bugtraq - APPLE-SA-2015-10-21-2 watchOS 2.0.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 21 Oct 2015 10:48:49 -0700
From: Apple Product Security <product-security-noreply@...ts.apple.com>
To: security-announce@...ts.apple.com
Subject: APPLE-SA-2015-10-21-2 watchOS 2.0.1


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2015-10-21-2 watchOS 2.0.1

watchOS 2.0.1 is now available and addresses the following:

Apple Pay
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  Some cards may allow a terminal to retrieve limited recent
transaction information when making a payment
Description:  The transaction log functionality was enabled in
certain configurations. This issue was addressed by removing the
transaction log functionality. This update additionally addresses the
issue for Apple Watches manufactured with watchOS 2.
CVE-ID
CVE-2015-5916

Bom
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  Unpacking a maliciously crafted archive may lead to
arbitrary code execution
Description:  A file traversal vulnerability existed in the handling
of CPIO archives. This issue was addressed through improved
validation of metadata.
CVE-ID
CVE-2015-7006 : Mark Dowd at Azimuth Security

configd
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  A malicious application may be able to elevate privileges
Description:  A heap based buffer overflow issue existed in the DNS
client library. A local user with the ability to spoof responses from
the local configd service may have been able to cause arbitrary code
execution in DNS clients.
CVE-ID
CVE-2015-7015 : PanguTeam

CoreGraphics
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  Processing a maliciously crafted image may lead to arbitrary
code execution
Description:  A memory corruption issue existed in CoreGraphics. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5925 : Apple
CVE-2015-5926 : Apple

FontParser
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  Viewing a document with a maliciously crafted font may lead
to arbitrary code execution
Description:  Multiple memory corruption issues existed in the
handling of font files. These issues were addressed through improved
bounds checking.
CVE-ID
CVE-2015-5927 : Apple
CVE-2015-5942

Grand Central Dispatch
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  Processing a maliciously crafted package may lead to
arbitrary code execution
Description:  A memory corruption issue existed in the handling of
dispatch calls. This issue was addressed through improved memory
handling.
CVE-ID
CVE-2015-6989 : Apple

ImageIO
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  Viewing a maliciously crafted image file may lead to
arbitrary code execution
Description:  Multiple memory corruption issues existed in the
parsing of image metadata. These issues was addressed through
improved metadata validation.
CVE-ID
CVE-2015-5935 : Apple
CVE-2015-5936 : Apple
CVE-2015-5937 : Apple
CVE-2015-5939 : Apple

IOAcceleratorFamily
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  A malicious application may be able to execute arbitrary
code with system privileges
Description:  A memory corruption issue existed in
IOAcceleratorFamily. This issue was addressed through improved memory
handling.
CVE-ID
CVE-2015-6996 : Ian Beer of Google Project Zero

IOHIDFamily
Available for:  Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact:  A malicious application may be able to execute arbitrary
code with kernel privileges
Description:  A memory corruption issue existed in the kernel. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2015-6974 : Luca Todesco (@qwertyoruiop)

Installation note:

Instructions on how to update your Apple Watch software are
available at https://support.apple.com/en-us/HT204641

To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".

Alternatively, on your watch, select "My Watch > General > About".


Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJWJuKhAAoJEBcWfLTuOo7tkBcP+QGVb0FmXmyDjPNF1b3Mx4Cv
2gPz3W6x1BQlss3/2+WX8YAMXgtGux0HQfYF/uQIjverf+HHlGDN2bd+P61odDEp
hEU2h6N6bPbDp85MehTgZWt8/c6HR5XB2KFKNAXhE6YmrZ8neXBYLF+sF9T9NMx0
ar2/yWFlCVFTgDHzt4KGFJFjNDr8urHNp0nc4KjOE7YE83oK9vkAxmqOhpPNNzdj
DIob8y1wO4NBoClzXr8DIlqoajFEWLXU++G6MVclhCoWun+vQpUo3XcOG7mJgoff
nrb9ITbsEXtpKLeHYPdK7y7EMWOasVb2GPkK3TWEc37wf2eEk2cUSHRN6bjeIsJO
WWVqGC8+Ya7eQgsztUlfUMK8OFNX9wz9CABB/wBNbYe1fzea+oZV7ijCR6IzOi6I
5xFEDCxSOnDMSn3uF/ENRk5LG7DC0PsL/Er/H2tSit9oacEGmoozyUdGlexG4o+a
pySDBLiplfVjdfoPv8ABQSN6mtvD1MaLVVAoG14FEObEEY/tdl22Ou8NZQ6OgeLl
I2uyMSPQDGMKXNxjIfgWTWK31TQakq3c78swlXy9fZrCWl/ti8y6CFUVqP8XOjN9
LgkJcChm77UXsiFCKqREMw/kgSDvctF94iMknUBc1+YDj+uDs+t9vvUzZ3syFC0V
4bPj6XOJcceSHv1+PlcF
=gtL/
-----END PGP SIGNATURE-----