site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043 Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. CVE-2020-3840: @littlelailo Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit) Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3855: Csaba Fitzl (@theevilbit) Wi-Fi Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com