-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-07-2024-7 visionOS 1.1 visionOS 1.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/kb/HT214087. Apple maintains a Security Releases page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. Accessibility Available for: Apple Vision Pro Impact: An app may be able to spoof system notifications and UI Description: This issue was addressed with additional entitlement checks. CVE-2024-23262: Guilherme Rambo of Best Buddy Apps (rambo.codes) ImageIO Available for: Apple Vision Pro Impact: Processing an image may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2024-23257: Junsung Lee working with Trend Micro Zero Day Initiative ImageIO Available for: Apple Vision Pro Impact: Processing an image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2024-23258: Zhenjiang Zhao of pangu team and Qianxin ImageIO Available for: Apple Vision Pro Impact: Processing an image may lead to arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2024-23286: Dohyun Lee (@l33d0hyun) Kernel Available for: Apple Vision Pro Impact: An app may be able to access user-sensitive data Description: A race condition was addressed with additional validation. CVE-2024-23235 Kernel Available for: Apple Vision Pro Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A memory corruption vulnerability was addressed with improved locking. CVE-2024-23265: Xinru Chi of Pangu Lab Kernel Available for: Apple Vision Pro Impact: An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited. Description: A memory corruption issue was addressed with improved validation. CVE-2024-23225 Metal Available for: Apple Vision Pro Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2024-23264: Meysam Firouzi @R00tkitsmm working with Trend Micro Zero Day Initiative Persona Available for: Apple Vision Pro Impact: An unauthenticated user may be able to use an unprotected Persona Description: A permissions issue was addressed to help ensure Personas are always protected CVE-2024-23295: Patrick Reardon RTKit Available for: Apple Vision Pro Impact: An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited. Description: A memory corruption issue was addressed with improved validation. CVE-2024-23296 Safari Available for: Apple Vision Pro Impact: An app may be able to fingerprint the user Description: The issue was addressed with improved handling of caches. CVE-2024-23220 UIKit Available for: Apple Vision Pro Impact: An app may be able to break out of its sandbox Description: This issue was addressed by removing the vulnerable code. CVE-2024-23246: Deutsche Telekom Security GmbH sponsored by Bundesamt für Sicherheit in der Informationstechnik WebKit Available for: Apple Vision Pro Impact: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 259694 CVE-2024-23226: Pwn2car WebKit Available for: Apple Vision Pro Impact: A malicious website may exfiltrate audio data cross-origin Description: The issue was addressed with improved UI handling. WebKit Bugzilla: 263795 CVE-2024-23254: James Lee (@Windowsrcer) WebKit Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A logic issue was addressed with improved validation. WebKit Bugzilla: 264811 CVE-2024-23263: Johan Carlsson (joaxcar) WebKit Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: A logic issue was addressed with improved state management. WebKit Bugzilla: 267241 CVE-2024-23284: Georg Felber and Marco Squarcina Additional recognition Kernel We would like to acknowledge Tarek Joumaa (@tjkr0wn) and 이준성(Junsung Lee) for their assistance. Model I/O We would like to acknowledge Junsung Lee for their assistance. Power Management We would like to acknowledge Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. for their assistance. Safari We would like to acknowledge Abhinav Saraswat, Matthew C, and 이동하 ( Lee Dong Ha of ZeroPointer Lab ) for their assistance. WebKit We would like to acknowledge Valentino Dalla Valle, Pedro Bernardo, Marco Squarcina, and Lorenzo Veronese of TU Wien for their assistance. Instructions on how to update visionOS are available at https://support.apple.com/kb/HT214009 To check the software version on your Apple Vision Pro, open the Settings app and choose General > About. All information is also posted on the Apple Security Releases web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmXqch0ACgkQX+5d1TXa Ivp/nA//XUiuB8BB/bRbBd0c9z/0DScN1cEWhZaAiWh7HGiOji+HjUv3GocXDHTh 65MqZ3y4C08Qr5qDNzZOnaTUZgbk+h3Pz62SoSS0deI3xp1uNpHsmtSqMh6Qs30I /IMBpmBuyqoL6w9KBSAubqsrwT/SVQuz67yMCSNUQ27KL3Dymf1JFKf+oaKYTC5R TRrmZ1yzWkvziGYYsjUR+G+HiwnQza/39sFOu7Eezkv+lqtQcP1v2eFRporxqvDX QejHf4mUIqNZs9KSe7z2uguRlMTbAaaOFt0UCXHhXXifQK9fmrOP9vKofAiy7S54 NDuSa6gZzKvakC0VxUozGZaFhVocDDbWOBrH6eLI3RTR59sl5RXv4cFTZXp5Xfy4 4xj99QM/zXb75TnPTWPlCJ9E2CfmFtfTRDa7wgZgeRL2dfHihaCV7/p28m8vdOAS QDbOBlReS27zwOcxVUSo+LcPvymve7ObCUc+ITwHW7V3Uq92mKfYmbv99ovxQGNB 9LAChqBoYfWTbUAfP9/cvY++543CAE5xmzSIfnmFEH04ZA2Fh4Gc6mmo1W3Q24Hx QwhV1agy52x2t4g+BABQSNkwLDkS9yGj/SNqz1fknVyFoKry0tZAdXGM51PwQvV1 7BnKw3PgU0EZK135spUgfhRBbemWfoISY9t/QqA2RCp9hiEsXZA= =pp0o -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/rcloke%40apple.com This email sent to rcloke@apple.com