-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2020-1-28-4 tvOS 13.3.1

tvOS 13.3.1 is now available and addresses the following:

Audio
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team

ImageIO
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2020-3870
CVE-2020-3878: Samuel Groß of Google Project Zero

IOAcceleratorFamily
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3837: Brandon Azad of Google Project Zero

IPSec
Available for: Apple TV 4K and Apple TV HD
Impact: Loading a maliciously crafted racoon configuration file may
lead to arbitrary code execution
Description: An off by one issue existed in the handling of racoon
configuration files. This issue was addressed through improved bounds
checking.
CVE-2020-3840: @littlelailo

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2020-3875: Brandon Azad of Google Project Zero

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of
Cognite

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious application may be able to determine kernel
memory layout
Description: An access issue was addressed with improved memory
management.
CVE-2020-3836: Brandon Azad of Google Project Zero

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2020-3842: Ned Williamson working with Google Project Zero

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2020-3853: Brandon Azad of Google Project Zero

libxpc
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously crafted string may lead to heap
corruption
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2020-3856: Ian Beer of Google Project Zero

libxpc
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to gain elevated privileges
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2020-3829: Ian Beer of Google Project Zero

WebKit
Available for: Apple TV 4K and Apple TV HD
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2020-3868: Marcin Towalski of Cisco Talos

wifivelocityd
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to execute arbitrary code with
system privileges
Description: The issue was addressed with improved permissions logic.
CVE-2020-3838: Dayton Pidhirney (@_watbulb)

Additional recognition

IOSurface
We would like to acknowledge Liang Chen (@chenliang0817) for their
assistance.

Installation note:

Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."

To check the current version of software, select
"Settings -> General -> About."

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y
0M0O1A//SCZ3xER+6ClBQJdJzWwsjmHI/Fwb5lod5uMRYxFx8T+xc0DT1KQV+cM6
HDjMO6vB0m9lc7ftwER09PnBnI8sZTnxfWckZV1LHX1Wss77wTI/thGZMB716rD8
ddUTcvMBwyLoI4qLg/DBXPb5ySshRXjXyoJ+DSbQ74iUssMhMrvP7j1OgdXximiq
Ymjwd9q5gICNmtIPBu/dkx/bIPwgmTGPbDKfIUOPkqD2guxEf1lXTS+XaiYT2dKt
LOYbtz5wVw82462BkV7dW2a0CZtom9NO/ro0h0dbl/QJI6Czpdq1V7oTY+csfm9N
2ouDc6MlxcKwBPncQUfHxXgWgodSG/syR/0gY2AX3YXwsVbGgo8DYdEKuGsB9DVZ
bcvZPWPQl6tvsYw0JlKVzGLzIZiqQq88187lT2omY3AzRYW12+te8Aj2AGNhTyCI
E/1YGwp9RYXNTsWD0Va4pf1a1r8+6F3m1GSkOmXEZRP4+MPu1/HmhCu7+uQXcVvF
fahuZmJ0E4F6k0dkBbI619FuDl41dhhuEqZjkhObLcYYq3Uyrd5qx3Qbw7wj/r68
17Ni/+nAoNf70vu7lxsVth86NWgqbzlTErymZ/jfd3/87NAEPRL8y5fmFZt91AQt
Ah4CGUBhIyRKcNoTBTgqzYUUE8jaQ3/HiAKKgwNboldqbNmQknA=
=ZEol
-----END PGP SIGNATURE-----