September 2019 - Security-announce

APPLE-SA-2019-9-27-1 iOS 13.1.1 and iPadOS 13.1.1
by Apple Product Security via Security-announce 27 Sep '19

27 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-27-1 iOS 13.1.1 and iPadOS 13.1.1 iOS 13.1.1 and iPadOS 13.1.1 are now available and address the following: Sandbox Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: Third party app extensions may not receive the correct sandbox restrictions Description: A logic issue applied the incorrect restrictions. This issue was addressed by updating the logic to apply the correct restrictions. CVE-2019-8779: Apple Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.1.1 and iPadOS 13.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2OQv8ACgkQBz4uGe3y 0M0khhAAlJIPFCMoN9t7dBGCAv7pAN/DB4vdQQe0GMf4wRI9gYWEZCZs5GGl3DWl lki8MyOl4kImWJrgYdK+muLCFo4oMhm2ieAyPYau14n/4ZBITe/PIP3JQT0jn+BA mtY+H2Lf1fACX49bNjpkIC0j05r4JGk7yggki0IOIkUyaoFCmCUNR8fV7clP8RK1 UUvo4scZ90axMMk4YzCqAEnHTeoUhqaYyCXirUThpMHhsZjbRbUQ497OOQ1B/N5W QSx0fsor2N6XvHA7g0dR4XrM+4U3xQgsdyQabMoqZG4Ua9UBnZ5n0kQi53kwLKWL wJtNb9VB27MvnwE4WmoHJcJPqXDE/4RaXV1Vd6m/0LGlRIHQRragKHzfYJSUhZ80 xd8H/E9yisSWGfflRziw5haPAatPKNvkHEy7kwC2/skbQ4vpb/CXnToiNIsSBnDl vn+wdjeW1gcnl2+q+BrhTPU2/wSxl3jUncjfNpq6LPzk+O3m9IN3Q6MTib4xkfZo poNmT0qCcTIK+7BZ3j5INP51ZCz7n9otD3l7LEI7dcb0bP2rM9yZZfdLILsNOyXc uAS6IFoq4Gwclma3rYbD2mgKPu94DQWTsiSBS3ZqSk+mc4cKphNc2U0Qq9Li31zB EEbk4iAT3QemSf7aAII5VhfRE+UOQ69JdIwJvIiN/tA3t4VsibQ= =12Lw -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-9 Safari 13.0.1
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-9 Safari 13.0.1 Safari 13.0.1 addresses the following: Safari Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6 Impact: Visiting a malicious website may lead to user interface spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2019-8654: Juno Im (@junorouse) of Theori Service Workers Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6 Impact: Service workers may leak private browsing history Description: The issue was addressed with improved handling of service worker lifetime. CVE-2019-8725: Michael Thwaite of Connect Media Additional recognition Safari We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) of TurkishKit for their assistance. Installation note: Safari 13.0.1 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2NGWkACgkQBz4uGe3y 0M1rohAAqaD5bYeP305cUxNucHOv/KOKf6LVk2GK71oLTgIHTGKInLKCD3xZ7Ml/ jOYFbMFDbDyi/lTepa5+yAWcvuB40T7AqstwnG/Ntwzi1LfCRnCHE60lZ/6ACLCC SB0KRxrhWwgUiZamtSRVeg4ZzDn/5sYwzQgmWx8Oa+/31Ch6TgyvGmljG4vt2Ijx Vvnvml7IY/glnp53XsmkkvXwr6gOYEA8oFPPaBQnkDQl9voUQhWvZ2HvqZSxJ8NB Mwj77QOPnNnFNp4Av0CI8tAWZbH6SPpkZZ12OwX2cAyXfa25ptolSOHp51Fs6X+Y fiOUr1L8ozxTM4vr2MlQYQw6enQ6qyp48hfBWzq6aEpuXJ/BMbfTqnf9rZYdRUpA Lsxp4CaE6wlrdZXuL2Cj6aiLzvHCiROpGuJrKNBMZqShGjB6q5gTPqWRueeKRH+W +ywhftihfw+MpiHd56dat+iOFKDfnSmSkRya85sLbN0UNMSJzRb8sdPWBZ2KCwWk xkyUDaDaVQaEj17FQ18hUrBX38wjpp9yD7nDNcQdr60P0Xm2eCt0lspwiCE3gl1p DfZiCC1QROE6zIZJktTy9ygZcnBerFY60M7tN0qcf+x6vkfIska+CJChz14qd7+p ag/jn1JHTThJFRenF1P6W70k8rWsHbv5VuyL9Mih0RX0UVBptes= =gcEu -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-8 iOS 13.1 and iPadOS 13.1
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-8 iOS 13.1 and iPadOS 13.1 iOS 13.1 and iPadOS 13.1 address the following: VoiceOver Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: The issue was addressed by restricting options offered on a locked device. CVE-2019-8775: videosdebarraquito Additional recognition Find My iPhone We would like to acknowledge an anonymous researcher for their assistance. Notes We would like to acknowledge an anonymous researcher for their assistance. Telephony We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13.1 and iPadOS 13.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2NGWEACgkQBz4uGe3y 0M34Nw/+O9ZMKHYpUp4jqV413+g/bLtXpEzOSExqV7YuZEB4lyfPLXddJAlr6ofH a+OpfNSAUhh/3D5kzbPMgv5ZFyEzMj53hPHH3MkZ5WAaBf9hsMVX/NXrU1PUeQQ+ 2gEayhgCjC7tpwAJelCm7BvnLwmiEMCpSC4OGXpVFZGuXa0NpMWRENQAQtpP6NtO 9CsyHZ9ByDCeS6JsgBNJAIjXLU4a/xIpjd0ZKTXVS2H9nU1uzRxnk4htHyw9Re5Q 0KtDlR1XBRHdfvbwJqcenzIeOZ1hyXwtqJZ3AtT2yGvJnEs5u+GpYMMWkQ3/MCl2 sMDomOYEImADh7f7kHCh1TXho8vNeTSWgriFDfWcW0VILLQhLYLOXpd4YWZeta4X PFCEXBHyX3hQFBz8TUsP0JoWueHYFWTmPg6oX7uufYxWsH9WkXN4DqzfIrskp9H0 AI+esP0Rz2frUOVP4+5kxjmU2xUU+y3RPKq/3I/CvWfG/xqUkGdkHLM//QiAUXs2 qhitv8y+4rjjmZfakEs3bVCwqKb17ppdvEHXJPUs3kz+kM48KvCTDttBUM7AFRPR CW1jpdrUHyX104q1N/ycwkLziD8ItK0IVzlRaJ0FNcn9KR3wf225HV18UpXoqKQ3 ImQZoI1ww+qIhVLTSqhYwZyHcY+q3vHiL53q3UdSmhmcQup6iy8= =wlDX -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-7 Xcode 11.0
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-7 Xcode 11.0 Xcode 11.0 addresses the following: IDE SCM Available for: macOS Mojave 10.14.4 and later Impact: Multiple issues in libssh2 Description: Multiple issues were addressed by updating to version 2.16. CVE-2019-3855: Chris Coulson ld64 Available for: macOS Mojave 10.14.4 and later Impact: Compiling code without proper input validation could lead to arbitrary code execution with user privilege Description: Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. CVE-2019-8721: Pan ZhenPeng of Qihoo 360 Nirvan Team CVE-2019-8722: Pan ZhenPeng of Qihoo 360 Nirvan Team CVE-2019-8723: Pan ZhenPeng of Qihoo 360 Nirvan Team CVE-2019-8724: Pan ZhenPeng of Qihoo 360 Nirvan Team otool Available for: macOS Mojave 10.14.4 and later Impact: Processing a maliciously crafted file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved state management. CVE-2019-8738: Pan ZhenPeng (@Peterpan0927) of Qihoo 360 Nirvan Team CVE-2019-8739: Pan ZhenPeng (@Peterpan0927) of Qihoo 360 Nirvan Team Installation note: Xcode 11.0 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "11.0". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2NDI4ACgkQBz4uGe3y 0M3yBg//WnHzKci0fwo78s/jomFP1EcSVj8FQ5T3ycwITMK01X5WDyZUHJw4rHJH l3NaJLFkjXXovzBl0aQzGHoRvOiYoMJeBCaZeix3dafLdA+6whZ8VREie4ncY31y EI0KoPxBxocLu0WaMUmEatDJsGqQWWFy0Q4LGGmDyOIXnrRqWJrLE7Qmm6IvOr1Q ViDpLeWzymHaAQiiXnpUR9nDvpCEA5irlbKzvmfA55FLzUYdh1RBJUjrsR+JcUJ0 IewyJD6FpFMzpOImQJ22oBArN++Fag6KjlmTDbmL1O2uCHbl1x71ZhOPBRhgWFkP X3nXTYFLGM22SWzOjBn8el05AAfOmkuISP9219HEXfbAYZliTQw37L2VlZ86nCn2 A3F258d8m1UAOh7NGvsDN4WUQ/QD4PQ0OUPSzQtztMXHZwoSiF92fw6epCkH10dV xb28tXuv4eI3aI2ncgf5fClOwsC6/IFeheTfimsL+6ccro2C1IiJvcMnBH7HBZ+9 k4Z414NOKlUsbhTX+8lcLKKzpN/WxppmyN01fIdwO2anu1IRXOI2D3TvRKFI+pkr u4u/ohjf8lmCgoDPyAa4YDmiYu9I5qMb/CmLwwhdYjX2NeUBSEPb3Ctga6jwP6RH /3kg2VAgACUG+nR08itzvCMwCzkILfiCSy6D9EkPed5aoPGIrP4= =9Hep -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-6 tvOS 13
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-6 tvOS 13 tvOS 13 addresses the following: Keyboards Available for: Apple TV 4K and Apple TV HD Impact: A local user may be able to leak sensitive user information Description: An authentication issue was addressed with improved state management. CVE-2019-8704: 王邦宇 (wAnyBug.Com) of SAINTSEC Additional recognition Keyboard We would like to acknowledge an anonymous researcher for their assistance. Profiles We would like to acknowledge James Seeley (@Code4iOS) of Shriver Job Corps for their assistance. Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2M+zsACgkQBz4uGe3y 0M3aSRAAtosqDT7s7P8Djp0IX73Ard9EPiT0iNQdd4QeIKxVciZG2a5bYnc0GtI0 88lvpnQZB/EsP+RK0joAWiEauykQ2GY96XVN2WrMriaJdgsQt+oidqhnbTDtyAWV EdCKCLDOZNyJIoPXRVimBmxHxah84E93qZkNYASYCJhHrusUiIBdRTeCmw3vOH2V AwwtiXDDWB3lIg5IcOs6E70bPe8DusjpRoeEkoDgWzDXTNC2dGdJqzo6mNbt0VHM 4iqbSQ/2MnBwid1ymG/zSmvl11lNtamBXtN8DPLRS80V8scTpu4mXFSS1Lb+hytl a5vGzPYxYANpzAoF6S3r654Xfxl4ANumV1ItcGsPq07ATAOTx9h+945S+AdFOsGM K7C9VxSEck4p93Je9nGfHSAqTjlBM0CEMxfc6noQx9nkF378id/CA2+wzHz+FW9N B70ixle9kr3KTcj4XfxP1VQOVgw6jrfnWqGfPPSMsq7GPyC0MsAtJpiDomPX0NP3 aqRPVx+8Sf860iAhyrIxSnsndseaCk0HJaKri2SA+qlGKj/2JYpFLsg7LuBqJ1o/ zkKRuAG2cWoDvgtZNPoYLars+4yXlf6A+xX+/NY1w4mrF4A9ON+PUVCVKDJifUJN 7N3vRMmrhRFLwWuvi2yvLL8lw4HOefiLhS6ekw/ehnohquEP8GU= =MvE3 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-5 watchOS 6
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-5 watchOS 6 watchOS 6 addresses the following: Foundation Available for: Apple Watch Series 3 and later Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8641: Samuel Groß and Natalie Silvanovich of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2L4cgACgkQBz4uGe3y 0M0eng/+PLb11EQvodGFMq64ib7Iu4VbU10ZH8QQ5s4Tccffh0aNqD0eAhSmcFR/ ZQKAIJt8eTwJrnKp6OSNo4JWchkaOsNj2DD4AFPjwO+/dlxH0TA82UPDL3BM2iD6 YFgDSuWtnmaSjF5zGOX6GDfsLKO94OfKG73Hivc63OHOBw9jGKLhMaIxG7MfYV+E U1+1ZaeVU1o2bFzDyQ+Y5aHaKXxNwO180rGMa4KLoeFYYMnxofm9lq9/dmQ/wokl kKP1Se0xu7UND/xvjhsAysg95NIgmeBjhnufkqvu/FrQl5MsiSmWs+dujksoJ/k4 gsLU1Giq7Ai450qoUFAvKlgREt9jpChpm3/2/+rZnJCdfbVaWvzP9pqH0M6fjOM0 7vs1EHb3Zd/Mywqz7YH5dMvRzG0QeBSzixP75CbMfyIOZP09nb0s3/w7ch2gNArQ vUG2Mx4J0maYqTJs4VrgLWOMICuRh5uJ1l+UrwgLvXIw8f9qromX5F25+uIDW8Wy dQNwrzZUelLrQ2e3u5nrRNF7lyHNBR3az/EPgeUesk7EnN4OLgbyh5f7tlVlNVQQ PZzMWWSVcZPG86WDannB3OungaRsAhqPH/9S1vTMDG7/Y8MfB3bVqToMYv6JIgdv 1dOcOFjT3YSUob/+eQdJG0pXyvN3UJTOBQb4fM8b1/ovqqovcIg= =Gtir -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-4 Safari 13
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-4 Safari 13 Safari 13 addresses the following: WebKit Page Loading Available for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue was addressed with improved state management. CVE-2019-8674 Installation note: Safari 13 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2L4cgACgkQBz4uGe3y 0M140w//SBVeEHScCaFuKyJGGKPaRgwgs9uRPsz8DLgNVny3BCniqhMnQPHeDWKI zjhd+M2oZvvaplPvFUXhjJutA9TTaX1HgVRW05j91OOtXz/FeSK1475KLXiWbrMl MsMq4u3HSjj36G78ShvRoLAPdG8qTubqPXikQ4E2nYIhjF8uEFYfH+Vfq+kJFJ4h e3QF7AfPiy/TTrLk9uBFlJGcqZ6CC1ySEDIaMmxqdYGaBZW85w6auM0hTLbJ51fw YChKpzlfDg3s4oAtifHjHCP8jwH47uitlWrvOo3yjlI/oMeS3FSDUYmgFzGUv7DU aSrz6Pfqpj38A8ln5ZfyHsQmU94oaDfJZ6TCcuILyJsDEoIRQH5n1KyuXkbCDvHO p64tUZOJtspRSce8dIa0XgP8jruK1N4IH3Td1AzkWRdSIPvAo6+n+XJGgRzFrs2S yDNKrqgAlnGuGz/uPY4YSy84cBP8qNjNEGDGngpTKtLboDpwiWF5Xsjshua21xov OredEXzYKjL2OYbHI23xCtGJ5zCVST63awdEsAELmPlWTEgv1/Cnl3ZnnzTYurx9 FUBxtBmbpYWf2swjqauhD7atfYLE1lyyaE3F/jAd9YrZeyVqMHNLU9+G03OwcUe3 xl9XxykQzUm4mBokPlhC0Bw1n/MMxbOdxkwV2N6n63XTE2vR5/0= =Inji -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-3 iOS 13
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-3 iOS 13 iOS 13 addresses the following: Bluetooth Available for: iPhone 6s and later Impact: Notification previews may show on Bluetooth accessories even when previews are disabled Description: A logic issue existed with the display of notification previews. This issue was addressed with improved validation. CVE-2019-8711: Arjang of MARK ANTHONY GROUP INC., Cemil Ozkebapci (@cemilozkebapci) of Garanti BBVA, Oguzhan Meral of Deloitte Consulting, Ömer Bozdoğan-Ramazan Atıl Anadolu Lisesi Adana/TÜRKİYE CoreAudio Available for: iPhone 6s and later Impact: Processing a maliciously crafted movie may result in the disclosure of process memory Description: A memory corruption issue was addressed with improved validation. CVE-2019-8705: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative Face ID Available for: iPhone 6s and later Impact: A 3D model constructed to look like the enrolled user may authenticate via Face ID Description: This issue was addressed by improving Face ID machine learning models. CVE-2019-8760: Wish Wu (吴潍浠 @wish_wu) of Ant-financial Light-Year Security Lab Foundation Available for: iPhone 6s and later Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8641: Samuel Groß and Natalie Silvanovich of Google Project Zero Keyboards Available for: iPhone 6s and later Impact: A local user may be able to leak sensitive user information Description: An authentication issue was addressed with improved state management. CVE-2019-8704: 王邦宇 (wAnyBug.Com) of SAINTSEC Messages Available for: iPhone 6s and later Impact: A person with physical access to an iOS device may be able to access contacts from the lock screen Description: The issue was addressed by restricting options offered on a locked device. CVE-2019-8742: videosdebarraquito Quick Look Available for: iPhone 6s and later Impact: Processing a maliciously crafted file may disclose user information Description: A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. CVE-2019-8731: Saif Hamed Hamdan Al Hinai of Oman National CERT, Yiğit Can YILMAZ (@yilmazcanyigit) Safari Available for: iPhone 6s and later Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2019-8727: Divyanshu Shukla (@justm0rph3u5) of Quotient Technology WebKit Page Loading Available for: iPhone 6s and later Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue was addressed with improved state management. CVE-2019-8674 Additional recognition Bluetooth We would like to acknowledge Jan Ruge of TU Darmstadt, Secure Mobile Networking Lab, Jiska Classen of TU Darmstadt, Secure Mobile Networking Lab, Francesco Gringoli of University of Brescia, Dennis Heinze of TU Darmstadt, Secure Mobile Networking Lab for their assistance. Control Center We would like to acknowledge Brandon Sellers for their assistance. Keyboard We would like to acknowledge an anonymous researcher for their assistance. Mail We would like to acknowledge Kenneth Hyndycz for their assistance. Profiles We would like to acknowledge James Seeley (@Code4iOS) of Shriver Job Corps for their assistance. SafariViewController We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 13". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2NGXUACgkQBz4uGe3y 0M0IaxAAsylDd2Oc5zuJXYgbN/WXihPF0k8Swhxypi65S1NbMLMrvL64NDPEpp2W BQ10PBqcPR4KDEnxTBn4AbcMPJE+U9LDcclv8+L2mopbjhQKBOKbCnWuxTfN2wk7 XfuSci+dFA4mQ3GPX6s+2+vqT59O001QeOQqvSDxBFsjlQTW1Vq96YHHb0KC4tDO r3nZZWboCPpVNkyXdFwKd6m+eqqMJaMNTj5el/5AZ3H7ynSe7sKI/gvZWgZSj/Nj hnbHIEAVCBwBzLY+3MQ8qNKi3M/gDbTYkuEj0+yUZ45gfj/ZgOyznggkn1yXA/Qw 7Uo1W1u75M3tHx1citWdQAq3UsGT8yxMQkYyZzU0h7bwNR6k6jy7NblAYEGNaas9 aMBxkL80QR8HvQmalMHgexC/bgg8grmf0ZzBmJcW9/zdYXcwPPn3dcukLQqXNo4o CgBDmLScJS9/0ULAk1MUgtb+FgmgI+u4pKqr6BRuEOCuyU8Pu4t0DzG/g7sVdCf4 EzVTrYjFLstd+waAj0TD4fCMDzrtc920Kfetxoq0tUkBj25KrWLrkhzgVCRd+GP8 o4IMT1AVuwxdmUQxsaQIC7qRWtYOwsGD4eSYXyZWfNvhacRm7QCNVGcYiw7bdd/u Q6eST5657wg/kFHQybkilyZ2DhyToMzW6kBkbXazY2ITiAegwp8= =uZLp -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-2 macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, Security Update 2019-005 Sierra
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-2 macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, Security Update 2019-005 Sierra macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, Security Update 2019-005 Sierra are now available and address the following: Foundation Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8641: Samuel Groß and Natalie Silvanovich of Google Project Zero Installation note: macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, Security Update 2019-005 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2NFuwACgkQBz4uGe3y 0M3WrBAAr+Bi8S05hUUkC9r4Jz/PlG2vMLDKedwcRPsiEiJ87izrfA8Bb/9qQ3EV IvRqTdw+RDjCQsMZ5GfNHLRynbYyq3ILSCEhLOvpAhHt4gkNF83EktleSe+yTno2 QlEa+l8oJGr2GMVsQNmXWPmykLNx1qK5jysPgepdm/JYOfz+IMGxM7vCaNMk+1gb hohqa60VBnOrl/6QyD39Y8U7JI7aQFYzc0b3NtQI4H5jgO/5LPeScBe3eNf9ldjf CN6TcI1VPEeGtEqBn5M5/YA/WB4zpaCOWB9KeOqgp+EMKeZtgNNDUDyeP0mL4sXh 0S9xub5dxkk2wEanBZe7bAJydoW9HIn9CAptcM3N7cCJ5vhTye96wCZ+awHJ32NU n2fm/rbOA4zB6NjTI052QwjElY8h8mh0E2sgU+04cF6GnIEEwxg1QTH0ccVl2YXf 2ek9DvdC+XbM6sGemNat4TBgsB20E6EVpmEXIJnS7hFTt3wuSEcQckYo3kUxMCQB 9pql4Rsq4Ma4uAK7b8Wsk8VTq1hWa7zo5cvSZcCirspHqyX0hmj236D9nUD1rPYI zt+h9Bhe2ee/ahQBgQND4uzYaLROsz7jFqR6PXQy/abx5+vYv236DweTjG0QWvAQ ubQ+WQrHYeW2nFOpZ2Lk18Sn0Fo5A3dTTTj9LEIeETbg2kwMjdE= =+3Bw -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2019-9-26-1 iOS 12.4.2
by Apple Product Security via Security-announce 26 Sep '19

26 Sep '19

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-9-26-1 iOS 12.4.2 iOS 12.4.2 is now available and addresses the following: Foundation Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPad touch 6th generation Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8641: Samuel Groß and Natalie Silvanovich of Google Project Zero Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.4.2". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl2L4ccACgkQBz4uGe3y 0M0+sw/9FKP5OpSDDplT8I76lvT6ethuW6VQTlmzV5szsvG1qnPNgjCM047lfV6N dumqIwDFaRC0ibxX1fhA6wZ9vJ4joTmufNZEcp3EdSw4ZgFnGS4nqYH7UQcatOrV 1eQ9D+OSCDu1lxooFR7iUyGhymjvPn/Ase/JI+/YefEgRI93kMyw8FxzXz3JKCK1 aZH1rnZdnXg+B7Hakc5p/t8sssxU8IAoJvihq9a7fK5OfKwxgbopVaztLVhVF/1Q CTF5nvT0GUL89O9UjTK1tHjlXMak/aslekkNHRYcMpn+elZz+xzxiS9Mj/rVgj8C TsDuIS3RE0KLH4K+rntgU2CJMNeAezqFIMo4vVvpu8HalQimFbO0v8l2yaTbUCqL nqfGSxGc/nQ+Fl4TlfkBhlx/gfSM5d0Ppx97c24Na9AF9PdjbgW4tleZWRFcoCkX /bfCTkzPdyy0ELj/Yt2oEgflzHFiBbNTyA639tYjqykGRZfs3iugZc9wJojzPE0Y QVy4pT3NAEBMRrx946sFQ9Mk5Kem0Wl+EAlKdBezgjg7fU7ZA2bvKOVMMmPl9HSn dBQp6ka5YHITXEjZ341ZZxvNAWcOINFWerFw69p7GXry7ys0Hiw60V4Q2dQmyQBp P597Lp4hEleVQm2QuHwu4CwmFjlOYUcoW10cyTEcMvN4vuAsRSQ= =C0kU -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0