site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-29-2025-7 tvOS 18.6 tvOS 18.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/124153. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. afclip Available for: Apple TV HD and Apple TV 4K (all models) Impact: Parsing a file may lead to an unexpected app termination Description: The issue was addressed with improved memory handling. CVE-2025-43186: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CFNetwork Available for: Apple TV HD and Apple TV 4K (all models) Impact: A non-privileged user may be able to modify restricted network settings Description: A denial-of-service issue was addressed with improved input validation. CVE-2025-43223: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CoreAudio Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted audio file may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2025-43277: Google's Threat Analysis Group CoreMedia Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2025-43210: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreMedia Playback Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access user-sensitive data Description: The issue was addressed with additional permissions checks. CVE-2025-43230: Chi Yuan Chang of ZUSO ART and taikosoup ICU Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2025-43209: Gary Kwong working with Trend Micro Zero Day Initiative ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2025-43226 libxml2 Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a file may lead to memory corruption Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-7425: Sergei Glazunov of Google Project Zero libxslt Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to memory corruption Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-7424: Ivan Fratric of Google Project Zero Metal Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2025-43234: Vlad Stolyarov of Google's Threat Analysis Group Model I/O Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2025-43224: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative CVE-2025-43221: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative Model I/O Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An input validation issue was addressed with improved memory handling. CVE-2025-31281: Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may disclose sensitive user information Description: This issue was addressed through improved state management. WebKit Bugzilla: 292888 CVE-2025-43227: Gilad Moav WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 291742 CVE-2025-31278: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei WebKit Bugzilla: 291745 CVE-2025-31277: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei WebKit Bugzilla: 293579 CVE-2025-31273: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 292599 CVE-2025-43214: shandikri working with Trend Micro Zero Day Initiative, Google V8 Security Team WebKit Bugzilla: 292621 CVE-2025-43213: Google V8 Security Team WebKit Bugzilla: 293197 CVE-2025-43212: Nan Wang (@eternalsakura13) and Ziling Chen WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing web content may lead to a denial-of-service Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 293730 CVE-2025-43211: Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may disclose internal states of the app Description: An out-of-bounds read was addressed with improved input validation. WebKit Bugzilla: 294182 CVE-2025-43265: HexRabbit (@h3xr4bb1t) from DEVCORE Research Team WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 295382 CVE-2025-43216: Ignacio Sanmillan (@ulexec) WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. WebKit Bugzilla: 296459 CVE-2025-6558: Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group Additional recognition Bluetooth We would like to acknowledge LIdong LI, Xiao Wang, Shao Dong Chen, and Chao Tan of Source Guard for their assistance. CoreAudio We would like to acknowledge Noah Weinberg for their assistance. libxml2 We would like to acknowledge Sergei Glazunov of Google Project Zero for their assistance. libxslt We would like to acknowledge Ivan Fratric of Google Project Zero for their assistance. WebKit We would like to acknowledge Google V8 Security Team, Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei, rheza (@ginggilBesel) for their assistance. Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About.“ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmiJVswACgkQX+5d1TXa IvqMNA//a5NudwGpWRYvkl/mJGxEXbdP/5/3FhjeKRUu0JzugNR3f/5btGLfIKkf JOYjG85Vt4l84V98lMwoeKHJAcMlc2fHImGiRGjDaulak4WQru6Hgl9D4bseEZBG 5hUWmFaTUtBQbqG8Ju/54KEWe7NAxC+BvcFuFVnUyiewwKJUUdv2d5R6vwB19L7E N6Ci0pFmqunP6Oe9WpoUWTvMqMAyHr6Xy19vHmQVP6753G33goaxF9t+fmLGGAQD B4s2KQ3tt1W45Cnv0oEoaHXtvphaKW7vX1F+tjNSMNgS1c89JVGrW+jdOm6kT2+M AhRvzbuQAyVy03D9lgym+kVw2kUMA0qtsOx9QVeYiZ5J5SklbVLlNwD9dm8SK5av 6IGi5hrMeqIA4KhbTLiohndhGU+noxCx0qOGxUaKTAgpni0opZFIXg/TinFO67dX AGbsFyMs582UO7nU1sbZ7XHcX9aGNsr+B+nfrVBEvbIZSYUJrCD2HCuqLH9q2RwK +tAVS8w3hY2bSK3KuMEHWGMm2nnePa1lez0gXFAwgbZFmOFD/dY+I5TraPj8cwme TwmckQjh8n32HeURmbEO4C/yGYVoYb4nDrtLX53rv4SeGzffNIW9eo1xonTti8PM zVdWOYvG+mlI+bHxU/C1KR6mxMO3fHKSbGYiT6iTa5TWh8isKfI= =znLI -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com