August 2025 - Security-announce

APPLE-SA-08-20-2025-5 macOS Ventura 13.7.8
by Apple Product Security via Security-announce 21 Aug '25

21 Aug '25

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-20-2025-5 macOS Ventura 13.7.8 macOS Ventura 13.7.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/124929. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. ImageIO Available for: macOS Ventura Impact: Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2025-43300: Apple macOS Ventura 13.7.8 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmimYeYACgkQ4Ifiq8DH 7PUhaw/+LAEDdBhPKWz+ePi18mkSr/hG29Ujxb8LVxCrPuCBtili1/aIjfdqJXJM SEa/+1HgekUw1oDlxu5Qe9pNNNAZlABOJz8K3GEqUP5e3CcWt2osUbtBdIQJyU87 1Nq4QpwWmO3sosV08KeIgzPbfw6NcMB1WHIpMllkYd++fzR4YWQWHHkc1IWxjMef LciiB7gn3b9nQMEyxQhyVUymHdX5+MLzWqjYi9immXyi0tDoSeqG5vChPXfaDd5Q Mc3mI702/mziMArqPeDhnlzJqwrETTwe19enO4+M8gLXz1poj02us9ftD7afwR1r pHAyA1TqewLqtqFq1vgwoAKTQ48IZ7/JKDfRpPVzf0cco7UK7E2GIxOX3MwdTgYu wZMvDk5oYbupYHt0u7WzK/Bs55wCg8aXg7e18O4OLYz+OP9oKSNdrUmE30Om9+Bc 9E3c71Jc42gnOQiuuWJov4C734bhkMpy2Po6N37j+muViOB8yPYYYQCGTh+gs9Xc Xt39Y5IaQVCAetOESOB4Op4Z88bY1bVgfH56gYQvztmsGnhKv14o0Gg4pAvMGEpU +XHO6yIPVhaD96QEo8AQLHnq6N6t8p1j0xHF+JPNKypCXTjNMLx9EQG7fqfwPfDk RYHwxFVtjiscPQS9UT0RvPRKpVHOW+6EvzqR3wbBM5aG5oi4Z4A= =seCP -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-08-20-2025-4 macOS Sonoma 14.7.8
by Apple Product Security via Security-announce 21 Aug '25

21 Aug '25

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-20-2025-4 macOS Sonoma 14.7.8 macOS Sonoma 14.7.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/124928. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. ImageIO Available for: macOS Sonoma Impact: Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2025-43300: Apple macOS Sonoma 14.7.8 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmimYcgACgkQ4Ifiq8DH 7PUOSw//YFleAN4ZeDbFoaTUXExV6hUg8maX00duxhRmFyyyXZoHL1a1LGE4kB/6 id359ACUbIcgbqKrn9zBGqFpYS3IBvKe9JB4gYUylwLlmcMhZYDMRpRwbOzPrF0m NTTCMQT7QeXeLN9Jm8Rb4ktye3lyCt9Gp863ouI1DLmdpU+wP+6hC3B6SiObgI4K 4XjloE6Bx16fTeDR7sx2cf2yBXMbz3rumzfF3Ym+F6nQXlUc4PNNy3DcOos/mLwM riWRRz+fm6NHFdXHlmWSM3bBV6mvSvhafjRIF+1DhkH7E+MS6mjWzpWjA0AjYBhH m/3LNwXaeseY/yDWxdvG2PA33d6mX31/f5jghDqQ9OzXMDDEBuJkYwkEXvbZPg7R oSnO3uLzIBaOStPwkYsz+EsQ7XiSq9tDgQrgpfKuIMwDEHmmzGJO7mU+UA4gPEJ0 fWwNkTu0ZGRrACA94NmlJPa8FIlloFk7Bm/ju/bsKWPc0S4bKoEgjR16lCS6egZt jTP93/ChR80sEmVBLr/utojVLZt1nMoDb6sTKLDpVzJ4WieuyQFGCMUe0KbSsTGj bFnb8SAlrU0xLgUz6CwJzPhS519aAV5yZEMzdr5YeHc1EqMII5LZnFHHCaX9ADb3 MlnAtnx9OTMRQpcGJZvcS3GI7Dj91pKNBt03dcV9MWE0558rc4k= =UC09 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-08-20-2025-3 macOS Sequoia 15.6.1
by Apple Product Security via Security-announce 21 Aug '25

21 Aug '25

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-20-2025-3 macOS Sequoia 15.6.1 macOS Sequoia 15.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/124927. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. ImageIO Available for: macOS Sequoia Impact: Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2025-43300: Apple macOS Sequoia 15.6.1 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmimYakACgkQ4Ifiq8DH 7PU+VQ//SmtxZzY88BU71akxpdEch9nfXb8AtrhmqU1oYM8l4hD64MvL9+ZH687j 26niAfGjFBkoBM/0BHQeq4hwv7Nfq+DSbZowoXEazZkiMqIpukfqjMbTsfX6yrYw lsdST1nKEfNdpkCfaSrTYRfpW1+DPuSGGzDOmMPE1py/CBl4CwXtiuMeDnhyCiwe rK7y/pXMpsZ9m4fU/Sed9is8wE7Sg3r0LAy2Dx6P9FVCP9754QnNtbtltVA52kxQ 0utq5V1/DxAQs8f29CtYJ22DEEfaYr0D0AdXvadQGBc/JlBE8tevH2g2u6xMykKk CBRxJ/iVDAVX535txpteRm5nkjaO1j9rF9c/wRoDYAbf5lw+4MX8RiqzUgTAnZB1 toQD9XiwvnT/JZYnJOmHa/NG5h4BznWlg9ME518JaVPVoAuFYWlaClIwOy3ia/pc LS1LpMVbqBwOF9uqmUejqXzUnDpXFCtaK7EGolLFP5czI8S147t+yYVgczw7pGQW 2W7su1C+2tJTSMFwQCj47K+bmCeU5diJcuYr15j/To4cG2n5xUfl7DGDISb9aWy6 R3PIwfNPMHsEU4bSklbOiHMMuYGcPUPisROHRIUn/JIFjNegD8Ski2F3JrJaJlR3 xu9xpZBQBPW+dR2d2C2BcE7VoCaAepZpAC/96ltCqQzK/dLF+rQ= =ZQO1 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-08-20-2025-2 iPadOS 17.7.10
by Apple Product Security via Security-announce 21 Aug '25

21 Aug '25

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-20-2025-2 iPadOS 17.7.10 iPadOS 17.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/124926. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. ImageIO Available for: iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation Impact: Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2025-43300: Apple This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iPadOS 17.7.10". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmimYW4ACgkQ4Ifiq8DH 7PWsiA/9FeZRy+Ju0LOJBMHiSnMorT4cidUCCl1IZPT8VhA5DMlhAQRt2CYxuBDO FH+jmLG9wGbn4bYWvGGUm1n0C59i3e/806iz7q3pkGf2yTLbBZ8VrAaXmJyIPDAQ Q+iTjh+i9V5y0JQDkafM72CLdNzOXfidlTQoMSyn3Y69nZ7mnWinrvH3H5F0uLIQ 4fmVYRtvIK9xInz3nRLSf9NJrZhZUPt9/VjGpzQ3SZuAIMkRY1DGawy6REitjVtT NMnJ984fcpwE9vywKfJPdhoVVIBGRVXLT0JpVJoOxSyMArhpF0WJG74I6sbH4BC7 xkQ5rdQGXtnHHScIxDQOR/61dwB1MUH5p3u2J7mJ9MekDz9zY6/+ehQDpkANQHbg rm6/rDUNOgqAkoBAn1dD8np7QQQVFkftsTkmvZOOZHS7QUD05W0crkbAhxg/BiPl uwCIZsGatpCxSRz/Ww7Wgp+Ei60gSxoAnLMjDHKwgBYNff8vKLEDNz4ha4CooWMJ ekcx9q6INkE75EquY2P5DaH2wMAL2wwW8pcmLo9v4oDGE70Cuo5JRr+BRp7LaGbJ jWWOOidzJiuMLxLYKCVgbaLTTJNMlzEBmhTVZ4jJs5kN93NkXICjDWRVmwcuI02S 3tuIa+85QUPQa+o65nWIPdUM6qxq5JB/WMrN0p4Aee/xE3F/eSA= =xUvr -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-08-20-2025-1 iOS 18.6.2 and iPadOS 18.6.2
by Apple Product Security via Security-announce 21 Aug '25

21 Aug '25

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-20-2025-1 iOS 18.6.2 and iPadOS 18.6.2 iOS 18.6.2 and iPadOS 18.6.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/124925. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. ImageIO Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later Impact: Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2025-43300: Apple This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 18.6.2 and iPadOS 18.6.2". All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmimYTQACgkQ4Ifiq8DH 7PVOFA//e/id+fbzn8Td4MWIp9i+gD8pK87zTBgh6SREyzMJatbggeWWgC3z3mdS i7r6NkUOin5ppSTAE55l/iIamFZsiTbTOVcfISys3jkBfklJJDdFUie8XkRmruVe 2tupD1+888S6vVvZ02X1wZwCnT5u0Pza8AKwf9Zg5pHktj/cTzwwCYa6qMCve/Ab CKNA1sqQId4/QG5p7MCfmFcvtGvYDrs+KyNXyNNFgvT27BRmwA2SHeT8EfWvjpv1 IV1DBMR3gTyFc9swKxSd4Ql0+RDnmFvN/PMSYu48+fbjcwAT9eSz1+z/xeKe/7qF JHXitUxo5W34J6xwhDgaS9/45unLU8JERSXf/yOd5QBMR0/WYiS5fb7Z9K3fZJkK c5PRnB5CBBnF4EYxmiHmqgpKYXDusrzyUi6Uq3BE86jw2tBjXaiqKITxDpfxeRj8 O8Wnb9T7sBGaV6Hs6WhTFYeEJPX0gDYRuVHvjI3YNWklyKsZI3oCPoZ8dfiiUSPy iMMSrfyVD3RS9K1s34XYTRIciT6H0l/wX4mYh3cV3D4CGexuVytOJ5TeDu9u9I+y pbPAKYTvpraUl+AYgR7b+9eG282+elmKRhGuGayVf1B1duChyPqDIvjP24EWnY+x WF4mVbJqCqE5F1nh334qiJPm10pjmxkkgNKN8m1jQznUrFkufGk= =mpw8 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0