November 2023 - Security-announce

APPLE-SA-11-30-2023-3 macOS Sonoma 14.1.2
by Apple Product Security via Security-announce 30 Nov '23

30 Nov '23

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-11-30-2023-3 macOS Sonoma 14.1.2 macOS Sonoma 14.1.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214032. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. WebKit Available for: macOS Sonoma Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: An out-of-bounds read was addressed with improved input validation. WebKit Bugzilla: 265041 CVE-2023-42916: Clément Lecigne of Google's Threat Analysis Group WebKit Available for: macOS Sonoma Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 265067 CVE-2023-42917: Clément Lecigne of Google's Threat Analysis Group macOS Sonoma 14.1.2 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmVpE+0ACgkQX+5d1TXa IvoY4Q//bNy4CuK4jcpHmFirjOgmyd8Sp+9aYQ5XkQ/GEZdUETxdK9rnjGBPfVO4 N6cfPpoiw030zlxJyYBhA+1UjQHC6ynENqII2WPoWWDH2TXdq+Iym4NQdPoaK5oL aTWpWz3ZmSmZ2MKGHX+3oUo5M7bl6prTePPGu9Z17f/SPfSKdYeo2/N170kCZP21 0x0Hzr62jcYwbNjBlu1mD9PsC382VsSrCnb4awKOqYQ6BA/Ij8gEnobjWgtSyzi5 iSc12Jgq77OLBUtxVDj/tmmDByOL13RJd2dfFZO4B+TIZ9mTuFwoUBVwDDcLvRhl 4KKGDwge7egeUirYV+rF1DVxE0vFUqq37Lw0H2hAp/pYH/DzxrFecaVeO4VLol8M tyY1clSf306D/p/FoXoetCFR1I35SY2L2AEYN9PwUQq2JRDbBZeWHSzv5zXWbnFH eG2frM/faoR79ThU+jzaiJZvg+LXSf3QH/CTSmRhMKxuYwP7eUEv6zrX0wdoDw5C ik0Q6D/iN0ZMz/NrydBBR7skfJDRzwYTmmdnFUHMq++NhRCuQnIR5gUVbGGFURMS 71rNTnRDp4Q23ecDoUvksBGr+mwXv0AH+5TOn/aFJ426FfTTuMIQ2gee04HqiYWY 35Q4hRgFoso7zDNt/gqGo1lrSYXDfNTF9Ka4Hv9YtS2qbBUJ4X4= =Iax0 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-11-30-2023-2 iOS 17.1.2 and iPadOS 17.1.2
by Apple Product Security via Security-announce 30 Nov '23

30 Nov '23

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-11-30-2023-2 iOS 17.1.2 and iPadOS 17.1.2 iOS 17.1.2 and iPadOS 17.1.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214031. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. WebKit Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: An out-of-bounds read was addressed with improved input validation. WebKit Bugzilla: 265041 CVE-2023-42916: Clément Lecigne of Google's Threat Analysis Group WebKit Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 265067 CVE-2023-42917: Clément Lecigne of Google's Threat Analysis Group This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 17.1.2 and iPadOS 17.1.2". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmVpE5sACgkQX+5d1TXa IvpPTA/+JJ3n5gqVmkHfwKBB+CWNQOwg9QPLF3b1pwmnzIoP5FD+taitl+ZqPlB2 j45XkNvRAtJBBU44Mvz6A8z9cr4IpSmH2DT5H2TNTz1xKBvsDeYYUnTd9PB8ruCE ad8LQ+I4rOr8LQycQ8I5Z3eCtlVnF/jsQ+42DrJqa8kQk/+E7bzJYL8+uCIrgl4D pzFQDZGzdbtpku5WV6QvrCtVeuIUOx7lFDuPSD522xiYDJxJy5m1DHyB69La2+Gt E4txlNRUxsS+7A2fPyYrwOEt2G9cwqHdFErtyyTvqv5lsMRDTLlrK5EXYgYmE+Z8 Qy+Yhgjy4GAV1hxFVoK7CN/4XDmQnW23/Fx0ioq0BM2uBCvibPoHuzNu4AwQ2d/s IH3wGmvUSj8+GBV5TeHdqfZeRvgMtmWG0VxqRUE1eWZ84Zu9UcbuiIE22psZoRXP H8AxJOC9NLrd4gPtI0JS9HxyIoFbnV9eFFtcHQYRgoEsxqQx1izlfQ6YgIRLB66G xfhZtZ/9rIAA2Wc/Z870ZXtIUVlKUdCO3uKN2InTyHuGHY7dPGskCpkP9+3Etshs WKbi79ruBFWi1u/bXQcQqbIKxffq1AzZF+4AlOGkitR3wLQ2RSmD1sn/9m7E5+sj iP35QFnhkMB1W7pdbjexLdimeeBB0FvfpRp5nFhxIcHrTlkvFJw= =CTkt -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-11-30-2023-1 Safari 17.1.2
by Apple Product Security via Security-announce 30 Nov '23

30 Nov '23

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-11-30-2023-1 Safari 17.1.2 Safari 17.1.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214033. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: An out-of-bounds read was addressed with improved input validation. WebKit Bugzilla: 265041 CVE-2023-42916: Clément Lecigne of Google's Threat Analysis Group WebKit Available for: macOS Monterey and macOS Ventura Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 265067 CVE-2023-42917: Clément Lecigne of Google's Threat Analysis Group Safari 17.1.2 may be obtained from the Mac App Store. All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmVpEg8ACgkQX+5d1TXa IvpIIw/+L5k+aLwUf7blhtLZpServytns7fQ3smgGh7ktf75P+0AwRyKAJtE45NG 3MjXlDQS5q2zkhdAAE9qTFkLHazbtzH1vSKEkYbLVDOkwZc6S7aGWP59VVPGw0Z5 bpgbt59M7MW7VqjCyXMMEkjeo9eEIzM4KZubK3U21keEjPJ9lzXApr/D42CYn3cm qV+ctIuAivq/DP0XBIPEuer5TUmY0Vhkfo6gi2Ykg1508lBHcWY/RNPlnMjDAhfJ uxz47S8DLk8UvpqiRT7T+/UUqiOk9TBVy8mvPVV9d2vA+wngdp8p5lScIB2mHTyi OnimNp4cKQjOYcFF0nSYrdvUcmlmx0djyF2oC4hZWAosIgms4rmh5jRgKyoAfkMz wPoRLBx9djmdVg4Hj7udatllWYUcIsEudLpMcGL4xjzha3eknHAF4mbUEp7yFKxM QwlFomJZbdNbiw0ALgmN0+tjOjqnQHJSAyYRo9OYhzoN3jzZ1A6EPDMu+yCcWj9g lzIf59WaQp9+YsDp6X/eCWkuyncOBYwkDN758zD125lTTubQ7mYmcywYyYSG+z4M eByRRytVciTw/W79eAkZndBdeIYl0OFIJi9HIIw8+A+T4OsEE4eU53GSxd0H7iG5 KFHUTy9wNruWQkPxjB+Fi6vHQ8HJPqHb6LZMRwJTKi3d2jsqpo8= =6bli -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0