site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-09-26-2023-8 watchOS 10 watchOS 10 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT213937. Apple maintains a Security Updates page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. App Store Available for: Apple Watch Series 4 and later Impact: A remote attacker may be able to break out of Web Content sandbox Description: The issue was addressed with improved handling of protocols. CVE-2023-40448: w0wbox Apple Neural Engine Available for devices with Apple Neural Engine: Apple Watch Series 9 and Apple Watch Ultra 2 Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2023-40432: Mohamed GHANNAM (@_simo36) CVE-2023-41174: Mohamed GHANNAM (@_simo36) CVE-2023-40409: Ye Zhang (@VAR10CK) of Baidu Security CVE-2023-40412: Mohamed GHANNAM (@_simo36) Apple Neural Engine Available for devices with Apple Neural Engine: Apple Watch Series 9 and Apple Watch Ultra 2 Impact: An app may be able to execute arbitrary code with kernel privileges Description: A use-after-free issue was addressed with improved memory management. CVE-2023-41071: Mohamed GHANNAM (@_simo36) Apple Neural Engine Available for devices with Apple Neural Engine: Apple Watch Series 9 and Apple Watch Ultra 2 Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2023-40399: Mohamed GHANNAM (@_simo36) Apple Neural Engine Available for devices with Apple Neural Engine: Apple Watch Series 9 and Apple Watch Ultra 2 Impact: An app may be able to disclose kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2023-40410: Tim Michaud (@TimGMichaud) of Moveworks.ai AuthKit Available for: Apple Watch Series 4 and later Impact: An app may be able to access user-sensitive data Description: The issue was addressed with improved handling of caches. CVE-2023-32361: Csaba Fitzl (@theevilbit) of Offensive Security Bluetooth Available for: Apple Watch Series 4 and later Impact: An attacker in physical proximity can cause a limited out of bounds write Description: The issue was addressed with improved checks. CVE-2023-35984: zer0k bootp Available for: Apple Watch Series 4 and later Impact: An app may be able to read sensitive location information Description: A privacy issue was addressed with improved private data redaction for log entries. CVE-2023-41065: Adam M., and Noah Roskin-Frazee and Professor Jason Lau (ZeroClicks.ai Lab) CFNetwork Available for: Apple Watch Series 4 and later Impact: An app may fail to enforce App Transport Security Description: The issue was addressed with improved handling of protocols. CVE-2023-38596: Will Brattain at Trail of Bits CoreAnimation Available for: Apple Watch Series 4 and later Impact: Processing web content may lead to a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2023-40420: 이준성(Junsung Lee) of Cross Republic Dev Tools Available for: Apple Watch Series 4 and later Impact: An app may be able to gain elevated privileges Description: This issue was addressed with improved checks. CVE-2023-32396: Mickey Jin (@patch1t) Game Center Available for: Apple Watch Series 4 and later Impact: An app may be able to access contacts Description: The issue was addressed with improved handling of caches. CVE-2023-40395: Csaba Fitzl (@theevilbit) of Offensive Security Kernel Available for: Apple Watch Series 4 and later Impact: An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations Description: The issue was addressed with improved memory handling. CVE-2023-41981: Linus Henze of Pinauten GmbH (pinauten.de) Kernel Available for: Apple Watch Series 4 and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2023-41984: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: Apple Watch Series 4 and later Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with improved validation. CVE-2023-40429: Michael (Biscuit) Thomas and 张师傅(@京东蓝军) libpcap Available for: Apple Watch Series 4 and later Impact: A remote user may cause an unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2023-40400: Sei K. libxpc Available for: Apple Watch Series 4 and later Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with additional restrictions. CVE-2023-40454: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (xlab.tencent.com) libxpc Available for: Apple Watch Series 4 and later Impact: An app may be able to access protected user data Description: An authorization issue was addressed with improved state management. CVE-2023-41073: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab (xlab.tencent.com) libxslt Available for: Apple Watch Series 4 and later Impact: Processing web content may disclose sensitive information Description: The issue was addressed with improved memory handling. CVE-2023-40403: Dohyun Lee (@l33d0hyun) of PK Security Maps Available for: Apple Watch Series 4 and later Impact: An app may be able to read sensitive location information Description: The issue was addressed with improved handling of caches. CVE-2023-40427: Adam M., and Wojciech Regula of SecuRing (wojciechregula.blog) MobileStorageMounter Available for: Apple Watch Series 4 and later Impact: A user may be able to elevate privileges Description: An access issue was addressed with improved access restrictions. CVE-2023-41068: Mickey Jin (@patch1t) Passcode Available for: Apple Watch Ultra (all models) Impact: An Apple Watch Ultra may not lock when using the Depth app Description: An authentication issue was addressed with improved state management. CVE-2023-40418: serkan Gurbuz Photos Storage Available for: Apple Watch Series 4 and later Impact: An app may be able to access edited photos saved to a temporary directory Description: The issue was addressed with improved checks. CVE-2023-40456: Kirin (@Pwnrin) CVE-2023-40520: Kirin (@Pwnrin) Safari Available for: Apple Watch Series 4 and later Impact: An app may be able to identify what other apps a user has installed Description: The issue was addressed with improved checks. CVE-2023-35990: Adriatik Raci of Sentry Cybersecurity Safari Available for: Apple Watch Series 4 and later Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: A window management issue was addressed with improved state management. CVE-2023-40417: Narendra Bhati From Suma Soft Pvt. Ltd. Sandbox Available for: Apple Watch Series 4 and later Impact: An app may be able to overwrite arbitrary files Description: The issue was addressed with improved bounds checks. CVE-2023-40452: Yiğit Can YILMAZ (@yilmazcanyigit) Share Sheet Available for: Apple Watch Series 4 and later Impact: An app may be able to access sensitive data logged when a user shares a link Description: A logic issue was addressed with improved checks. CVE-2023-41070: Kirin (@Pwnrin) Simulator Available for: Apple Watch Series 4 and later Impact: An app may be able to gain elevated privileges Description: The issue was addressed with improved checks. CVE-2023-40419: Arsenii Kostromin (0x3c3e) StorageKit Available for: Apple Watch Series 4 and later Impact: An app may be able to read arbitrary files Description: This issue was addressed with improved validation of symlinks. CVE-2023-41968: Mickey Jin (@patch1t) and James Hutchins TCC Available for: Apple Watch Series 4 and later Impact: An app may be able to access user-sensitive data Description: The issue was addressed with improved checks. CVE-2023-40424: Arsenii Kostromin (0x3c3e), Joshua Jewett (@JoshJewett33), and Csaba Fitzl (@theevilbit) of Offensive Security WebKit Available for: Apple Watch Series 4 and later Impact: Processing web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 249451 CVE-2023-39434: Francisco Alonso (@revskills), and Dohyun Lee (@l33d0hyun) of PK Security WebKit Available for: Apple Watch Series 4 and later Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved checks. WebKit Bugzilla: 256551 CVE-2023-41074: 이준성(Junsung Lee) of Cross Republic and me Li WebKit Available for: Apple Watch Series 4 and later Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 239758 CVE-2023-35074: Abysslab Dong Jun Kim(@smlijun) and Jong Seong Kim(@nevul37) Additional recognition Airport We would like to acknowledge Adam M., and Noah Roskin-Frazee and Professor Jason Lau (ZeroClicks.ai Lab) for their assistance. Audio We would like to acknowledge Mickey Jin (@patch1t) for their assistance. Bluetooth We would like to acknowledge Jianjun Dai and Guang Gong of 360 Vulnerability Research Institute for their assistance. Books We would like to acknowledge Aapo Oksman of Nixu Cybersecurity for their assistance. Control Center We would like to acknowledge Chester van den Bogaard for their assistance. Data Detectors UI We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi Narain College Of Technology Bhopal for their assistance. Find My We would like to acknowledge Cher Scarlett for their assistance. Home We would like to acknowledge Jake Derouin (jakederouin.com) for their assistance. Kernel We would like to acknowledge Bill Marczak of The Citizen Lab at The University of Toronto's Munk School, Maddie Stone of Google's Threat Analysis Group, and 永超 王 for their assistance. libxml2 We would like to acknowledge OSS-Fuzz, and Ned Williamson of Google Project Zero for their assistance. libxpc We would like to acknowledge an anonymous researcher for their assistance. libxslt We would like to acknowledge Dohyun Lee (@l33d0hyun) of PK Security, OSS-Fuzz, and Ned Williamson of Google Project Zero for their assistance. NSURL We would like to acknowledge Zhanpeng Zhao (行之) and 糖豆爸爸(@晴天组织) for their assistance. Photos We would like to acknowledge Dawid Pałuska and Kirin (@Pwnrin) for their assistance. Photos Storage We would like to acknowledge Wojciech Regula of SecuRing (wojciechregula.blog) for their assistance. Power Services We would like to acknowledge Mickey Jin (@patch1t) for their assistance. Shortcuts We would like to acknowledge Alfie Cockell Gwinnett, Christian Basting of Bundesamt für Sicherheit in der Informationstechnik, Cristian Dinca of "Tudor Vianu" National High School of Computer Science, Romania, Giorgos Christodoulidis, Jubaer Alnazi of TRS Group Of Companies, KRISHAN KANT DWIVEDI, and Matthew Butler for their assistance. Software Update We would like to acknowledge Omar Siman for their assistance. StorageKit We would like to acknowledge Mickey Jin (@patch1t) for their assistance. WebKit We would like to acknowledge Khiem Tran, Narendra Bhati From Suma Soft Pvt. Ltd, and an anonymous researcher for their assistance. Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJkACgkQX+5d1TXa Ivo3WhAA1an2sh+qEnBj7zKhCx64vpUB3B6ET0lh+vMjHwu3Z7ThtdEnjwUgs1SA 5zzj3Jsf8Zb/ivyQ+jfI5IyUZxCT+sWn3t3CHN4jb1LTsxL/h9mrP42U01GTooju erIvHarH2gk/Qew99cPPok7MpyNVPmRfJ3juEIZOe4CjsKLsWz6HRsiIQE/nvMta NUIiF6/VTzdynDEFlK7iUWS31N2nN3pLhUFwOdKz1t1lCKpWBYsSPPms6nmFLeWJ 3rfyDPzupAQxfhldfgdBpQvYzYiDpqRNUBrFJCKG8BaKpv87AZI7NKgNv4WYNWP9 0P3IIIAvGVpCmNcjGl18K9hiigXfs+U0QPA6DD2O2hnsUmiUbLnEc4BpkK5KO+y1 uteIDhV8IsN4n86h9IGY2nImJtbUSADhsIRkwdbI8Z80q4zLYteKuj83FztVgSx2 /C382yyFqMZA8DnSy+CNbCp5AsHOPAgeC+sTvnLlPfPAyJMMSyoQk8S1ARx6fqog TEu8GPqOWjyol8gKTTnEqufLF+lmJbNxxAKLXt7rhpiy8Bl4GUYIooKta32MshVU fsoujI+xVfsGwev0QZIPa+ElCMj8r2GhHqBZ+ceifRhMPBJ/UcnP6Y+ekg26pVnI CbJ+Aj4WU3KKRdpKWP6TT8eIOq6tvYYMJKCylCVKFeEGkpB7sEE= =TnBb -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com