exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Apple Security Advisory 2017-01-23-4

Apple Security Advisory 2017-01-23-4
Posted Jan 24, 2017
Authored by Apple | Site apple.com

Apple Security Advisory 2017-01-23-4 - tvOS 10.1.1 is now available and addresses buffer overflow, code execution, and various other security vulnerabilities.

tags | advisory, overflow, vulnerability, code execution
systems | apple
advisories | CVE-2016-8687, CVE-2017-2350, CVE-2017-2354, CVE-2017-2355, CVE-2017-2356, CVE-2017-2360, CVE-2017-2362, CVE-2017-2363, CVE-2017-2365, CVE-2017-2369, CVE-2017-2370, CVE-2017-2373
SHA-256 | d752960214514544ebcbcd5838b9d16b7826312ba8c694a44be4a74ac8b34f4c

Apple Security Advisory 2017-01-23-4

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

APPLE-SA-2017-01-23-4 tvOS 10.1.1

tvOS 10.1.1 is now available and addresses the following:

Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-2370: Ian Beer of Google Project Zero

Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A use after free issue was addressed through improved
memory management.
CVE-2017-2360: Ian Beer of Google Project Zero

libarchive
Available for: Apple TV (4th generation)
Impact: Unpacking a maliciously crafted archive may lead to arbitrary
code execution
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2016-8687: Agostino Sarubbo of Gentoo

WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may exfiltrate
data cross-origin
Description: A prototype access issue was addressed through improved
exception handling.
CVE-2017-2350: Gareth Heyes of Portswigger Web Security

WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed through
improved memory handling.
CVE-2017-2354: Neymar of Tencent's Xuanwu Lab (tencent.com) working
with Trend Micro's Zero Day Initiative
CVE-2017-2362: Ivan Fratric of Google Project Zero
CVE-2017-2373: Ivan Fratric of Google Project Zero

WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2017-2355: Team Pangu and lokihardt at PwnFest 2016

WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed through
improved input validation.
CVE-2017-2356: Team Pangu and lokihardt at PwnFest 2016
CVE-2017-2369: Ivan Fratric of Google Project Zero

WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may exfiltrate
data cross-origin
Description: Multiple validation issues existed in the handling of
page loading. This issue was addressed through improved logic.
CVE-2017-2363: lokihardt of Google Project Zero

WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may exfiltrate
data cross-origin
Description: A validation issue existed in variable handling. This
issue was addressed through improved validation.
CVE-2017-2365: lokihardt of Google Project Zero

Additional recognition

WebKit hardening
We would like to acknowledge Ben Gras, Kaveh Razavi, Erik Bosman,
Herbert Bos, and Cristiano Giuffrida of the vusec group at
Vrije Universiteit Amsterdam for their assistance.

Installation note:

Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software.a

To check the current version of software, select
"Settings -> General -> About.a

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJYgqLhAAoJEIOj74w0bLRGY6EQAML8K3D+sOlvbhCidcaoAbWw
Vn2IGFG4J/Rn7MqomPasMMuKKFXAMyqb3HAfUAgCRqSjuFfwPkzo+nTSIQJRHI+X
SnjsOXGUzaL+/xRz1gQyDDvlNhUMvdONZIdy/guDEXj8VbR8CAa1aGsGxWtCFSCK
pGyYzQuTRSkqaFZJwRNGuHSJoplTZZcu6/VvHI5ZKxFcbMJ0QV3yXUL4abQ2vQjN
JkVqm9TARVAJMMXAO77goU0lqrq1ffkW+TYyTdGPz4u8fI08uQ5E8W/MkUj9OdNj
sgKL8D8YvfDSEXrzoBoNXEQzWAj8rHWEbA187g4u071ja1sd5laQG69Z1L02CkOg
V8pudQaEM5zmSlvnjxKsByS6I3PtLZxffL6yx9Bgv63h+ai/L53VKkqPTFI1GR3q
6rAf+Ky8s6Z4/y7zcaN7TJ9oG82x5bTI5h3R5WmcALOQLJsk+47guYh6ZxSVTcbw
e9oITPRxYqeUzW4u7eOBkWs3i+v+p3hMlY4CGBoUyF0Jb8kH5CaIJNLtvhHC0Ek0
c8PKoG/LpkBoXyiWaTsgQEx/6iMxDtYYiELMLq0gNBrxewz1YWYYE4647kKWjITM
VKtjAJcpCKmXjObE0JufSY79kyT1AQQXab1sZ2HWpdoeaOfz3TDkbLs2lPObgJdo
UOrsZPgApcrRvf+dzocG
=uwig
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    8 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close