update, and you should download it as soon as possible. Take a look at Apple's features list below to know what to expect when your update is finished:

Apple Card Family

• Apple Card can be shared with up to five people, including anyone 13 years or older in your Family Sharing group
• Apple Card Family adds support for families to track expenses, manage spending with optional limits and controls, and build credit together

Podcasts

• Subscription support for channels and individual shows

AirTag and Find My

• Lost mode option to add an email address instead of a phone number for AirTag and Find My network accessories
• AirTag will show the partially masked phone number of the owner when tapped with an NFC-capable device

Accessibility

• Voice Control users can unlock their iPhone for the first time after a restart using only their voice

This release also fixes the following issues:

• Unlock with Apple Watch may not work after using Lock iPhone on Apple Watch
• Reminders may appear as blank lines
• Call blocking extensions may not appear in Settings
• Bluetooth devices could sometimes disconnect or send audio to a different device during an active call
• iPhone may experience reduced performance during startup

For information on the security content of Apple software updates, please visit this website: support.apple.com/kb/HT201222

Security Notes

iOS 14.6 and iPadOS 14.6

Released May 24, 2021

Audio

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution
• Description: This issue was addressed with improved checks.
• CVE-2021-30707: hjy79425575 working with Trend Micro Zero Day Initiative

Audio

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Parsing a maliciously crafted audio file may lead to disclosure of user information
• Description: This issue was addressed with improved checks.
• CVE-2021-30685: Mickey Jin (@patch1t) of Trend Micro

AVEVideoEncoder

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: An application may be able to cause unexpected system termination or write kernel memory
• Description: A race condition was addressed with improved state handling.
• CVE-2021-30714: @08Tc3wBB of ZecOps, and George Nosenko

CommCenter

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A device may accept invalid activation results
• Description: A logic issue was addressed with improved restrictions.
• CVE-2021-30729: CHRISTIAN MINA

Core Services

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to gain root privileges
• Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.
• CVE-2021-30681: Zhongcheng Li (CK01)

CoreAudio

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted audio file may disclose restricted memory
• Description: An out-of-bounds read was addressed with improved bounds checking.
• CVE-2021-30686: Mickey Jin of Trend Micro

Crash Reporter

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to modify protected parts of the file system
• Description: A logic issue was addressed with improved state management.
• CVE-2021-30727: Cees Elzinga

CVMS

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A local attacker may be able to elevate their privileges
• Description: This issue was addressed with improved checks.
• CVE-2021-30724: Mickey Jin (@patch1t) of Trend Micro

Heimdal

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A local user may be able to leak sensitive user information
• Description: A logic issue was addressed with improved state management.
• CVE-2021-30697: Gabe Kirkpatrick (@gabe_k)

Heimdal

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may cause a denial of service or potentially disclose memory contents
• Description: A memory corruption issue was addressed with improved state management.
• CVE-2021-30710: Gabe Kirkpatrick (@gabe_k)

ImageIO

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted image may lead to disclosure of user information
• Description: An out-of-bounds read was addressed with improved bounds checking.
• CVE-2021-30687: Hou JingYi (@hjy79425575) of Qihoo 360

ImageIO

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted image may lead to disclosure of user information
• Description: This issue was addressed with improved checks.
• CVE-2021-30700: Ye Zhang(@co0py_Cat) of Baidu Security

ImageIO

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted image may lead to arbitrary code execution
• Description: This issue was addressed with improved checks.
• CVE-2021-30701: Mickey Jin (@patch1t) of Trend Micro and Ye Zhang of Baidu Security

ImageIO

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted ASTC file may disclose memory contents
• Description: This issue was addressed with improved checks.
• CVE-2021-30705: Ye Zhang of Baidu Security

Kernel

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to execute arbitrary code with kernel privileges
• Description: A logic issue was addressed with improved validation.
• CVE-2021-30740: Linus Henze (pinauten.de)

Kernel

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may disclose restricted memory
• Description: This issue was addressed with improved checks.
• CVE-2021-30674: Siddharth Aeri (@b1n4r1b01)

Kernel

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: An application may be able to execute arbitrary code with kernel privileges
• Description: A logic issue was addressed with improved state management.
• CVE-2021-30704: an anonymous researcher

Kernel

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted message may lead to a denial of service
• Description: A logic issue was addressed with improved state management.
• CVE-2021-30715: The UK's National Cyber Security Centre (NCSC)

Kernel

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: An application may be able to execute arbitrary code with kernel privileges
• Description: A buffer overflow was addressed with improved size validation.
• CVE-2021-30736: Ian Beer of Google Project Zero

LaunchServices

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to break out of its sandbox
• Description: This issue was addressed with improved environment sanitization.
• CVE-2021-30677: Ron Waisberg (@epsilan)

Mail

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination
• Description: A use after free issue was addressed with improved memory management.
• CVE-2021-30741: SYMaster of ZecOps Mobile EDR Team

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted USD file may disclose memory contents
• Description: An information disclosure issue was addressed with improved state management.
• CVE-2021-30723: Mickey Jin (@patch1t) of Trend Micro
• CVE-2021-30691: Mickey Jin (@patch1t) of Trend Micro
• CVE-2021-30692: Mickey Jin (@patch1t) of Trend Micro
• CVE-2021-30694: Mickey Jin (@patch1t) of Trend Micro

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution
• Description: A memory corruption issue was addressed with improved state management.
• CVE-2021-30725: Mickey Jin (@patch1t) of Trend Micro

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted USD file may disclose memory contents
• Description: An out-of-bounds read was addressed with improved input validation.
• CVE-2021-30746: Mickey Jin (@patch1t) of Trend Micro

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted image may lead to arbitrary code execution
• Description: A validation issue was addressed with improved logic.
• CVE-2021-30693: Mickey Jin (@patch1t) & Junzhi Lu (@pwn0rz) of Trend Micro

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted USD file may disclose memory contents
• Description: An out-of-bounds read was addressed with improved bounds checking.
• CVE-2021-30695: Mickey Jin (@patch1t) & Junzhi Lu (@pwn0rz) of Trend Micro

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution
• Description: An out-of-bounds read was addressed with improved input validation.
• CVE-2021-30708: Mickey Jin (@patch1t) & Junzhi Lu (@pwn0rz) of Trend Micro

Model I/O

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted USD file may disclose memory contents
• Description: This issue was addressed with improved checks.
• Trend Micro

Notes

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A user may be able to view restricted content from the lockscreen
• Description: A window management issue was addressed with improved state management.
• CVE-2021-30699: videosdebarraquito

Security

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing a maliciously crafted certificate may lead to arbitrary code execution
• Description: A memory corruption issue in the ASN.1 decoder was addressed by removing the vulnerable code.
• CVE-2021-30737: xerub

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to universal cross site scripting
• Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins.
• CVE-2021-30744: Dan Hite of jsontop

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to arbitrary code execution
• Description: A use after free issue was addressed with improved memory management.
• CVE-2021-21779: Marcin Towalski of Cisco Talos

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious application may be able to leak sensitive user information
• Description: A logic issue was addressed with improved restrictions.
• CVE-2021-30682: an anonymous researcher and 1lastBr3ath

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to universal cross site scripting
• Description: A logic issue was addressed with improved state management.
• CVE-2021-30689: an anonymous researcher

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: Processing maliciously crafted web content may lead to arbitrary code execution
• Description: Multiple memory corruption issues were addressed with improved memory handling.
• CVE-2021-30749: an anonymous researcher and mipu94 of SEFCOM lab, ASU. working with Trend
• Micro Zero Day Initiative
• CVE-2021-30734: Jack Dates of RET2 Systems, Inc. (@ret2systems) working with Trend Micro Zero Day Initiative

WebKit

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A malicious website may be able to access restricted ports on arbitrary servers
• Description: A logic issue was addressed with improved restrictions.
• CVE-2021-30720: David Schütz (@xdavidhu)

WebRTC

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: A remote attacker may be able to cause a denial of service
• Description: A null pointer dereference was addressed with improved input validation.
• CVE-2021-23841: Tavis Ormandy of Google
• CVE-2021-30698: Tavis Ormandy of Google

Wi-Fi

• Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• Impact: An attacker in WiFi range may be able to force a client to use a less secure authentication mechanism
• Description: A logic issue was addressed with improved validation.
• CVE-2021-30667: Raul Siles of DinoSec (@dinosec)

This update comes just three days after Apple released the second RC for iOS 14.6.

How to Download & Install iOS 14.6 on Your iPhone

To download iOS 14.6 on your iPhone, open Settings -> General -> Software Update. Wait for this page to load, then follow the on-screen instructions to download and install iOS 14.6. If you have "Automatic Updates" enabled, you can simply allow your iPhone to update overnight.

Previous SlideNext Slide

Cover image by Jake Peterson/Gadget Hacks