Message-id: <5C4501FE-1E22-46EC-973C-63E5F06F1121@lists.apple.com>
Date: Thu, 05 Nov 2020 15:40:23 -0800
From: Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-2020-11-05-7 tvOS 14.2

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2020-11-05-7 tvOS 14.2

tvOS 14.2 is now available and address the following issues.
Information about the security content is also available at
https://support.apple.com/HT211930.

Audio
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2020-27910: JunDong Xie and XingWei Lin of Ant Security Light-
Year Lab

Audio
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: An out-of-bounds write was addressed with improved input
validation.
CVE-2020-27916: JunDong Xie of Ant Security Light-Year Lab

CoreAudio
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: An out-of-bounds write was addressed with improved input
validation.
CVE-2020-10017: Francis working with Trend Micro Zero Day Initiative,
JunDong Xie of Ant Security Light-Year Lab

CoreAudio
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2020-27909: Anonymous working with Trend Micro Zero Day
Initiative, JunDong Xie and XingWei Lin of Ant Security Light-Year
Lab

Crash Reporter
Available for: Apple TV 4K and Apple TV HD
Impact: A local attacker may be able to elevate  their privileges
Description: An issue existed within the path validation logic for
symlinks. This issue was addressed with improved path sanitization.
CVE-2020-10003: Tim Michaud (@TimGMichaud) of Leviathan

FontParser
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2020-27927: Xingwei Lin of Ant Security Light-Year Lab

Foundation
Available for: Apple TV 4K and Apple TV HD
Impact: A local user may be able to read arbitrary files
Description: A logic issue was addressed with improved state
management.
CVE-2020-10002: James Hutchins

ImageIO
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: An out-of-bounds write was addressed with improved input
validation.
CVE-2020-27912: Xingwei Lin of Ant Security Light-Year Lab

IOAcceleratorFamily
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2020-27905: Mohamed Ghannam (@_simo36)

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious application may be able to determine kernel
memory layout
Description: A logic issue was addressed with improved state
management.
CVE-2020-9974: Tommy Muir (@Muirey03)

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2020-10016: Alex Helie

libxml2
Available for: Apple TV 4K and Apple TV HD
Impact: Processing maliciously crafted web content may lead to code
execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2020-27917: found by OSS-Fuzz

libxml2
Available for: Apple TV 4K and Apple TV HD
Impact: A remote attacker may be able to cause unexpected application
termination or arbitrary code execution
Description: An integer overflow was addressed through improved input
validation.
CVE-2020-27911: found by OSS-Fuzz

Logging
Available for: Apple TV 4K and Apple TV HD
Impact: A local attacker may be able to elevate their privileges
Description: A path handling issue was addressed with improved
validation.
CVE-2020-10010: Tommy Muir (@Muirey03)

WebKit
Available for: Apple TV 4K and Apple TV HD
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2020-27918: an anonymous researcher

Installation note:

Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."

To check the current version of software, select
"Settings -> General -> About."

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIyBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAl+kfkIACgkQZcsbuWJ6
jjANCg/4mHWMMHmOwVdZf2tgDkVIZVytBs3XopaZgDapWOBYhFyT/91iVOYBryt6
NWBWXAgsDMvtVdxw8M9Eh6yLbPLF9czSzptTJAB/ctVWUNzozc+U09OQHucwhibk
p6/L3R37ZlQKWW/BJNjbNt15gU0TGteJDxsZssjfwpux3rWaDBytTNXiHn3abB6E
D1coWnBCF+fgHDqKV/UCATepIbfnDRShyInIl7MoRD2j5tWRPWIorFfsynpJOD97
cdXA2xg4RNlVM083TEvV9jih27Tye1YawKzLxDaSvUt2cyDprP40X6LhhYLhSpPg
cCJe0Sc7ni5M5t7x99Rm6Jl7ov9mrYA/vkK4nDY8J14hfZSpSlo2jo3AAb6OE9uN
XZxOPhYyeOaWJRijanad8CL5DAvppsILnKUDRwso4fp3S5Mqt2G9LXh3wgHPkgD6
HLw52wYL9YEqzmQ2FQbnY9WDPXFCzlMDI+S7JuSatv8zDFui3exGf22wJryrbEKX
EZg+brjIlxP/S+DbXbkdyTJQpweGieD9yfef+xaaBtMuZZqG4TshUlfiNjT4uewi
dG/mO721wRwoD0XApzKm7qjVcX1jAvuue3FrsZZ0gjCPAIsa81fUVLZbf6oScnIo
Ky90Mr8uYhE9rBPCSDCvqGqrBHip4iV5sNkGwxEsapghs1L6JQ==
=VjTa
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists