full-disclosure - [FD] APPLE-SA-2019-12-10-6 Safari 13.0.4

Open Source and information security mailing list archives

Message-id: <F00FF3A6-70D4-45B0-AD6B-C2B8BE8A5F3B@lists.apple.com>
Date: Tue, 10 Dec 2019 15:55:42 -0800
From: Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-2019-12-10-6 Safari 13.0.4

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2019-12-10-6 Safari 13.0.4

Safari 13.0.4 is now available and addresses the following:

WebKit
Available for: macOS Mojave and macOS High Sierra, and included in
macOS Catalina
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2019-8835: Anonymous working with Trend Micro's Zero Day
Initiative, Mike Zhang of Pangu Team
CVE-2019-8844: William Bowling (@wcbowling)

WebKit
Available for: macOS Mojave and macOS High Sierra, and included in
macOS Catalina
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2019-8846: Marcin Towalski of Cisco Talos

Installation note:

Safari 13.0.4 may be obtained from the Mac App Store.

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl3wFpAACgkQBz4uGe3y
0M247Q/+Puog9fznddnmX6AZlC0w3fZp1LcCKASKbl3OKeZZMssSCiVxcbnIzcgL
ftYqaOKsSPDHbuKi0myMYLt3gnkmtq1lGTtW85ytSLNeR+2W/+dzmtfMelqS+wwG
kQh4V/R1oTFpU/p/oI3bH2kEJGqj+npwNML2zeW2UclcWdFNkWfO0hvEWj2eKFwT
HyqmyRLZoGjX6qsZ0sPpwnVXXnsedUfHOdxRvjw8Wwp4DSRt1ockAs0Mh7nUy86X
CVB/Adlmd9LPLqRPWG5dec/d6+yG/bGhD+uM92pNor6hvvZhhCisMFrGOwezxNGJ
HNFbIOJpMLYoOGlydSIHzdJseEEyD0dQwtkHdsLkR3+Sc59uMXF/Ah13cW0n+9pw
h6MNPo9e2K8w+Ocgd+0e6B0uknyKeRHzTQ7Y4TUIXYqV5GSNEMpQU9cxnNTJgk1t
RZesiLWbttWzdg2dx8kGlljTJYp4wb3yN5idE1BfsXZz0DoHKa1VBPZpSUUvYpx+
kUMY5gfLPNgGCQtd4IzFzVnNcfh34j2tvBWbr8QSKygWjaN746r1zeibTp8XE43/
RLDvlF4IF6QRWZd2UbFLH2PSjNvc4EgPA1gRHmWvFVrK7eZznLD1EZbB1jI1TRPE
hHCt7lmK8DdN9stVkt3pNQoT1Tukh2kIi+gnt6+Qh4Yyo5Jdo7A=
=LKd0
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives