site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-12-6-4 tvOS 11.2 tvOS 11.2 addresses the following: IOSurface Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13861: Ian Beer of Google Project Zero Kernel Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13862: Apple CVE-2017-13876: Ian Beer of Google Project Zero Kernel Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to read restricted memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2017-13833: Brandon Azad Kernel Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to read restricted memory Description: A type confusion issue was addressed with improved memory handling. CVE-2017-13855: Jann Horn of Google Project Zero Kernel Available for: Apple TV 4K and Apple TV (4th generation) Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13867: Ian Beer of Google Project Zero Kernel Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13865: Ian Beer of Google Project Zero CVE-2017-13868: Brandon Azad CVE-2017-13869: Jann Horn of Google Project Zero Wi-Fi Available for: Apple TV (4th generation) Released for Apple TV 4K in tvOS 11.1. Impact: An attacker in Wi-Fi range may force nonce reuse in WPA multicast/GTK clients (Key Reinstallation Attacks - KRACK) Description: A logic issue existed in the handling of state transitions. This was addressed with improved state management. CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU Leuven Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN+kpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEZUug// RGywQvg+ks1/IDLXTWLlGUuXJIaAr0Gtkd6iToG+x9GdwwWVkwxMJhS/7GxqRbOt eg8o81VGO6tWYKh2LIuHTpc7s7/vYT3icFM794ghwsgq7uyPp8nF5AWcT29ne2C/ lV+rcpo/fWExVa5wFCb9lkDzTOStqhDO33zbhrcCs9P5cjCE+aPaSeqdOi50/BlZ /LmlOIUAPpAr5k5DeuAxO93KzVSFFQF7cT9oH7f+2SVsWyW1+K6QKuKjaeNjA7nk Ff3vGOCJsHpjnWK2E1JEZUunWwXcoSNhFfLSMQMxaIrZRu02THn4aeCmerzC9mr0 eJDWCijsvnJXBMgeqcdlRmx2aaN//NCUU9vE6Uwpg6whjSb6/s48iyj4Lc/8aKO7 5TEOqMJu3JmzP2dTvVRtxQVfnsgOm/YHw5qHJepG8nHbZCq2GBFRsS1jc7+9PZ81 V206C97GQAlcDQlv1T+oMnwaDJJ0rwfRIeEXQXaTloHUt5sQU3MeBBXH2NL2ZsPD 4bxTz5BPshi07fkqmDXQ3pTxztaorD25l4vt4e1KF20JH4R75ijZWe1HpNMC3UqA Mi+Lv8Wq2SkS7URBtlT+WxO8S7aZO1SPFBXjtUhwAfc/NHodP4cnyYkacGvYwPhm 5jHu7bnSkO9BmQnCYKSkxMHOrOPxYZjHMUISFC6M4CA= =OsEg -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com