Message-id: <AE8A42AC-6783-41E5-A6B6-2955CB8B5E0A@lists.apple.com>
Date: Wed, 21 Jul 2021 17:13:44 -0700
From: Apple Product Security via Fulldisclosure <fulldisclosure@...lists.org>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-2021-07-21-6 tvOS 14.7

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2021-07-21-6 tvOS 14.7

tvOS 14.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT212604.

Audio
Available for: Apple TV 4K and Apple TV HD
Impact: A local attacker may be able to cause unexpected application
termination or arbitrary code execution
Description: This issue was addressed with improved checks.
CVE-2021-30781: tr3e

CoreAudio
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2021-30775: JunDong Xie of Ant Security Light-Year Lab

CoreAudio
Available for: Apple TV 4K and Apple TV HD
Impact: Playing a malicious audio file may lead to an unexpected
application termination
Description: A logic issue was addressed with improved validation.
CVE-2021-30776: JunDong Xie of Ant Security Light-Year Lab

CoreText
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2021-30789: Mickey Jin (@patch1t) of Trend Micro, Sunglin of
Knownsec 404 team

Crash Reporter
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious application may be able to gain root privileges
Description: A logic issue was addressed with improved validation.
CVE-2021-30774: Yizhuo Wang of Group of Software Security In
Progress (G.O.S.S.I.P) at Shanghai Jiao Tong University

CVMS
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious application may be able to gain root privileges
Description: An out-of-bounds write issue was addressed with improved
bounds checking.
CVE-2021-30780: Tim Michaud(@TimGMichaud) of Zoom Video
Communications

dyld
Available for: Apple TV 4K and Apple TV HD
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: A logic issue was addressed with improved validation.
CVE-2021-30768: Linus Henze (pinauten.de)

FontParser
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: An integer overflow was addressed through improved input
validation.
CVE-2021-30760: Sunglin of Knownsec 404 team

FontParser
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted tiff file may lead to a
denial-of-service or potentially disclose memory contents
Description: This issue was addressed with improved checks.
CVE-2021-30788: tr3e working with Trend Micro Zero Day Initiative

FontParser
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A stack overflow was addressed with improved input
validation.
CVE-2021-30759: hjy79425575 working with Trend Micro Zero Day
Initiative

Identity Service
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious application may be able to bypass code signing
checks
Description: An issue in code signature validation was addressed with
improved checks.
CVE-2021-30773: Linus Henze (pinauten.de)

Image Processing
Available for: Apple TV 4K and Apple TV HD
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2021-30802: Matthew Denton of Google Chrome Security

ImageIO
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: This issue was addressed with improved checks.
CVE-2021-30779: Jzhu, Ye Zhang(@co0py_Cat) of Baidu Security

ImageIO
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2021-30785: CFF of Topsec Alpha Team, Mickey Jin (@patch1t) of
Trend Micro

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious attacker with arbitrary read and write capability
may be able to bypass Pointer Authentication
Description: A logic issue was addressed with improved state
management.
CVE-2021-30769: Linus Henze (pinauten.de)

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: An attacker that has already achieved kernel code execution
may be able to bypass kernel memory mitigations
Description: A logic issue was addressed with improved validation.
CVE-2021-30770: Linus Henze (pinauten.de)

libxml2
Available for: Apple TV 4K and Apple TV HD
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: This issue was addressed with improved checks.
CVE-2021-3518

WebKit
Available for: Apple TV 4K and Apple TV HD
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A type confusion issue was addressed with improved state
handling.
CVE-2021-30758: Christoph Guttandin of Media Codings

WebKit
Available for: Apple TV 4K and Apple TV HD
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2021-30795: Sergei Glazunov of Google Project Zero

WebKit
Available for: Apple TV 4K and Apple TV HD
Impact: Processing maliciously crafted web content may lead to code
execution
Description: This issue was addressed with improved checks.
CVE-2021-30797: Ivan Fratric of Google Project Zero

Additional recognition

Assets
We would like to acknowledge Cees Elzinga for their assistance.

CoreText
We would like to acknowledge Mickey Jin (@patch1t) of Trend Micro for
their assistance.

Safari
We would like to acknowledge an anonymous researcher for their
assistance.

Sandbox
We would like to acknowledge Csaba Fitzl (@theevilbit) of Offensive
Security for their assistance.

Installation note:

Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."

To check the current version of software, select
"Settings -> General -> About."

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAmD4sAkACgkQZcsbuWJ6
jjD5oA//a1OagBps6Wv7d8Wap8qvZju5cnyzl2LWvK0m/CSqY0w5SMhrzQ/iy2XO
5qBjUOTZhBKc6tIA3pZYNz/1gMuy8cvLSftxcBG4uwYLsyDF8cFQInQFy/QALm7V
UcUXbm5pbDz3WGdIq8aceSG/M+2KWzXXw6kZG/AsZr1c+oPSQir8bHHaScz5k0ec
NRjmV/H1XP78ZDBoVwt0gzD/58hhKJojBlriDbaSrrWCGMs7Xyz0CUaJPBK7msOZ
eMrLXQxhPeh7m1xdTM4vI5Yo0Cez6ol3SS0ryQzqKOL614rYVGgYyc+IciNXCKIv
DDdkN3+dGYeEASfnKmN2xgpL2NtkrTDoyyPGCwufdmkHtcmnPS4+odmJaaStJO8r
fM5GWH1s7bUR2QkFWsK0DMjz9DwUhjfmCPrv+Nji+FDwMdIOhvHFTvqY/t7xxgrm
2jw7fF+7ugaCtnTNasrHkdR9HG5TrDYU51sV2MxXlWSLWqlJJKC8xy1Pk2JqH0Z7
6xYZvXqefRzb86OMY0N0GTxpvCLFo92Mmq5H8Zmrpl2q9l9QQSGFHP9DDA/oLCSb
UfI9UXfT2Z79+vGKV97gXVDLhaiHPy9b725lq8Sn5HbsutGFmY+VBUvRCgTd9MNn
ycBzm2H2/zOw7h3M9Q62mPciT/d4X2uMZ7fo647xeoHjYu/j9Rk=
=q0q7
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists