site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-1-23-3 watchOS 4.2.2 watchOS 4.2.2 is now available and addresses the following: Audio Available for: All Apple Watch models Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and Taekyoung Kwon of the Information Security Lab, Yonsei University Core Bluetooth Available for: All Apple Watch models Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team Kernel Available for: All Apple Watch models Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed through improved memory handling. CVE-2018-4090: Jann Horn of Google Project Zero Kernel Available for: All Apple Watch models Impact: An application may be able to read restricted memory Description: A race condition was addressed through improved locking. CVE-2018-4092: an anonymous researcher Kernel Available for: All Apple Watch models Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4082: Russ Cox of Google Kernel Available for: All Apple Watch models Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4093: Jann Horn of Google Project Zero LinkPresentation Available for: All Apple Watch models Impact: Processing a maliciously crafted text message may lead to application denial of service Description: A resource exhaustion issue was addressed through improved input validation. CVE-2018-4100: Abraham Masri (@cheesecakeufo) QuartzCore Available for: All Apple Watch models Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of web content. This issue was addressed through improved input validation. CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day Initiative Security Available for: All Apple Watch models Impact: A certificate may have name constraints applied incorrectly Description: A certificate evaluation issue existed in the handling of name constraints. This issue was addressed through improved trust evaluation of certificates. CVE-2018-4086: Ian Haken of Netflix WebKit Available for: All Apple Watch models Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4088: Jeonghoon Shin of Theori CVE-2018-4096: found by OSS-Fuzz Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng7kpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEaXoQ/7 BjxNf3VDcmJJo5kOl/HK1W/pjwEGpoE/UN/PiMii/IyAhnHRUFZqHtDDZpl7WU9v EKYFSuK6JPkiYfT5cx5jQzw54x2qR7g0r8E2MmsnrlDkMyF/ucj93FEiBJqAIzTn uPYa5rV+rZLBhuERjyh69u0oXciklxkjtl1z7Gf+eL/GJWmOtcwrvnmiKPwTLHld tPmxJ1YHM7360rQ11zSB0wmZzOBO187Y3FrwqD7VH1woeWmt0Wkv+k7I6Z/6E4pM kniC001tlPAuW03OwXWtgp1gNCIz7MyHLpw93mRoyHabAy6puTpDJEmAQWIpMzbP uiZDpcn7grclubTetkDy4WmbuVvSTSOuOjseZlqaJ6l9vZv2bnOfT7M9mRRHxsns Rt1X/F1EgMNqcS7FnnYFqiun1fX1fEiyJedBa7FuN1HTIIFtx5ehMnqlxyd+yy3+ tTt55pW/KWY6+fRDKWMobyHYSBR75kdSVKGLLQEahkwOZnKOjgHaaaH5XZCRUbCg u0wuHvhDahUsEEYEpgrlwDyFniLeMTfpju22FPx6DhPzbAEGszCRI5tnHLGk6Tza EQnH9hEaSqIgTgrYHyYtK6Gh/U73pAC2XVfUDPNHpnyNTx055cSL/VZxq+KHe3Xh 2ncf97zYLPAMudrPRlzNy04cwqE7aNTimcDd0WENk0o= =afZh -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com