Message-id: <70F127D2-3A1F-4EB8-8E67-D1B32AB4FFAE@lists.apple.com>
Date: Tue, 28 Jan 2020 14:36:13 -0800
From: Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>
To: Apple Product Security via Security-announce
 <security-announce@...ts.apple.com>
Subject: [FD] APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1

iOS 13.3.1 and iPadOS 13.3.1 are now available and address the
following:

Audio
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team

FaceTime
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: A remote FaceTime user may be able to cause the local user's
camera self-view to display the incorrect camera
Description: An issue existed in the handling of the local user's
self-view. The issue was corrected with improved logic.
CVE-2020-3869: Elisa Lee

ImageIO
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2020-3870
CVE-2020-3878: Samuel Groß of Google Project Zero

IOAcceleratorFamily
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3837: Brandon Azad of Google Project Zero

IPSec
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: Loading a maliciously crafted racoon configuration file may
lead to arbitrary code execution
Description: An off by one issue existed in the handling of racoon
configuration files. This issue was addressed through improved bounds
checking.
CVE-2020-3840: @littlelailo

Kernel
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2020-3875: Brandon Azad of Google Project Zero

Kernel
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of
Cognite

Kernel
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: A malicious application may be able to determine kernel
memory layout
Description: An access issue was addressed with improved memory
management.
CVE-2020-3836: Brandon Azad of Google Project Zero

Kernel
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3842: Ned Williamson working with Google Project Zero
CVE-2020-3858: Xiaolong Bai and Min (Spark) Zheng of Alibaba Inc,
Luyi Xing of Indiana University Bloomington

Kernel
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed with improved locking.
CVE-2020-3831: Corellium, Proteas of Qihoo 360 Nirvan Team

Kernel
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2020-3853: Brandon Azad of Google Project Zero

Kernel
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2020-3860: Proteas of Qihoo 360 Nirvan Team

libxpc
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: Processing a maliciously crafted string may lead to heap
corruption
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2020-3856: Ian Beer of Google Project Zero

libxpc
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to gain elevated privileges
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2020-3829: Ian Beer of Google Project Zero

Mail
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: Turning off "Load remote content in messages" may not apply
to all mail previews
Description: This issue was addressed with improved setting
propagation.
CVE-2020-3873: Alexander Heinrich (@Sn0wfreeze) of Technische
Universität Darmstadt

Messages
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: A person with physical access to an iOS device may be able to
access contacts from the lock screen
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2020-3859: Simone PC of X10X (TWR)

Messages
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: Users removed from an iMessage conversation may still be able
to alter state
Description: This issue was addressed with improved checks.
CVE-2020-3844: Lance Rodgers of Oxon Hill High School

Phone
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: A person with physical access to an iOS device may be able to
access contacts from the lock screen
Description: A lock screen issue allowed access to contacts on a
locked device. This issue was addressed with improved state
management.
CVE-2020-3828: an anonymous researcher

Safari Login AutoFill
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: A local user may unknowingly send a password unencrypted over
the network
Description: The issue was addressed with improved UI handling.
CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research

Screenshots
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: Screenshots of the Messages app may reveal additional message
content
Description: An issued existed in the naming of screenshots. The
issue was corrected with improved naming.
CVE-2020-3874: Nicolas Luckie of Durham College

wifivelocityd
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: The issue was addressed with improved permissions logic.
CVE-2020-3838: Dayton Pidhirney (@_watbulb)

Additional recognition

IOSurface
We would like to acknowledge Liang Chen (@chenliang0817) for their
assistance.

Photos Storage
We would like to acknowledge Salman Husain of UC Berkeley for their
assistance.

Installation note:

This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/

iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.

The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.

To check that the iPhone, iPod touch, or iPad has been updated:

* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 13.3.1 and iPadOS 13.3.1".

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y
0M3JFg/9HBcMDffgGWKqqWc7O+CoqqogA+LPrEz+iGn8clEC3El9kr+i6Q1Lk4Pw
RqE+v88E6jp11puj7g5/i5Fi4QzTZT2Y4wxfgAtNVJRfzak3AqDINswwSCrO/+q/
v+HnvErqH1QXH/AOX/PwU4/D+GQWOuxCsgiXyeLGDZKvjxxu+9T6BnbG594+pdxF
lIfbnYRTObJ3K9dumQg/lK8f6AxOgJChUYddZGOvE8kcfeheGRSrl/Pp/uoTUhSd
Vf4qnqVq7fmmGgaKaMZ5acQARP4KeS97C9R/SB6PT3HLsMpEOMq6dmGd1Ma8Atvx
CvwrOAkZagAzUWmJQKIR+UkGrnBUyW+1w2XYExLEXKbyOEO9BUvPVCo+0xFLZi2C
LrCYNVHTKVmCxDO3FmsIOIn39Fk3w9dDilEOLh+usFKYDclsahVvjpCtIinKGSkF
WaijwWPQUwDXEL6NjaS6i42l7zUj/Of3Nw5MZGxyMpKsn//hu24n1p+b52ky9Iha
xQAyIPZo+ChJqJI3+GqyW/20YLOyJSOOKrkN0m9GOa7ovPR99iyNRuX+NrUqfCby
hHcrkjP3ONIc4ADXXpKao22ERcHEBeCuIfzUgA1V94B3sF7+Abqdt2G8SDHc7ftx
o8jh2jBj4V360kxs6736hjY+X5YHYDBzYJ4iJTxwOhdGGLqmDo4=
=4Udc
-----END PGP SIGNATURE-----


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists