ESB-2018.1988 - [tvOS] Apple tvOS: Multiple vulnerabilities 2018-07-10
Printable versionPGP/GPG verifiable version
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.1988 tvOS 11.4.1 released 10 July 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Apple tvOS Publisher: Apple Operating System: Apple iOS Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Increased Privileges -- Existing Account Access Privileged Data -- Existing Account Denial of Service -- Remote with User Interaction Provide Misleading Information -- Remote with User Interaction Reduced Security -- Unknown/Unspecified Resolution: Patch/Upgrade CVE Names: CVE-2018-4293 CVE-2018-4284 CVE-2018-4282 CVE-2018-4280 CVE-2018-4278 CVE-2018-4277 CVE-2018-4273 CVE-2018-4272 CVE-2018-4271 CVE-2018-4270 CVE-2018-4267 CVE-2018-4266 CVE-2018-4265 CVE-2018-4264 CVE-2018-4263 CVE-2018-4262 CVE-2018-4261 CVE-2018-4248 Reference: ESB-2018.1985 Original Bulletin: https://support.apple.com/en-au/HT208936 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-7-9-3 tvOS 11.4.1 tvOS 11.4.1 is now available and addresses the following: CFNetwork Available for: Apple TV 4K and Apple TV (4th generation) Impact: Cookies may unexpectedly persist in Safari Description: A cookie management issue was addressed with improved checks. CVE-2018-4293: an anonymous researcher Kernel Available for: Apple TV 4K and Apple TV (4th generation) Impact: A local user may be able to read kernel memory Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. CVE-2018-4282: Proteas of Qihoo 360 Nirvan Team libxpc Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4280: Brandon Azad libxpc Available for: Apple TV 4K and Apple TV (4th generation) Impact: A malicious application may be able to read restricted memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2018-4248: Brandon Azad LinkPresentation Available for: Apple TV 4K and Apple TV (4th generation) Impact: Visiting a malicious website may lead to address bar spoofing Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. CVE-2018-4277: xisigr of Tencent's Xuanwu Lab (tencent.com) WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4270: found by OSS-Fuzz WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: A malicious website may exfiltrate audio data cross-origin Description: Sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking. CVE-2018-4278: Jun Kokatsu (@shhnjk) WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4284: Found by OSS-Fuzz WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: A malicious website may be able to cause a denial of service Description: A race condition was addressed with additional validation. CVE-2018-4266: found by OSS-Fuzz WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4261: Omair working with Trend Micro's Zero Day Initiative CVE-2018-4262: Mateusz Krzywicki working with Trend Micro's Zero Day Initiative CVE-2018-4263: Arayz working with Trend Micro's Zero Day Initiative CVE-2018-4264: found by OSS-Fuzz, Yu Zhou and Jundong Xie of Ant-financial Light-Year Security Lab CVE-2018-4265: cc working with Trend Micro's Zero Day Initiative CVE-2018-4267: Arayz of Pangu team working with Trend Micro's Zero Day Initiative CVE-2018-4272: found by OSS-Fuzz WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2018-4271: found by OSS-Fuzz CVE-2018-4273: found by OSS-Fuzz Additional recognition Kernel We would like to acknowledge juwei lin (@panicaII) of Trend Micro working with Trend Micro's Zero Day Initiative for their assistance. Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ - -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEfcwwPWJ3e0Ig26mf8ecVjteJiCYFAltDyFIpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQ8ecVjteJiCbGSQ/9 EB9rnBmzuhPOQBY4qZpl6x9iIDvIHFGDYpZ5e1KqAMJ50wcA6JdaZCZerq+XRKga YnR5TmXVhOGI+gMu5gmMMOrqu43O3uXVAVVfqItHDOnt4fLZVcHsVkjr+19Ue+nY 24SRIKWDVldqjrhJX0YyJ1V/UGbwodK5B5qm7ZMcJMMwNB8pII8MnIIx513Xv7Qx 5pSrerwraCOhZkHOQ5jMSex2qniLGdtLwEaLfCCYEgRJHB44U1SDtYKGzHvWkPeN vEFf7YOz58ejjsP6flYFKPdCXtLHhK1BXeXPEl2zN7ghef/6KVhljx84lJExhGDz WRfep8HpK3QraFqhW2M7lMBCl7oz8H25M7QAniQ5RQRG3jiM/xBZ9O3RRNJG43uJ gZ7M0QUHE6fTvfMa/XKAj93gisRhyZdSZPLN6o3cekyxjdVPAFGUXF6cuT8pq87/ bD4Sf1JhbcMYNiAY6kVf+UCSubB5aGTwg4e8fvvDmeTImU9bwtdvd3NWPkDSH7U+ I/FMlfEUd4dALCOQK/xEVIo00+6dNm40H2BSmjTecNsxmPcl+sUrcrj4VQqi9n26 H3OuRay6A8q+W1y/7a+pGR8ZUGY2Sd3aCl295J6S0iTWxOopefpYGltv7HUgXHSD wrLvX91VWNttVXlBShHP8ItcgFnjsGnisjP3XGfAFgI= =fxoF - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW0P3XWaOgq3Tt24GAQiikRAAgFBnQ6KBsMQxJtPH8z9LCIOlqG1G6Oer kaGY1EZQS1RXw8YsdiHLkOHWYWLEOdOg8AFu06VnVNwqJOyngcLOuCn1wJdPAQQU KbcJIoCys7GmATCcJ51niMRxPejTlGWRupy2TQVDY/RRhlUEfjgS0ZtWU6jHfkPW Svyd3aQ5cI1hqeqPrveLsiudM88TgqIqWYoW1UWFYB+/2162tgGhnr4xD9Zaes1Y tFH/V3s3Dg5+f+bcaQ85cLQbmvXg/bx1rizk+pDOuNAlqmr71Wx28lUGnUEvFyYq VnYlzjpnjCTHwJtyCQmdrZhHn7gABE6j4DoSeFcs9NSCQosxiZ2L4tMXTIOUitcR 9RqFs4mc8F4bNK9hlIyYBfQ4tljKjJ57ftYDDfUppp7XOdzpxMWoa29SyXt51ORk Jd/OhbNLBScUKboNhbJIyxIH7Wa2cASsXBlQIfjpNYGuWLtSO/U3qbk5N+WmM6Kb ZFLM7oOpAEqDHAE/xr11iYtbTvJSxs98kpVD5tW2zonS7629tjmoeu2XRO21zYtd f+TKm+KUhHyZA/cX2sKywKox5ouHsGZXlYmad+AJkFhojjnt1/jsnc1jffKXIO5p gAqA+fk3xRb3v4Ote/Wp8eC9CLI9N4ZFyXAvNTLLNWW5h7QVrksTRbWbeSJrh9o4 B2/9dtbXPsE= =z7y5 -----END PGP SIGNATURE-----« Back to bulletins