site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-01-26-6 watchOS 8.4 watchOS 8.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213059. ColorSync Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2022-22584: Mickey Jin (@patch1t) of Trend Micro Crash Reporter Available for: Apple Watch Series 3 and later Impact: A malicious application may be able to gain root privileges Description: A logic issue was addressed with improved validation. CVE-2022-22578: an anonymous researcher iCloud Available for: Apple Watch Series 3 and later Impact: An application may be able to access a user's files Description: An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. CVE-2022-22585: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (https://xlab.tencent.com) Kernel Available for: Apple Watch Series 3 and later Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow issue was addressed with improved memory handling. CVE-2022-22593: Peter Nguyễn Vũ Hoàng of STAR Labs WebKit Available for: Apple Watch Series 3 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2022-22590: Toan Pham from Team Orca of Sea Security (security.sea.com) WebKit Available for: Apple Watch Series 3 and later Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A logic issue was addressed with improved state management. CVE-2022-22592: Prakash (@1lastBr3ath) WebKit Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted mail message may lead to running arbitrary javascript Description: A validation issue was addressed with improved input sanitization. CVE-2022-22589: Heige of KnownSec 404 Team (knownsec.com) and Bo Qu of Palo Alto Networks (paloaltonetworks.com) WebKit Storage Available for: Apple Watch Series 3 and later Impact: A website may be able to track sensitive user information Description: A cross-origin issue in the IndexDB API was addressed with improved input validation. CVE-2022-22594: Martin Bajanik of FingerprintJS Additional recognition WebKit We would like to acknowledge Prakash (@1lastBr3ath) for their assistance. Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmHx1EsACgkQeC9qKD1p rhjBEw//T3hH2N6vYXFcWWk5QghcWMWGnacDNTlkcYKNdGP8STbqHo62PyPIxDca FnVobVePJqhiXULtoRn+WZ2PynkrH6FRmBeeNnbjk85mBoU8Xm0rMpz5IjX7kjfh NvRCrnEKbRg8/702k2TvXK0n4dV7erYs+d4UKdA+e20OggtQldW2cmtTTBjCIq1X +kjF8PF4di3esNNt1gI8c3zLwGw7BVyUkQqgKek7rBJzFt8m1hnOLh62giGOrf8j D7UA6M3QAkiFF4+K2NU/t1PrdW7quUFszhO+NTdvx+9VCu7vFsPjIX1M1Rp7NllR E+Y96PxMhjHVA2Re0+wPIK6R2QJ8aTc9VhZrotJyplmG2XyVWUS7sJxLrRP7Nwt9 ivuswd1Mg1RBeJDa8k5AX9+CqaFTbm0J82VVtts0mEtkdJYsRoviCCwRx4Kh41uE hEUbVFUmR/fn+JVbV1IckeEcO1y/ge/m5I/PfxErZDqXgNuGtbdo6fyCNDi+D74i 9RkOnX/3T3kloifWCD+xGAbVeml1fnznrATIweeqMpStf7DWuDJGZWliQNdWaAVM rW9wAkL73WndDuwf2A57zU6MPBigU+arO1EzgGWAUPfBIMhjE0wr8V18HSY0lDqJ maEKhALSG7d0J/FBrfG9I9yH9DKoFxM79JkIZa+yF8qqhkrxesc= =+J9t -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com