February 2018 - Security-announce

APPLE-SA-2018-02-19-4 watchOS 4.2.3
by Apple Product Security 19 Feb '18

19 Feb '18

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-02-19-4 watchOS 4.2.3 watchOS 4.2.3 is now available and addresses the following: CoreText Available for: All Apple Watch models Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4124: an anonymous researcher Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJaizCFAAoJEIOj74w0bLRGHOQQAI/8+maAAaJ4FVj4c4jpHx2l 8h6Jp1u4fa/buEeOaNKbTegSm1HEbBbvaD8J9s238dXyoiiyut4R0x3iwiimsZ8R QUJn9CoysNzCKlblsudmxSsODLLodx+k+KN/CkrT9ujTgf4UgQUFRsQzzZ8i3CiO bgfc63k94vPpRrYVQXz5nvZR5bBFqw/DOhJRFQy3d6+pg1h9yKZwM8hn+Ywd9imN e0Pd+a8LwUZiUotQiB799UErsSt2KoU23Wjq24ETIGgg2e4L76bpq6Tguzc37ea6 xMUVlZvh0ZIC8h+QnUPShnr4F2wHNcdLujQRnl5r/ufQRh6e+XRuaDqg5qNDmUwd juEMJcJLUfcGKBmQCVyBnJFLi885ZAWaWzvthuOkuJY4eNqfwwodxB3YZnH55Qhy bN+GVjpJCyzM9v8IhXumpVe7x4cI0I14mhJKCQJOK0jKsm3QgYpvsp4Yu/JTHjrV WQMFngCfy5Vx+20RTH9tT6wLqtMoyA8cwxViR5xU82uq+jY7qY1yWuCZRVRfRs69 o11PmA3kXm2JqXF6xLTZER9lCis3E8se149myw1Qe2XimrkIHRYkkyZwMxBckLty epbtXiM6zs+i9wTcdM4rGTHcw3fAPYcas4OpnLC9f1yve1SfCyMFhSvEZ7LzjG5q eAB9cTArNP6m8zaLmNV+ =4LGh -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2018-02-19-3 tvOS 11.2.6
by Apple Product Security 19 Feb '18

19 Feb '18

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-02-19-3 tvOS 11.2.6 tvOS 11.2.6 is now available and addresses the following: CoreText Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4124: an anonymous researcher Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJaizCFAAoJEIOj74w0bLRGvXYP/Rfsw0gVK8hgRBiD1SAFeufC zOUnqSLSps7r/64SoVBmcUmDtFY6v+NkUIMiPePk0rvKbvxuhp3OQGQMpMMIx2Fv 1UAmo7DF+LJp+CeZxyEc1jNAqmVMTTxL/by42DMc9kOAwqo43AryoShz+QYilwrX BxAJhAUPgbCzDQ542tbFoa7UuQlaooe7n3nSQqyTby541UiUGBJAbgUIf8m/EGTh OOXm0DyBjqRgC5q/46DBx+Y21t3+IjiB6qbeWi4yPko/vQYbvFsvBSb1n1We6A4G kkS1q9Uq7P89kMrtHB0tEArnJI4xCSY+NwiTrrj5BkCnRQp7EL0zN8hFjpE8ofQ9 2lRwf2khWE1LRl1a+Iyy5R8ZQzQ19DmEeWvd+19VIWVVXj1Zrt+DZ0k9+ILRWPQB dy+3AxloBveWKEYI3SzUuFt+pUx7hZhPp69xHjn9ATk3KVnRs2m1JMan3ZaZrxQY e0bYVNsjBv0+bKeuMCgU7+0Ht0R5G7+dBN9mTY1UOrOaJFta5hoewEyQmZJfSEw3 Ixg5Gy4Z6GaYhqHCXVPZAN4sPmY5YkbcxCXFeXNjPW0g6dpxuQGgnrZSU0C6bOJM VSrnq+0xWLjCwFZvtcJmLmYoy25/IILS+mG6WoeEPNI1fD0ZpVCUaSyc5KA7oE/F NGFfGFZms1zqGtHomhi0 =j8I1 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2018-02-19-2 macOS High Sierra 10.13.3 Supplemental Update
by Apple Product Security 19 Feb '18

19 Feb '18

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-02-19-2 macOS High Sierra 10.13.3 Supplemental Update macOS High Sierra 10.13.3 Supplemental Update is now available and addresses the following: CoreText Available for: macOS High Sierra 10.13.3 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4124: an anonymous researcher Installation note: macOS High Sierra 10.13.3 Supplemental Update may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJaizCFAAoJEIOj74w0bLRGxJQQAKPE9l+lgJ6skBM3eVjs5W8M dtEV1UCP46py+R26xIsded5E+Z02x0RGz96hr4fderLdSIpIiaII5T1qY1/1vzZ+ njoGOiGVc/1gGqsqWPpuZu02C0xPdlQ0ohQ2CJ/neS1RRlh0QjjezkoKDe7b7tVC +NFag9Y3hw3AB0XVYi/bFPvOycFjf04FNzFe1rUzFOjjx+T2MQpfkUy4nur6RxIS ekfpE5lNLRNWnGVdn5UmR1yYqdFzih1QsrG6Aa41vvMVV57+/oIGpJFnKoYhEX0i uh1QChKU5xEnS2ELse/OyOcOh3CdpwNnHDyZrYE6m5OgJp652JIwrRZZt12Q4PJ8 YT6+jte7qpa/zc0JThCdF0Tfz8C0nWQbYJcw/7I1TpcM4PdzLXDVd9Mu6eqUtFwV WqzV632WsY4GHmYILuR4SeMSRxfxXBUuksSBi8+oMLy97cB0+jyt9As+8j6tPjRR jTgEIwVyF3ZpMSf0x26ETY/2S19iDqe3VDPJ0HRAhirpaUR5eERoa6Rvw1ArCHBN ULbc4d4UdGS9NTfIuxw/i+tQo0KSz90S88CdWjyCJPGLZ9tOWzIJ31mBSHMnq4v+ /xzKq44IQFN16yz1zCSwFL4Ty1iYX22PmoEG5QZeBtoNI92y153XJLgkPy0DPety DMY3WCveD0wJg7OGm8OK =jxgk -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2018-02-19-1 iOS 11.2.6
by Apple Product Security 19 Feb '18

19 Feb '18

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-02-19-1 iOS 11.2.6 iOS 11.2.6 is now available and addresses the following: CoreText Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4124: an anonymous researcher Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "11.2.6". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJaizCFAAoJEIOj74w0bLRGudgP/A21nHvIArfC6P8S52R3m6H9 UqRAb7o9dC4kK7UZiE/mXYQMcPZrxCM9XNs5U1o/cziFibAdHIUMsCcXpPVZEC0/ KLj2XjTCPSAsFEqgkWXbzWi6epnir+yHc3SUgTBsQk78ZA+ArDGgY27lY32wPpC1 nXbqe18I/mnEX+GHzgdnST27bDX8aBENJYeJp3bUugfDXplO8uZusTAzowh6Z+9j lzt5gt3H01RRflVf2J4jCI+MD3FQHOP/CvW2srVofRvtRMRxfOMJDmbFCkqp7Ep5 Np08UjTaWNVBVNrtt0O1nhMS30iFcFSHE50TuHeS0XGnx8yVJOOM4Psik8iRlCGv 9F3lXcIMw4Nh4Ff2u3YrhaFbtt7lS5nKPwAgzzTjuDYQiA1XUBKU4x9KbpY8Vkr2 GX+tLHfkp48jPMhafEi4e2VS7ysvcK7vcgPzs+oy+6Pxze0T0/G/vKfDLTGYzTLS CEqCM0rVlv3tOYZn9eF+Dl8jAJ2NDCxyGAV8AqWFNkMgDSc4UhCQOVqV/iXE8ks3 UGQz3e3sXIGlLD3xBmuQ183PvX6b8rEUDfxwh/ixBXv3hJt7A+mR9EXsj/SXhXXG 3bsZdfW61mEdMUfVllJpt9ctceX7q1BAJbLDnxlMJUNAFVggfcERWLPKTwWbREhX xu7Xlj99gSjM4B0zFq1F =3j+M -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0