exploit the possibilities

Apple Security Advisory 2018-9-24-5

Apple Security Advisory 2018-9-24-5
Posted Sep 25, 2018
Authored by Apple | Site apple.com

Apple Security Advisory 2018-9-24-5 - APPLE-SA-2018-9-24-5 provides additional information for APPLE-SA-2018-9-17-2. watchOS 5 is now available and addresses validation issues.

tags | advisory
systems | apple
advisories | CVE-2016-1777, CVE-2018-4191, CVE-2018-4299, CVE-2018-4305, CVE-2018-4311, CVE-2018-4313, CVE-2018-4319, CVE-2018-4336, CVE-2018-4344, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4363
SHA-256 | d094dbbbfb6765337f5e8e2519acbcb8ba389473da3df254ef33db12d4630cb3

Apple Security Advisory 2018-9-24-5

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2018-9-24-5 Additional information for
APPLE-SA-2018-9-17-2 watchOS 5

watchOS 5 addresses the following:

iTunes Store
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime

Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This
issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero

Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
Entry added September 24, 2018

Safari
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots. The issue was addressed with improved handling
of application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu
of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi - Ankara/TA1/4rkiye,
Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l University, Metin Altug
Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western
Governor's University (WGU)

Security
Available for: Apple Watch Series 1 and later
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky

WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
Entry added September 24, 2018

WebKit
Available for: Apple Watch Series 1 and later
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
Entry added September 24, 2018

WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
Entry added September 24, 2018

WebKit
Available for: Apple Watch Series 1 and later
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
This was addressed with improved tracking of security origins.
CVE-2018-4319: John Pettitt of Google
Entry added September 24, 2018

WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by Google OSS-Fuzz
Entry added September 24, 2018

Additional recognition

Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.

Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.

SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.

WebKit
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.

Installation note:

Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641

To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".

Alternatively, on your watch, select "My Watch > General > About".

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlupFUMACgkQeC9tht7T
K3FlkA/+M8ZAHAIh7DJNvRNa+oRd9iQ+u1nKxGqKrSOZadu4A6YpY0ccMkTIk3Hd
LIkmFtn4y/p+ZJ49A2k50+Hr5rcuW0XfjgHXb0l7wEkgKFOx1gMQNt52Jm34skyK
gQWrCu10xQD3tNXUTjn4/F9FU6hTUPP+2IizCfuL77MdQ0j4eFLjOzMNjdgvgpYt
VYgR7GgW4vBgEO4KBG09JqG6ghej4CWHuxghMZVK5hZZ6xOCSHuwZMoRzpg9yE8U
VkVomuFTmPm8AE1xvWQGSJLJNjuYahs6FUOccwBlwDgdG9s5PYud9ZR7qKGevUTL
Wa3+vJHnijvua+pvz7wOIXrfP0eI4LWMBvm9ub+ftNEQxcNE+Nl/ErqoHMpyuqrW
Be+B61TvOuN4oc2m4xU4vbx/kOWOCOgvUO+sDxZOkfKe1fQCkxLgsSjCBViCsitT
zmNBhSQIsCs+aYX1ZpC8qn5XYEWVb/Ois+Zc20Z6FdkC3BFUen6K21qKdTKo+AjM
jYQqtcbUUG2crcnCSRFJfHF0iGQl+PtWInRHH007wqeBNoiAUbsxbjtiWslgvuzq
p3O+5sPeWlp1haMRhG9GjCi+9JoFGu1gYKon02XrdXrLnUaD6iH9qkHXmKVPgmn6
+SfVKYNHX2AQwuRTSDe0ziHRZ/5oKrCBHDoNXHh+YOUeREGOVpA=
=DoWw
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close