APPLE-SA-2019-3-27-1 watchOS 5.2

时间:2022-02-06 01:38:03

APPLE-SA-2019-3-27-1 watchOS 5.2

watchOS 5.2 is now available and addresses the following:

CFString
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted string may lead to a denial
of service
Description: A validation issue was addressed with improved logic.
CVE-2019-8516: SWIPS Team of Frifee Inc.

configd
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to elevate privileges
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2019-8552: Mohamed Ghannam (@_simo36)

Contacts
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to elevate privileges
Description: A buffer overflow issue was addressed with improved
memory handling.
CVE-2019-8511: an anonymous researcher

CoreCrypto
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to elevate privileges
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2019-8542: an anonymous researcher

file
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted file might disclose user
information
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2019-6237: an anonymous researcher

Foundation
Available for: Apple Watch Series 1 and later
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2019-7286: an anonymous researcher, Clement Lecigne of Google
Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel
Groß of Google Project Zero

GeoServices
Available for: Apple Watch Series 1 and later
Impact: Clicking a malicious SMS link may lead to arbitrary code
execution
Description: A memory corruption issue was addressed with improved
validation.
CVE-2019-8553: an anonymous researcher

iAP
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to elevate privileges
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2019-8542: an anonymous researcher

IOHIDFamily
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: A memory corruption issue was addressed with improved
state management.
CVE-2019-8545: Adam Donenfeld (@doadam) of the Zimperium zLabs Team

Kernel
Available for: Apple Watch Series 1 and later
Impact: A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory
Description: A buffer overflow was addressed with improved size
validation.
CVE-2019-8527: Ned Williamson of Google and derrek (@derrekr6)

Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to determine kernel
memory layout
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2019-8540: Weibo Wang (@ma1fan) of Qihoo 360  Nirvan Team

Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to gain elevated privileges
Description: A logic issue was addressed with improved state
management.
CVE-2019-8514: Samuel Groß of Google Project Zero

Kernel
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to read kernel memory
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2019-7293: Ned Williamson of Google

Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to determine kernel
memory layout
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed with improved input
validation.
CVE-2019-6207: Weibo Wang of Qihoo 360 Nirvan Team (@ma1fan)
CVE-2019-8510: Stefan Esser of Antid0te UG

Messages
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to view sensitive user information
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2019-8546: ChiYuan Chang

Passcode
Available for: Apple Watch Series 1 and later
Impact: A partially entered passcode may not clear when the device
goes to sleep
Description: An issue existed where partially entered passcodes may
not clear when the device went to sleep.  This issue was addressed by
clearing the passcode when a locked device sleeps.
CVE-2019-8548: Tobias Sachs

Power Management
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: Multiple input validation issues existed in MIG
generated code. These issues were addressed with improved validation.
CVE-2019-8549: Mohamed Ghannam (@_simo36) of SSD Secure Disclosure
(ssd-disclosure.com)

Privacy
Available for: Apple Watch Series 1 and later
Impact: A malicious app may be able to track users between installs
Description: A privacy issue existed in motion sensor calibration.
This issue was addressed with improved motion sensor processing.
CVE-2019-8541: Stan (Jiexin) Zhang and Alastair R. Beresford of the
University of Cambridge, Ian Sheret of Polymath Insight Limited

Siri
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to initiate a Dictation
request without user authorization
Description: An API issue existed in the handling of dictation
requests. This issue was addressed with improved validation.
CVE-2019-8502: Luke Deshotels of North Carolina State University,
Jordan Beichler of North Carolina State University, William Enck of
North Carolina State University, Costin Carabaș of University
POLITEHNICA of Bucharest, and Răzvan Deaconescu of University
POLITEHNICA of Bucharest

TrueTypeScaler
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2019-8517: riusksk of VulWar Corp working with Trend Micro Zero
Day Initiative

WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2019-8518: Samuel Groß of Google Project Zero
CVE-2019-8558: Samuel Groß of Google Project Zero
CVE-2019-8559: Apple
CVE-2019-8563: Apple

WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2019-8536: Apple
CVE-2019-8544: an anonymous researcher

WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2019-8506: Samuel Groß of Google Project Zero

WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may result in the
disclosure of process memory
Description: A validation issue was addressed with improved logic.
CVE-2019-7292: Zhunki and Zhiyi Zhang of 360 ESG Codesafe Team

Additional recognition

Kernel
We would like to acknowledge Brandon Azad of Google Project Zero for
their assistance.

Installation note:

Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641

To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".

Alternatively, on your watch, select "My Watch > General > About".

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

APPLE-SA-2019-3-27-1 watchOS 5.2的更多相关文章

  1. Alpha冲刺(4/10)——2019.4.27

    所属课程 软件工程1916|W(福州大学) 作业要求 Alpha冲刺(4/10)--2019.4.27 团队名称 待就业六人组 1.团队信息 团队名称:待就业六人组 团队描述:同舟共济扬帆起,乘风破浪 ...

  2. Beta冲刺(6/7)——2019.5.27

    所属课程 软件工程1916|W(福州大学) 作业要求 Beta冲刺(6/7)--2019.5.27 团队名称 待就业六人组 1.团队信息 团队名称:待就业六人组 团队描述:同舟共济扬帆起,乘风破浪万里 ...

  3. [New!!!]欢迎大佬光临本蒟蒻的博客(2019.11.27更新)

    更新于2019.12.22 本蒟蒻在博客园安家啦!!! 本蒟蒻的博客园主页 为更好管理博客,本蒟蒻从今天开始,正式转入博客园. 因为一些原因,我的CSDN博客将彻底不会使用!!!(带来不便,敬请谅解) ...

  4. 2019/8/27 Test(luogu 五月天模拟赛)

    \(2019/8/27\)大考 \(\color{#ff0808}{\text{初二诀别赛(SAD)}}\) 题目名称 链接 寿司 \(BSOJ5111\) 秀秀的森林 \(BSOJ5125\) 分组 ...

  5. 2019.9.27,SAP成都研究院数字创新空间团队建设,射箭和游泳

    2019年9月27日,秋高气爽,SAP成都研究院数字创新团队全体成员又迎来了一次团队建设活动.这次的主题是:射箭. 在正式活动之前,大家先享用了一顿泰式海鲜火锅: 吃饱喝足之后,我们来到了名为&quo ...

  6. 【NOI2019模拟2019.6.27】B (生成函数+整数划分dp|多项式exp)

    Description: \(1<=n,k<=1e5,mod~1e9+7\) 题解: 考虑最经典的排列dp,每次插入第\(i\)大的数,那么可以增加的逆序对个数是\(0-i-1\). 不难 ...

  7. Alpha冲刺&lpar;5&sol;10&rpar;——2019&period;4&period;27

    作业描述 课程 软件工程1916|W(福州大学) 团队名称 修!咻咻! 作业要求 项目Alpha冲刺(团队) 团队目标 切实可行的计算机协会维修预约平台 开发工具 Eclipse 团队信息 队员学号 ...

  8. 【英文文档】 Installing Go from source Go语言官方编译指南 2019&period;02&period;27

    Introduction Go is an open source project, distributed under a BSD-style license. This document expl ...

  9. 2019&period;02&period;27 bzoj4556&colon; &lbrack;Tjoi2016&Heoi2016&rsqb;字符串(二分答案&plus;sam&plus;线段树合并)

    传送门 题意:给一个字符串SSS. 有mmm次询问,每次给四个参数a,b,c,da,b,c,da,b,c,d,问s[a...b]s[a...b]s[a...b]的所有子串和s[x...y]s[x... ...

  10. 2019&sol;3&sol;27 wen 数组排序

随机推荐

  1. print输出格式总结

    妈的,今天又被printf坑了一回...看来需要一次性总结书所有结果,省的又出现这样那样的麻烦.. #include<stdio.h> #include<string.h> # ...

  2. c语言的字符串操作(比较详细)

    1)字符串操作 strcpy(p, p1) 复制字符串 strncpy(p, p1, n) 复制指定长度字符串 strcat(p, p1) 附加字符串 strncat(p, p1, n) 附加指定长度 ...

  3. javascript图片延迟加载(转载)

    <!DOCTYPE HTML><html><head><meta http-equiv="Content-Type" content=&q ...

  4. Html在线编辑器--基于Jquery的xhEditor轻量级编辑器

    xhEditor V1.2.2 下载地址 开源中国社区: http://www.oschina.net/p/xheditor xhEditor是一个基于jQuery开发的简单迷你并且高效的可视化XHT ...

  5. Linux下硬盘分区

    1  fdisk -l查看硬盘及分区信息 我的系统(Archlinux)下的命令效果如下: 由上面的图片可以得知该系统只挂载了1个硬盘,命名为sda,其有2个主分区,sda1和sda2,至于为什么这么 ...

  6. 机智的造假-&gt&semi;sql给Echart提供数据

    数据要求:要求数据随着上班时间的延长要递增,要看起来像真数据 declare @key int; declare cur_rate cursor for select keyID from #t1; ...

  7. VIM学习一: VIM命令学习及插件介绍

    一.光标移动及编辑命令(含查找替换) [打开关闭窗口] :e file或:open file       打开新文档 :q或者ctrl+w+q         关闭当前视图的窗口 :tab split ...

  8. python3 pip 安装Scrapy在win10 安装报错error&colon; Microsoft Visual C&plus;&plus; 14&period;0 is required&period; Get it with &quot&semi;Microsoft Visual C&plus;&plus; Build Tools&quot&semi;&colon; http&colon;&sol;&sol;landinghub&period;visualstudio&period;com&sol;visual-cpp-build-tools

    问题描述 当前环境win10,python_3.6.1,64位. 在windows下,在dos中运行pip install Scrapy报错: building 'twisted.test.raise ...

  9. Java中关于AbstractQueuedSynchronizer的入门(二)

    AQS是一个同步器的基础类,里面的关键字段: //如下关键字段都是volatile类型 /** * Head of the wait queue, lazily initialized. Except ...

  10. Flask之数据库设置

    4 数据库 知识点 Flask-SQLALchemy安装 连接数据库 使用数据库 数据库迁移 邮件扩展 4.1 数据库的设置 Web应用中普遍使用的是关系模型的数据库,关系型数据库把所有的数据都存储在 ...