Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File.

As a part of my 5G home internet offering, Optus bundles a 5G gateway called the Nokia Fastmile. The same device seems to be shipped by T-Mobile for their 5G offering and is passionately known as the 'trashcan' in r/tmobileisp.

![](https://eddiez.me/content/images/2021/10/ResrcID22518_GW_bottom.png)

Nokia Fastmile Stock Photo

Naturally, the first thing I tried to do is to obtain root access on it.

**Finding a Privilege Escalation Bug**

EDIT: This has been assigned CVE-2021-45896.

Immediately, the first thing I noticed is that the provided userAdmin credentials printed on the bottom of the device seem to be a low level account.

Taking a peak at the requests going on when logging in immediately reveals an authenticated privilege escalation vulnerability. This likely also affects other Nokia devices. My firmware version: 3TG00118ABAD52.

When logging in, a call is made to POST /login\_web\_app.cgi.

If you intercept the response you will see that there is a variable called "is\_ctc\_admin".

![](https://eddiez.me/content/images/2021/10/image-2.png)

Change "is\_ctc\_admin" to 1

If you change this in the response to 1 you get access to additional functionality and full admin. The vulnerability is a classic access control issue where authorisation is handled only on the client side.

Now we have access to an additional tab but also more functionality in some existing tabs.

![](https://eddiez.me/content/images/2021/10/image-3.png)

SPAN Ports!

![](https://eddiez.me/content/images/2021/10/image-7.png)

QOS

![](https://eddiez.me/content/images/2021/10/image-4.png)

Backup and Restore Configuration

**Modifying the Configuration**

Doing some Googling I came across this smart guy who figured out the format of Nokia's configuration file format and wrote a tool to unpack, and pack configuration files so that you can make changes that aren't available through the web interface.

Unlocking IAM’s Nokia G-240W-A router (Part 1) · 0x41.cf

![](https://0x41.cf/favicon.png)

![](https://i.0x41.cf/b/nokia-g-240w-a.png)

The tool he wrote also works for the Nokia Fastmile: https://gist.github.com/thedroidgeek/80c379aa43b71015d71da130f85a435a

Following the write-up gets us all the way to SSH/Telnet access to the device however we are stopped by this annoying password prompt for shell access.

None of the passwords in the configuration file work for this shell password.

![](https://eddiez.me/content/images/2021/10/image-8.png)

???

Some other comments mention changing LimitAccount\_ONTUSER to false and logging in with ONTUSER:SUGAR2A041 however this doesn't seem to work for the Fastmile.

**Giving Up and Moving to Looking at Hardware**

randomsrvapps over at Whirlpool seems to have managed to get a trivial root shell via UART/ADB revealing that the device is Android based? Lets verify this.

Flipping the device over we see some ports that seem to be covered (circled in yellow on the photo).

![](https://eddiez.me/content/images/2021/11/4032-3024-resize.jpg)

These stickers can only be uncovered from the rear as the stickers they used are quite strong. By undoing circled bolts in red (Torx T15H) and removing the sim card, the feet come off and we can poke out the stickers.

This reveals a USB-C port and two RJ12 ports.

![](https://eddiez.me/content/images/2021/11/3024-4032-resize-crop.jpg)

USB-C is Top Right

**It runs Android?**

As per the thread, plugging into the USB-C port and running ADB shell gives us an immediate root shell on the device.

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-13-16-50-43.png)

Interestingly it has a Snapdragon 855 in it, the same processor that was in previous generation flagships like the Google Pixel 4.

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-20-22-43-15.png)

Snapdragon 855

I also confirmed that you can get this same console access by plugging into the pins outlined in the thread. These terminals are 1.8v logic level and the pins from inside to out are RX, TX, and ground with a baud rate of 115200.

![](https://eddiez.me/content/images/2021/11/3024-4033-resize-canvas.jpg)

Having a poke around via ADB shell reveals some oddities.

The most noteworthy being that the IP addressing scheme of my local network configured via the WEB-UI (172.10.0.0/24) is non-existent and some random private subnet 192.168.85.0/24 shows up.

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-21-08-14-26.png)

Performing a traceroute from my local machine we see traffic get routed through this 192.168.85.0/24 subnet as well.

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-21-08-24-13.png)

The First Hop Is My pfsense Firewall (I'm Running Double NAT)

This can also be verified by performing a tcpdump with a filter on the Fastmile whilst pinging 9.9.9.9.

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-21-08-23-56.png)

Why is our IP address 192.168.85.6??

I immediately copied over a precompiled binary of busybox onto the Fastmile to try to run ARP.

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-21-08-28-12.png)

Then the realisation came.

**It's Two Devices in One Box!**

Nokia have basically taped a 5G capable phone to one of their old Alcatel-Lucent routers and shipped it in a cylindrical box. This also explains why the configuration modification tool earlier worked flawlessly.

![](https://eddiez.me/content/images/2021/11/Nokia-Fastmile.jpg)

Having root on the Android side doesn't help at all with getting root on the router side!

Using this knowledge we can also enable remote Android debugging by first adding a firewall rule.

    iptables -I INPUT 1 -s 192.168.85.6 -j ACCEPT

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-13-22-38-34.png)

Enabling remote debugging on a port.

    adb tcpip 5555 //While connected via USB.
    

Then connecting remotely without having to be tethered to the device.

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-13-22-43-12.png)

Looking back at the physical device again you can even see two different PCB types.

![](https://eddiez.me/content/images/2021/11/4032-3026-resize-annotated-2.jpg)

UART pins are also provided for the router side that are easily accessible. These pins are 3.3v logic level and the pins from inside out are ground, RX, TX with a baud rate of 115200.

![](https://eddiez.me/content/images/2021/11/4032-3027-resize.jpg)

Letting it boot whilst connected via UART drops us into the same restricted shell that we had earlier via SSH where we don't know the 'shell' password. Not helpful.

Interrupting boot drops us in CFE but I don't have the patience to dump the image over serial as that would take ~4 days. Otherwise, I'm not too familiar with CFE and am not super keen on turning my Fastmile into a $400 brick.

![](https://eddiez.me/content/images/2021/11/Screenshot-from-2021-11-14-00-39-45.png)

Changing the GPON Password Board Parameter Doesn't Do Anything

If anyone else has any advice/knowledge feel free to ping me at email, we still aren't root after all this.

**Teardown**

Out of curiosity, I took the device apart a bit more as I hadn't seen any other write-ups detailing this.

Tracing back to the step where we'd removed the bottom of the device, the next step of disassembly is to bend back the clips around the perimeter circled in red. I've also circled the UART pins in yellow for clarity.

![](https://eddiez.me/content/images/2021/11/clips_resize.jpg)

Now you can flip the device and lift up the white shell to reveal the antennas.

![](https://eddiez.me/content/images/2021/11/antenna-resized.jpg)

Every bolt from here on is a Torx T8H. Looking at the top there are 5 bolts to undo which loosen the LED indicator board.

![](https://eddiez.me/content/images/2021/11/top-resized.jpg)

With the top LED indicator board off we can see where all the antenna's terminate. If you wanted to attach an external antenna, this is where you'd do it.

![](https://eddiez.me/content/images/2021/11/antenna-resized-1.jpg)

Unfortunately, accessibility to the connectors is very limited as some snake under the heatsink. I did try removing the heatsink later but it was pretty solidly bound to the PCB so I'm not sure if it's held together with a thermal epoxy or if I missed some bolts.

Next up, looking at the side of the device with the smaller heatsink (Android side), there are two more bolts on the diagonal face to loosen.

![](https://eddiez.me/content/images/2021/11/phone-side-resized.jpg)

This allows you to lift up 2/5 sides of the antenna assembly revealing the Android device.

![](https://eddiez.me/content/images/2021/11/phone-resized.jpg)

Removing the 4 bolts that hold the Android side in allows you to lift and fold the device over like we've done with the antenna panels.

![](https://eddiez.me/content/images/2021/11/phone-flipped-resized.jpg)

This also reveals the backside of the Alcatel-Lucent router and the only electrical interconnect between the two devices in the bottom right.

![](https://eddiez.me/content/images/2021/11/router-backside-resized-3.jpg)

I didn't go any further as the router side is mostly covered up by it's heatsink and if it's anything like the Android side then it was likely to also be difficult to remove.

CVE-2021-45896: WIP: Hacking the Nokia Fastmile

basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier.

@@ -7,10 +7,7 @@ import com.nexblocks.authguard.service.exceptions.ServiceAuthorizationException; import com.nexblocks.authguard.service.exceptions.ServiceException; import com.nexblocks.authguard.service.exceptions.codes.ErrorCode; import com.nexblocks.authguard.service.model.AccountBO; import com.nexblocks.authguard.service.model.AuthRequestBO; import com.nexblocks.authguard.service.model.CredentialsBO; import com.nexblocks.authguard.service.model.EntityType; import com.nexblocks.authguard.service.model.\*; import com.google.inject.Inject; import io.vavr.control.Either; import org.slf4j.Logger; @@ -86,7 +83,14 @@ public BasicAuthProvider(final CredentialsService credentialsService, final Acco private Either<Exception, AccountBO\> verifyCredentialsAndGetAccount(final String username, final String password) { final Optional<CredentialsBO\> credentials \= credentialsService.getByUsernameUnsafe(username);  
// TODO replace this with Either mapping if (credentials.isPresent()) { final Optional<Exception\> validationError \= checkIdentifier(credentials.get(), username);  
if (validationError.isPresent()) { return Either.left(validationError.get()); }  
if (securePassword.verify(password, credentials.get().getHashedPassword())) { return getAccountById(credentials.get().getAccountId()); } else { @@ -103,13 +107,38 @@ public BasicAuthProvider(final CredentialsService credentialsService, final Acco final Optional<CredentialsBO\> credentials \= credentialsService.getByUsernameUnsafe(username);  
if (credentials.isPresent()) { final Optional<Exception\> validationError \= checkIdentifier(credentials.get(), username);  
if (validationError.isPresent()) { return Either.left(validationError.get()); }  
return getAccountById(credentials.get().getAccountId()); } else { return Either.left(new ServiceAuthorizationException(ErrorCode.CREDENTIALS\_DOES\_NOT\_EXIST, "Identifier " + username + " does not exist")); } }  
private Optional<Exception\> checkIdentifier(final CredentialsBO credentials, final String identifier) { final Optional<UserIdentifierBO\> matchedIdentifier \= credentials.getIdentifiers() .stream() .filter(existing \-\> identifier.equals(existing.getIdentifier())) .findFirst();  
if (matchedIdentifier.isEmpty()) { return Optional.of(new IllegalStateException("No identifier matched but credentials were returned")); }  
if (!matchedIdentifier.get().isActive()) { return Optional.of(new ServiceAuthorizationException(ErrorCode.INACTIVE\_IDENTIFIER, "Identifier is not active", EntityType.ACCOUNT, credentials.getAccountId())); }  
return Optional.empty(); }  
private Either<Exception, AccountBO\> getAccountById(final String accountId) { final Optional<AccountBO\> account \= accountsService.getById(accountId);

CVE-2021-45890: Prevent authentication with inactive identifiers · AuthGuard/AuthGuard@9783b11

An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances.

CVE-2021-45480

An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted.

Investing in Mutual Funds is now easy with the UTI MF (UTI Mutual Funds) App. It gives you a hassle-free experience to invest in any mutual fund scheme of your choice from anywhere, anytime with just a few clicks. The paperless transactions allow new investors to start a SIP or invest a lumpsum with ease.

With UTI MF app, our existing customers can invest, track and manage their mutual fund investments, get statement of account and enjoy a host of other features that makes their investing a pleasant experience.

Why Choose UTI MF app for mutual fund investment?  
Heralding a new era of mobile-ready investments, the UTI MF app is intuitive, easy to use and specially designed to give you to a one-of-kind experience that is simple, fast and hassle-free. With the UTI MF app, you can perform all financial transaction on the go. You can register for a new scheme, invest in a scheme of your choice, redeem, track performance, and accomplish all your financial goals.

Features and Benefits of Investing in Mutual Fund with UTI MF App :  
The UTI MF app is designed in a way to offer you a one-stop solution for all your investment needs.  
You can enjoy a wide range of exciting new features and benefits, such as –  
1\. It promotes 100% paperless transactions.  
2\. You can easily sign up and sign in into your account using PAN card or folio number.  
3\. Explore and know the details of various UTI mutual funds and check the fund-related latest and historic data, including NAVs.  
4\. The One Click Investment is a NIFTY tool that allows you to purchase/sell units with click of a button.  
5\. The e-Smart features allow you to make payment for all your transactions with a single click without the hassles of accessing internet banking or entering debit card details.  
6\. The easy-to-use calculators allows you to plan your investments, including setting a goal, purchasing an SIP. You can also email the results to yourself for posterity.  
7\. The factsheet gives easy access to fund details and quarterly performance to all investors.  
8\. uSAVE allows you to make smart investment decisions and grow your savings through investment in liquid funds. It also allows you to instantly Redeem up to Rs. 50,000 into your bank account through IMPS.  
9\. You can mark and save your transactions as favourite for easy and quick reference in the future.  
10\. The Learn and invest sections is specially crafted to give you the best information content and be a master at investment and make smarter decisions. The information can also be saved and shared through social media.

Start investing in UTI Mutual Fund Regular as well as Direct Plans with UTI MF App :  
● The switch option allows you to easily switch your investment in equity fund to debt fund and vice-versa with ease.  
● Start investing in a new systematic investment plan through monthly or quarterly SIP with minimum investment amount as low as Rs. 500 for period of six months or more to suit your needs.  
● The investing in mutual funds through SIP is an excellent way to invest a small and grow your capital.  
● Get professional support to manage your investment portfolio.

Invest in Mutual Fund for Free with UTIMF App :  
● Create your mutual fund investment account within few minutes.  
● Invest in mutual funds schemes of your choice by starting an SIP or invest a lump sum with just a few clicks.  
● Carry out the transaction without any paperwork.  
● Use the UTI MF app, a one-stop solution for all your mutual fund investment needs.  
● One of the leading and most popular investment apps in India.

Select from a wide range of our Mutual Fund schemes :  
● Debt Category Funds  
● Equity Category Funds  
● Hybrid Category Funds  
● Overnight & Liquid Funds  
● Solution Based Funds  
● ETFs

CVE-2020-35398: UTI Mutual Fund Invest in Mutual Fund Online – Apps on Google Play

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS High Sierra 10.13. An application may be able to execute arbitrary code with elevated privileges.

CVE-2017-13835: About the security content of macOS High Sierra 10.13

This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra, iOS 12.4, tvOS 12.4. A local user may be able to read a persistent account identifier.

Released July 22, 2019

**Bluetooth**

Available for: Apple TV 4K and Apple TV HD

Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic (Key Negotiation of Bluetooth - KNOB)

Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation.

CVE-2019-9506: Daniele Antonioli of SUTD, Singapore, Dr. Nils Ole Tippenhauer of CISPA, Germany, and Prof. Kasper Rasmussen of University of Oxford, England

The changes for this issue mitigate CVE-2020-10135.

Entry added August 13, 2019, updated June 25, 2020

**Core Data**

Available for: Apple TV 4K and Apple TV HD

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2019-8646: natashenka of Google Project Zero

**Core Data**

Available for: Apple TV 4K and Apple TV HD

Impact: A remote attacker may be able to cause arbitrary code execution

Description: A use after free issue was addressed with improved memory management.

CVE-2019-8647: Samuel Groß and natashenka of Google Project Zero

**Core Data**

Available for: Apple TV 4K and Apple TV HD

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2019-8660: Samuel Groß and natashenka of Google Project Zero

**Game Center**

Available for: Apple TV 4K and Apple TV HD

Impact: A local user may be able to read a persistent account identifier

Description: This issue was addressed with a new entitlement.

CVE-2019-8702: Min (Spark) Zheng and Xiaolong Bai of Alibaba Inc.

Entry added February 24, 2020

**Heimdal**

Available for: Apple TV 4K and Apple TV HD

Impact: An issue existed in Samba that may allow attackers to perform unauthorized actions by intercepting communications between services

Description: This issue was addressed with improved checks to prevent unauthorized actions.

CVE-2018-16860: Isaac Boukris and Andrew Bartlett of the Samba Team and Catalyst

**Image Processing**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: A denial of service issue was addressed with improved validation.

CVE-2019-8668: an anonymous researcher

Entry added October 8, 2019

**libxslt**

Available for: Apple TV 4K and Apple TV HD

Impact: A remote attacker may be able to view sensitive information

Description: A stack overflow was addressed with improved input validation.

CVE-2019-13118: found by OSS-Fuzz

**Profiles**

Available for: Apple TV 4K and Apple TV HD

Impact: A malicious application may be able to restrict access to websites

Description: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement.

CVE-2019-8698: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin Carabaș and Răzvan Deaconescu of University POLITEHNICA of Bucharest

**Quick Look**

Available for: Apple TV 4K and Apple TV HD

Impact: An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary

Description: This issue was addressed with improved checks.

CVE-2019-8662: natashenka and Samuel Groß of Google Project Zero

**Siri**

Available for: Apple TV 4K and Apple TV HD

Impact: A remote attacker may be able to leak memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2019-8646: natashenka of Google Project Zero

**UIFoundation**

Available for: Apple TV 4K and Apple TV HD

Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2019-8657: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative

**WebKit**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue existed in the handling of document loads. This issue was addressed with improved state management.

CVE-2019-8690: Sergei Glazunov of Google Project Zero

**WebKit**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved state management.

CVE-2019-8649: Sergei Glazunov of Google Project Zero

**WebKit**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue was addressed with improved state management.

CVE-2019-8658: akayn working with Trend Micro's Zero Day Initiative

**WebKit**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2019-8644: G. Geshev working with Trend Micro's Zero Day Initiative

CVE-2019-8666: Zongming Wang (王宗明) and Zhe Jin (金哲) from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd.

CVE-2019-8669: akayn working with Trend Micro's Zero Day Initiative

CVE-2019-8671: Apple

CVE-2019-8672: Samuel Groß of Google Project Zero

CVE-2019-8673: Soyeon Park and Wen Xu of SSLab at Georgia Tech

CVE-2019-8676: Soyeon Park and Wen Xu of SSLab at Georgia Tech

CVE-2019-8677: Jihui Lu of Tencent KeenLab

CVE-2019-8678: Anthony Lai (@darkfloyd1014) of Knownsec, Ken Wong (@wwkenwong) of VXRL, Jeonghoon Shin (@singi21a) of Theori, Johnny Yu (@straight\_blast) of VX Browser Exploitation Group, Chris Chan (@dr4g0nfl4me) of VX Browser Exploitation Group, Phil Mok (@shadyhamsters) of VX Browser Exploitation Group, Alan Ho (@alan\_h0) of Knownsec, Byron Wai of VX Browser Exploitation, P1umer of ADLab of Venustech

CVE-2019-8679: Jihui Lu of Tencent KeenLab

CVE-2019-8680: Jihui Lu of Tencent KeenLab

CVE-2019-8681: G. Geshev working with Trend Micro Zero Day Initiative

CVE-2019-8683: lokihardt of Google Project Zero

CVE-2019-8684: lokihardt of Google Project Zero

CVE-2019-8685: akayn, Dongzhuo Zhao working with ADLab of Venustech, Ken Wong (@wwkenwong) of VXRL, Anthony Lai (@darkfloyd1014) of VXRL, and Eric Lung (@Khlung1) of VXRL

CVE-2019-8686: G. Geshev working with Trend Micro's Zero Day Initiative

CVE-2019-8687: Apple

CVE-2019-8688: Insu Yun of SSLab at Georgia Tech

CVE-2019-8689: lokihardt of Google Project Zero

Entry updated September 11, 2019

CVE-2019-8702: About the security content of tvOS 12.4

This issue was addressed with improved entitlements. This issue is fixed in watchOS 6, tvOS 13, macOS Catalina 10.15, iOS 13. An application may be able to gain elevated privileges.

Released September 24, 2019

**AppleFirmwareUpdateKext**

Available for: Apple TV 4K and Apple TV HD

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption vulnerability was addressed with improved locking.

CVE-2019-8747: Mohamed Ghannam (@\_simo36)

Entry added October 29, 2019

**Audio**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved state management.

CVE-2019-8706: Yu Zhou of Ant-Financial Light-Year Security Lab

Entry added October 29, 2019

**Audio**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing a maliciously crafted audio file may disclose restricted memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2019-8850: Anonymous working with Trend Micro Zero Day Initiative

Entry added December 4, 2019

**CFNetwork**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to a cross site scripting attack

Description: This issue was addressed with improved checks.

CVE-2019-8753: Łukasz Pilorz of Standard Chartered GBS Poland

Entry added October 29, 2019

**CoreAudio**

Available for: Apple TV 4K and Apple TV HD

Impact: Playing a malicious audio file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2019-8592: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative

Entry added November 6, 2019

**CoreCrypto**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing a large input may lead to a denial of service

Description: A denial of service issue was addressed with improved input validation.

CVE-2019-8741: Nicky Mouha of NIST

Entry added October 29, 2019

**CoreAudio**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing a maliciously crafted movie may result in the disclosure of process memory

Description: A memory corruption issue was addressed with improved validation.

CVE-2019-8705: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative

Entry added October 8, 2019

**Foundation**

Available for: Apple TV 4K and Apple TV HD

Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2019-8746: natashenka and Samuel Groß of Google Project Zero

Entry added October 29, 2019

**IOUSBDeviceFamily**

Available for: Apple TV 4K and Apple TV HD

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8718: Joshua Hill and Sem Voigtländer

Entry added October 29, 2019

**Kernel**

Available for: Apple TV 4K and Apple TV HD

Impact: An application may be able to gain elevated privileges

Description: This issue was addressed with improved entitlements.

CVE-2019-8703: an anonymous researcher

Entry added March 16, 2021

**Kernel**

Available for: Apple TV 4K and Apple TV HD

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption vulnerability was addressed with improved locking.

CVE-2019-8740: Mohamed Ghannam (@\_simo36)

Entry added October 29, 2019

**Kernel**

Available for: Apple TV 4K and Apple TV HD

Impact: A local app may be able to read a persistent account identifier

Description: A validation issue was addressed with improved logic.

CVE-2019-8809: Apple

Entry added October 29, 2019

**Kernel**

Available for: Apple TV 4K and Apple TV HD

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8712: Mohamed Ghannam (@\_simo36)

Entry added October 29, 2019

**Kernel**

Available for: Apple TV 4K and Apple TV HD

Impact: A malicious application may be able to determine kernel memory layout

Description: A memory corruption issue existed in the handling of IPv6 packets. This issue was addressed with improved memory management.

CVE-2019-8744: Zhuo Liang of Qihoo 360 Vulcan Team

Entry added October 29, 2019

**Kernel**

Available for: Apple TV 4K and Apple TV HD

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2019-8709: derrek (@derrekr6) derrek (@derrekr6)

Entry added October 29, 2019

**Kernel**

Available for: Apple TV 4K and Apple TV HD

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8717: Jann Horn of Google Project Zero

Entry added October 8, 2019

**Kernel**

Available for: Apple TV 4K and Apple TV HD

Impact: A malicious application may be able to determine kernel memory layout

Description: The issue was addressed with improved permissions logic.

CVE-2019-8780: Siguza

Entry added October 8, 2019

**Keyboards**

Available for: Apple TV 4K and Apple TV HD

Impact: A local user may be able to leak sensitive user information

Description: An authentication issue was addressed with improved state management.

CVE-2019-8704: 王 邦 宇 (wAnyBug.Com) of SAINTSEC

**libxml2**

Available for: Apple TV 4K and Apple TV HD

Impact: Multiple issues in libxml2

Description: Multiple memory corruption issues were addressed with improved input validation.

CVE-2019-8749: found by OSS-Fuzz

CVE-2019-8756: found by OSS-Fuzz

Entry added October 8, 2019

**libxslt**

Available for: Apple TV 4K and Apple TV HD

Impact: Multiple issues in libxslt

Description: Multiple memory corruption issues were addressed with improved input validation.

CVE-2019-8750: found by OSS-Fuzz

Entry added October 29, 2019

**mDNSResponder**

Available for: Apple TV 4K and Apple TV HD

Impact: An attacker in physical proximity may be able to passively observe device names in AWDL communications

Description: This issue was resolved by replacing device names with a random identifier.

CVE-2019-8799: David Kreitschmann and Milan Stute of Secure Mobile Networking Lab at Technische Universität Darmstadt

Entry added October 29, 2019

**UIFoundation**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing a maliciously crafted text file may lead to arbitrary code execution

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2019-8745: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative

Entry added October 8, 2019

**UIFoundation**

Available for: Apple TV 4K and Apple TV HD

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2019-8831: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative

Entry added November 18, 2019

**WebKit**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A logic issue was addressed with improved state management.

CVE-2019-8625: Sergei Glazunov of Google Project Zero

CVE-2019-8719: Sergei Glazunov of Google Project Zero

CVE-2019-8764: Sergei Glazunov of Google Project Zero

Entry added October 8, 2019, updated October 29, 2019

**WebKit**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2019-8707: an anonymous researcher working with Trend Micro's Zero Day Initiative, cc working with Trend Micro Zero Day Initiative

CVE-2019-8710: found by OSS-Fuzz

CVE-2019-8726: Jihui Lu of Tencent KeenLab

CVE-2019-8728: Junho Jang of LINE Security Team and Hanul Choi of ABLY Corporation

CVE-2019-8733: Sergei Glazunov of Google Project Zero

CVE-2019-8734: found by OSS-Fuzz

CVE-2019-8735: G. Geshev working with Trend Micro Zero Day Initiative

CVE-2019-8743: zhunki from Codesafe Team of Legendsec at Qi'anxin Group

CVE-2019-8751: Dongzhuo Zhao working with ADLab of Venustech

CVE-2019-8752: Dongzhuo Zhao working with ADLab of Venustech

CVE-2019-8763: Sergei Glazunov of Google Project Zero

CVE-2019-8765: Samuel Groß of Google Project Zero

CVE-2019-8766: found by OSS-Fuzz

CVE-2019-8773: found by OSS-Fuzz

Entry added October 8, 2019, updated October 29, 2019

**WebKit**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to universal cross site scripting

Description: A validation issue was addressed with improved logic.

CVE-2019-8762: Sergei Glazunov of Google Project Zero

Entry added November 18, 2019

**WebKit**

Available for: Apple TV 4K and Apple TV HD

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved validation.

CVE-2020-9932: Dongzhuo Zhao working with ADLab of Venustech

Entry added July 28, 2020

**Wi-Fi**

Available for: Apple TV 4K and Apple TV HD

Impact: A device may be passively tracked by its Wi-Fi MAC address

Description: A user privacy issue was addressed by removing the broadcast MAC address.

CVE-2019-8854: Ta-Lun Yen of UCCU Hacker and FuriousMacTeam of the United States Naval Academy and the Mitre Cooperation

Entry added December 4, 2019

CVE-2019-8703: About the security content of tvOS 13

CVE-2019-8643: Arun Sharma of VMWare This issue is fixed in macOS Mojave 10.14. Description: A logic issue was addressed with improved state management..

Released September 24, 2018

**Bluetooth**

Available for: iMac (21.5-inch, Late 2012), iMac (27-inch, Late 2012), iMac (21.5-inch, Late 2013), iMac (21.5-inch, Mid 2014), iMac (Retina 5K, 27-inch, Late 2014), iMac (21.5-inch, Late 2015), Mac mini (Mid 2011), Mac mini Server (Mid 2011), Mac mini (Late 2012), Mac mini Server (Late 2012), Mac mini (Late 2014), Mac Pro (Late 2013), MacBook Air (11-inch, Mid 2011), MacBook Air (13-inch, Mid 2011), MacBook Air (11-inch, Mid 2012), MacBook Air (13-inch, Mid 2012), MacBook Air (11-inch, Mid 2013), MacBook Air (13-inch, Mid 2013), MacBook Air (11-inch, Early 2015), MacBook Air (13-inch, Early 2015), MacBook Pro (13-inch, Mid 2012), MacBook Pro (15-inch, Mid 2012), MacBook Pro (Retina, 13-inch, Early 2013), MacBook Pro (Retina, 15-inch, Early 2013), MacBook Pro (Retina, 13-inch, Late 2013), and MacBook Pro (Retina, 15-inch, Late 2013)

Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic

Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation.

CVE-2018-5383: Lior Neumann and Eli Biham

The updates below are available for these Mac models: MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro (Late 2013, Mid 2010, and Mid 2012 models with recommended Metal-capable graphics processor, including MSI Gaming Radeon RX 560 and Sapphire Radeon PULSE RX 580)

**afpserver**

Impact: A remote attacker may be able to attack AFP servers through HTTP clients

Description: An input validation issue was addressed with improved input validation.

CVE-2018-4295: Jianjun Chen (@whucjj) from Tsinghua University and UC Berkeley

Entry added October 30, 2018

**App Store**

Impact: A malicious application may be able to determine the Apple ID of the owner of the computer

Description: A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls.

CVE-2018-4324: Sergii Kryvoblotskyi of MacPaw Inc.

**AppleGraphicsControl**

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2018-4417: Lee of the Information Security Lab Yonsei University working with Trend Micro's Zero Day Initiative

Entry added October 30, 2018

**Application Firewall**

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: A configuration issue was addressed with additional restrictions.

CVE-2018-4353: Abhinav Bansal of LinkedIn Inc.

Entry updated October 30, 2018

**APR**

Impact: Multiple buffer overflow issues existed in Perl

Description: Multiple issues in Perl were addressed with improved memory handling.

CVE-2017-12613: Craig Young of Tripwire VERT

CVE-2017-12618: Craig Young of Tripwire VERT

Entry added October 30, 2018

**ATS**

Impact: A malicious application may be able to elevate privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2018-4411: lilang wu moony Li of Trend Micro working with Trend Micro's Zero Day Initiative

Entry added October 30, 2018

**ATS**

Impact: An application may be able to read restricted memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2018-4308: Mohamed Ghannam (@\_simo36)

Entry added October 30, 2018

**Auto Unlock**

Impact: A malicious application may be able to access local users AppleIDs

Description: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement.

CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.

**CFNetwork**

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4126: Bruno Keith (@bkth\_) working with Trend Micro's Zero Day Initiative

Entry added October 30, 2018

**CoreFoundation**

Impact: A malicious application may be able to elevate privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)

Entry added October 30, 2018

**CoreFoundation**

Impact: An application may be able to gain elevated privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)

Entry added October 30, 2018

**CoreText**

Impact: Processing a maliciously crafted text file may lead to arbitrary code execution

Description: A use after free issue was addressed with improved memory management.

CVE-2018-4347: Vasyl Tkachuk of Readdle

Entry added October 30, 2018, updated December 13, 2018

**Crash Reporter**

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2018-4333: Brandon Azad

**CUPS**

Impact: In certain configurations, a remote attacker may be able to replace the message content from the print server with arbitrary content

Description: An injection issue was addressed with improved validation.

CVE-2018-4153: Michael Hanselmann of hansmi.ch

Entry added October 30, 2018

**CUPS**

Impact: An attacker in a privileged position may be able to perform a denial of service attack

Description: A denial of service issue was addressed with improved validation.

CVE-2018-4406: Michael Hanselmann of hansmi.ch

Entry added October 30, 2018

**Dictionary**

Impact: Parsing a maliciously crafted dictionary file may lead to disclosure of user information

Description: A validation issue existed which allowed local file access. This was addressed with input sanitization.

CVE-2018-4346: Wojciech Reguła (@\_r3ggi) of SecuRing

Entry added October 30, 2018

**DiskArbitration**

Impact: A malicious application may be able to modify contents of the EFI system partition and execute arbitrary code with kernel privileges if secure boot is not enabled

Description: A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks.

CVE-2018-4296: Vitaly Cheptsov

Entry updated January 22, 2019

**dyld**

Impact: A malicious application may be able to modify protected parts of the file system

Description: A configuration issue was addressed with additional restrictions.

CVE-2018-4433: Vitaly Cheptsov

Entry updated January 22, 2019

**fdesetup**

Impact: Institutional recovery keys may be incorrectly reported as present

Description: A logic issue was addressed with improved state management.

CVE-2019-8643: Arun Sharma of VMWare

Entry added August 1, 2019

**Firmware**

Impact: An attacker with physical access to a device may be able to elevate privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2017-5731: Intel and Eclypsium

CVE-2017-5732: Intel and Eclypsium

CVE-2017-5733: Intel and Eclypsium

CVE-2017-5734: Intel and Eclypsium

CVE-2017-5735: Intel and Eclypsium

Entry added June 24, 2019

**Grand Central Dispatch**

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4426: Brandon Azad

Entry added October 30, 2018

**Heimdal**

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4331: Brandon Azad

CVE-2018-4332: Brandon Azad

CVE-2018-4343: Brandon Azad

Entry added October 30, 2018

**Hypervisor**

Impact: Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis

Description: An information disclosure issue was addressed by flushing the L1 data cache at the virtual machine entry.

CVE-2018-3646: Baris Kasikci, Daniel Genkin, Ofir Weisse, and Thomas F. Wenisch of University of Michigan, Mark Silberstein and Marina Minkin of Technion, Raoul Strackx, Jo Van Bulck, and Frank Piessens of KU Leuven, Rodrigo Branco, Henrique Kawakami, Ke Sun, and Kekai Hu of Intel Corporation, Yuval Yarom of The University of Adelaide

Entry added October 30, 2018

**iBooks**

Impact: Parsing a maliciously crafted iBooks file may lead to disclosure of user information

Description: A configuration issue was addressed with additional restrictions.

CVE-2018-4355: evi1m0 of bilibili security team

Entry added October 30, 2018

**Intel Graphics Driver**

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2018-4396: Yu Wang of Didi Research America

CVE-2018-4418: Yu Wang of Didi Research America

Entry added October 30, 2018

**Intel Graphics Driver**

Impact: An application may be able to read restricted memory

Description: A memory initialization issue was addressed with improved memory handling.

CVE-2018-4351: Appology Team @ Theori working with Trend Micro's Zero Day Initiative

Entry added October 30, 2018

**Intel Graphics Driver**

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2018-4350: Yu Wang of Didi Research America

Entry added October 30, 2018

**Intel Graphics Driver**

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4334: Ian Beer of Google Project Zero

Entry added October 30, 2018

**Intel Graphics Driver**

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2018-4451: Tyler Bohan of Cisco Talos

CVE-2018-4456: Tyler Bohan of Cisco Talos

Entry added December 21, 2018, updated January 22, 2019

**IOHIDFamily**

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved input validation.

CVE-2018-4408: Ian Beer of Google Project Zero

Entry added October 30, 2018, updated August 1, 2019

**IOKit**

Impact: A malicious application may be able to break out of its sandbox

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4341: Ian Beer of Google Project Zero

CVE-2018-4354: Ian Beer of Google Project Zero

Entry added October 30, 2018

**IOKit**

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2018-4383: Apple

Entry added October 30, 2018

**IOUserEthernet**

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4401: Apple

Entry added October 30, 2018

**Kernel**

Impact: A malicious application may be able to leak sensitive user information

Description: An access issue existed with privileged API calls. This issue was addressed with additional restrictions.

CVE-2018-4399: Fabiano Anemone (@anoane)

Entry added October 30, 2018

**Kernel**

Impact: An attacker in a privileged network position may be able to execute arbitrary code

Description: A memory corruption issue was addressed with improved validation.

CVE-2018-4407: Kevin Backhouse of Semmle Ltd.

Entry added October 30, 2018

**Kernel**

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4336: Brandon Azad

CVE-2018-4337: Ian Beer of Google Project Zero

CVE-2018-4340: Mohamed Ghannam (@\_simo36)

CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)

CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative, Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero Day Initiative

Entry updated October 30, 2018

**LibreSSL**

Impact: Multiple issues in libressl were addressed in this update

Description: Multiple issues were addressed by updating to libressl version 2.6.4.

CVE-2015-3194

CVE-2015-5333

CVE-2015-5334

CVE-2016-0702

Entry added October 30, 2018, updated December 13, 2018

**Login Window**

Impact: A local user may be able to cause a denial of service

Description: A validation issue was addressed with improved logic.

CVE-2018-4348: Ken Gannon of MWR InfoSecurity and Christian Demko of MWR InfoSecurity

Entry added October 30, 2018

**mDNSOffloadUserClient**

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4326: an anonymous researcher working with Trend Micro's Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team

Entry added October 30, 2018

**MediaRemote**

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: An access issue was addressed with additional sandbox restrictions.

CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs

Entry added October 30, 2018

**Microcode**

Impact: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis

Description: An information disclosure issue was addressed with a microcode update. This ensures that older data read from recently-written-to addresses cannot be read via a speculative side-channel.

CVE-2018-3639: Jann Horn (@tehjh) of Google Project Zero (GPZ), Ken Johnson of the Microsoft Security Response Center (MSRC)

Entry added October 30, 2018

**Security**

Impact: A local user may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2018-4395: Patrick Wardle of Digita Security

Entry added October 30, 2018

**Security**

Impact: An attacker may be able to exploit weaknesses in the RC4 cryptographic algorithm

Description: This issue was addressed by removing RC4.

CVE-2016-1777: Pepi Zawodsky

**Spotlight**

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4393: Lufeng Li

Entry added October 30, 2018

**Symptom Framework**

Impact: An application may be able to read restricted memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2018-4203: Bruno Keith (@bkth\_) working with Trend Micro's Zero Day Initiative

Entry added October 30, 2018

**Text**

Impact: Processing a maliciously crafted text file may lead to a denial of service

Description: A denial of service issue was addressed with improved validation.

CVE-2018-4304: jianan.huang (@Sevck)

Entry added October 30, 2018

**Wi-Fi**

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2018-4338: Lee @ SECLAB, Yonsei University working with Trend Micro's Zero Day Initiative

Entry added October 23, 2018

CVE-2019-8643: About the security content of macOS Mojave 10.14

A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13, iCloud for Windows 7.0, watchOS 4, iOS 11, iTunes 12.7 for Windows. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.

Released September 12, 2017

**CFNetwork**

Available for: Windows 7 and later

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-13829: Niklas Baumstark and Samuel Gro working with Trend Micro's Zero Day Initiative 

CVE-2017-13833: Niklas Baumstark and Samuel Gro working with Trend Micro's Zero Day Initiative

Entry added November 10, 2017

**ImageIO**

Available for: Windows 7 and later

Impact: Processing a maliciously crafted image may lead to a denial of service

Description: An information disclosure issue existed in the processing of disk images. This issue was addressed through improved memory management.

CVE-2017-13831: Glen Carmichael

Entry added October 31, 2017, updated November 10, 2017

**libxml2**

Available for: Windows 7 and later

Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution

Description: A use after free issue was addressed with improved memory management.

CVE-2017-9049: Wei Lei and Liu Yang - Nanyang Technological University in Singapore

Entry added October 18, 2018

**libxml2**

Available for: Windows 7 and later

Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2017-7376: an anonymous researcher

CVE-2017-5130: an anonymous researcher

Entry added October 18, 2018

**libxml2**

Available for: Windows 7 and later

Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution

Description: A memory corruption issue was addressed with improved input validation.

CVE-2017-9050: Mateusz Jurczyk (j00ru) of Google Project Zero

Entry added October 18, 2018

**libxml2**

Available for: All Apple Watch models

Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution

Description: A null pointer dereference was addressed with improved validation.

CVE-2018-4302: Gustavo Grieco

Entry added October 18, 2018

**WebKit**

Available for: Windows 7 and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: A memory corruption issue was addressed through improved input validation.

CVE-2017-7081: Apple

Entry added September 25, 2017

**WebKit**

Available for: Windows 7 and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7087: Apple

CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend Micro’s Zero Day Initiative

CVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend Micro's Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360 Vulcan Team

CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend Micro’s Zero Day Initiative

CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group

CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University working with Trend Micro’s Zero Day Initiative

CVE-2017-7096: Wei Yuan of Baidu Security Lab

CVE-2017-7098: Felipe Freitas of Instituto Tecnológico de Aeronáutica

CVE-2017-7099: Apple

CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53

CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University

CVE-2017-7104: likemeng of Baidu Secutity Lab

CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University

CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com) working with Trend Micro's Zero Day Initiative

CVE-2017-7117: lokihardt of Google Project Zero

CVE-2017-7120: chenqin (陈钦) of Ant-financial Light-Year Security Lab

Entry added September 25, 2017

**WebKit**

Available for: Windows 7 and later

Impact: Cookies belonging to one origin may be sent to another origin

Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed by no longer returning cookies for custom URL schemes.

CVE-2017-7090: Apple

Entry added September 25, 2017

**WebKit**

Available for: Windows 7 and later

Impact: Processing maliciously crafted web content may lead to a cross site scripting attack

Description: Application Cache policy may be unexpectedly applied.

CVE-2017-7109: avlidienbrunn

Entry added September 25, 2017

CVE-2018-4302: About the security content of iTunes 12.7 for Windows

A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan. An attacker with physical access to a device may be able to elevate privileges.

Released June 1, 2018

**Accessibility Framework**

Available for: macOS High Sierra 10.13.4

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: An information disclosure issue existed in Accessibility Framework. This issue was addressed with improved memory management.

CVE-2018-4196: Alex Plaskett, Georgi Geshev and Fabian Beterke of MWR Labs working with Trend Micro’s Zero Day Initiative, and WanderingGlitch of Trend Micro Zero Day Initiative

Entry updated July 19, 2018

**AMD**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to read kernel memory

Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation.

CVE-2018-4253: shrek\_wzw of Qihoo 360 Nirvan Team

**AMD**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to read kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2018-4256: shrek\_wzw of Qihoo 360 Nirvan Team

Entry added July 19, 2018

**AMD**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to read kernel memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2018-4255: shrek\_wzw of Qihoo 360 Nirvan Team

Entry added October 18, 2018, updated December 14, 2018

**AMD**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: An input validation issue existed in the kernel. This issue was addressed with improved input validation.

CVE-2018-4254: an anonymous researcher

Entry added October 18, 2018

**AMD**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: An input validation issue existed in the kernel. This issue was addressed with improved input validation.

CVE-2018-4254: shrek\_wzw of Qihoo 360 Nirvan Team

Entry added October 24, 2018

**AppleGraphicsControl**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2018-4258: shrek\_wzw of Qihoo 360 Nirvan Team

Entry added October 18, 2018

**AppleGraphicsPowerManagement**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A buffer overflow was addressed with improved size validation.

CVE-2018-4257: shrek\_wzw of Qihoo 360 Nirvan Team

Entry added October 18, 2018

**apache\_mod\_php**

Available for: macOS High Sierra 10.13.4

Impact: Issues in php were addressed in this update

Description: This issue was addressed by updating to php version 7.1.16.

CVE-2018-7584: Wei Lei and Liu Yang of Nanyang Technological University

**ATS**

Available for: macOS High Sierra 10.13.4

Impact: A malicious application may be able to elevate privileges

Description: A type confusion issue was addressed with improved memory handling.

CVE-2018-4219: Mohamed Ghannam (@\_simo36)

**Bluetooth**

Available for: MacBook Pro (Retina, 15-inch, Mid 2015), MacBook Pro (Retina, 15-inch, 2015), MacBook Pro (Retina, 13-inch, Early 2015), MacBook Pro (15-inch, 2017), MacBook Pro (15-inch, 2016), MacBook Pro (13-inch, Late 2016, Two Thunderbolt 3 Ports), MacBook Pro (13-inch, Late 2016, Four Thunderbolt 3 Ports), MacBook Pro (13-inch, 2017, Four Thunderbolt 3 Ports), MacBook (Retina, 12-inch, Early 2016), MacBook (Retina, 12-inch, Early 2015), MacBook (Retina, 12-inch, 2017), iMac Pro, iMac (Retina 5K, 27-inch, Late 2015), iMac (Retina 5K, 27-inch, 2017), iMac (Retina 4K, 21.5-inch, Late 2015), iMac (Retina 4K, 21.5-inch, 2017), iMac (21.5-inch, Late 2015), and iMac (21.5-inch, 2017)

Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic

Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation.

CVE-2018-5383: Lior Neumann and Eli Biham

Entry added July 23, 2018

**Bluetooth**

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6

Impact: A malicious application may be able to determine kernel memory layout.

Description: An information disclosure issue existed in device properties. This issue was addressed with improved object management.

CVE-2018-4171: shrek\_wzw of Qihoo 360 Nirvan Team

**CoreGraphics**

Available for: macOS High Sierra 10.13.4

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2018-4194: Jihui Lu of Tencent KeenLab, Yu Zhou of Ant-financial Light-Year Security Lab

Entry added June 21, 2018

**CUPS**

Available for: macOS High Sierra 10.13.4

Impact: A local process may modify other processes without entitlement checks

Description: An issue existed in CUPS. This issue was addressed with improved access restrictions.

CVE-2018-4180: Dan Bastone of Gotham Digital Science

Entry added July 11, 2018

**CUPS**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to read arbitrary files as root

Description: An issue existed in CUPS. This issue was addressed with improved access restrictions.

CVE-2018-4181: Eric Rafaloff and John Dunlap of Gotham Digital Science

Entry added July 11, 2018

**CUPS**

Available for: macOS High Sierra 10.13.4

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: An access issue was addressed with additional sandbox restrictions on CUPS.

CVE-2018-4182: Dan Bastone of Gotham Digital Science

Entry added July 11, 2018

**CUPS**

Available for: macOS High Sierra 10.13.4

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: An access issue was addressed with additional sandbox restrictions.

CVE-2018-4183: Dan Bastone and Eric Rafaloff of Gotham Digital Science

Entry added July 11, 2018

**EFI**

Available for: macOS High Sierra 10.13.4

Impact: An attacker with physical access to a device may be able to elevate privileges

Description: A validation issue was addressed with improved logic.

CVE-2018-4478: an anonymous researcher, an anonymous researcher, Ben Erickson of Trusted Computer Consulting, LLC

Entry added February 15, 2019

**Firmware**

Available for: macOS High Sierra 10.13.4

Impact: A malicious application with root privileges may be able to modify the EFI flash memory region

Description: A device configuration issue was addressed with an updated configuration.

CVE-2018-4251: Maxim Goryachy and Mark Ermolov

**FontParser**

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.4

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: A memory corruption issue was addressed with improved validation.

CVE-2018-4211: Proteas of Qihoo 360 Nirvan Team

**Grand Central Dispatch**

Available for: macOS High Sierra 10.13.4

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: An issue existed in parsing entitlement plists. This issue was addressed with improved input validation.

CVE-2018-4229: Jakob Rieck (@0xdead10cc) of the Security in Distributed Systems Group, University of Hamburg

**Graphics Drivers**

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.4

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2018-4159: Axis and pjf of IceSword Lab of Qihoo 360

**Hypervisor**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption vulnerability was addressed with improved locking.

CVE-2018-4242: Zhuo Liang of Qihoo 360 Nirvan Team

Entry added October 30, 2018

**iBooks**

Available for: macOS High Sierra 10.13.4

Impact: An attacker in a privileged network position may be able to spoof password prompts in iBooks

Description: An input validation issue was addressed with improved input validation.

CVE-2018-4202: Jerry Decime

**Identity Services**

Available for: macOS High Sierra 10.13.4

Impact: A malicious application may be able to access local users AppleIDs

Description: A privacy issue in the handling of Open Directory records was addressed with improved indexing.

CVE-2018-4217: Jacob Greenfield of Commonwealth School

Entry added December 10, 2018

**Intel Graphics Driver**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2018-4141: an anonymous researcher, Zhao Qixun (@S0rryMybad) of Qihoo 360 Vulcan Team

**IOFireWireAVC**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A race condition was addressed with improved locking.

CVE-2018-4228: Benjamin Gnahm (@mitp0sh) of Mentor Graphics

**IOGraphics**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4236: Zhao Qixun(@S0rryMybad) of Qihoo 360 Vulcan Team

**IOHIDFamily**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4234: Proteas of Qihoo 360 Nirvan Team

**Kernel**

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4249: Kevin Backhouse of Semmle Ltd.

Entry updated December 18, 2018

**Kernel**

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6

Impact: A malicious application may be able to execute arbitrary code with kernel privileges

Description: In some circumstances, some operating systems may not expect or properly handle an Intel architecture debug exception after certain instructions. The issue appears to be from an undocumented side effect of the instructions. An attacker might utilize this exception handling to gain access to Ring 0 and access sensitive memory or control operating system processes.

CVE-2018-8897: Andy Lutomirski, Nick Peterson (linkedin.com/in/everdox) of Everdox Tech LLC

**Kernel**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A buffer overflow was addressed with improved bounds checking.

CVE-2018-4241: Ian Beer of Google Project Zero

CVE-2018-4243: Ian Beer of Google Project Zero

**libxpc**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to gain elevated privileges

Description: A logic issue was addressed with improved validation.

CVE-2018-4237: Samuel Groß (@5aelo) working with Trend Micro’s Zero Day Initiative

**libxpc**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4404: Samuel Groß (@5aelo) working with Trend Micro’s Zero Day Initiative

Entry added October 30, 2018

**Mail**

Available for: macOS High Sierra 10.13.4

Impact: An attacker may be able to exfiltrate the contents of S/MIME- encrypted e-mail

Description: An issue existed in the handling of encrypted Mail. This issue was addressed with improved isolation of MIME in Mail.

CVE-2018-4227: Damian Poddebniak of Münster University of Applied Sciences, Christian Dresen of Münster University of Applied Sciences, Jens Müller of Ruhr University Bochum, Fabian Ising of Münster University of Applied Sciences, Sebastian Schinzel of Münster University of Applied Sciences, Simon Friedberger of KU Leuven, Juraj Somorovsky of Ruhr University Bochum, Jörg Schwenk of Ruhr University Bochum

**Messages**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to conduct impersonation attacks

Description: An injection issue was addressed with improved input validation.

CVE-2018-4235: Anurodh Pokharel of Salesforce.com

**Messages**

Available for: macOS High Sierra 10.13.4

Impact: Processing a maliciously crafted message may lead to a denial of service

Description: This issue was addressed with improved message validation.

CVE-2018-4240: Sriram (@Sri\_Hxor) of PrimeFort Pvt. Ltd

**NVIDIA Graphics Drivers**

Available for: macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A race condition was addressed with improved locking.

CVE-2018-4230: Ian Beer of Google Project Zero

**Security**

Available for: macOS High Sierra 10.13.4

Impact: Users may be tracked by malicious websites using client certificates

Description: An issue existed in the handling of S-MIME certificates. This issue was addressed with improved validation of S-MIME certificates.

CVE-2018-4221: Damian Poddebniak of Münster University of Applied Sciences, Christian Dresen of Münster University of Applied Sciences, Jens Müller of Ruhr University Bochum, Fabian Ising of Münster University of Applied Sciences, Sebastian Schinzel of Münster University of Applied Sciences, Simon Friedberger of KU Leuven, Juraj Somorovsky of Ruhr University Bochum, Jörg Schwenk of Ruhr University Bochum

**Security**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to read a persistent account identifier

Description: An authorization issue was addressed with improved state management.

CVE-2018-4223: Abraham Masri (@cheesecakeufo)

**Security**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to read a persistent device identifier

Description: An authorization issue was addressed with improved state management.

CVE-2018-4224: Abraham Masri (@cheesecakeufo)

**Security**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to modify the state of the Keychain

Description: An authorization issue was addressed with improved state management.

CVE-2018-4225: Abraham Masri (@cheesecakeufo)

**Security**

Available for: macOS High Sierra 10.13.4

Impact: A local user may be able to view sensitive user information

Description: An authorization issue was addressed with improved state management.

CVE-2018-4226: Abraham Masri (@cheesecakeufo)

**Speech**

Available for: macOS High Sierra 10.13.4

Impact: A sandboxed process may be able to circumvent sandbox restrictions

Description: A sandbox issue existed in the handling of microphone access. This issue was addressed with improved handling of microphone access.

CVE-2018-4184: Jakob Rieck (@0xdead10cc) of the Security in Distributed Systems Group, University of Hamburg

**UIKit**

Available for: macOS High Sierra 10.13.4

Impact: Processing a maliciously crafted text file may lead to a denial of service

Description: A validation issue existed in the handling of text. This issue was addressed with improved validation of text.

CVE-2018-4198: Hunter Byrnes

**Windows Server**

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.4

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2018-4193: Markus Gaasedelen, Amy Burnett, and Patrick Biernat of Ret2 Systems, Inc working with Trend Micro’s Zero Day Initiative, Richard Zhu (fluorescence) working with Trend Micro’s Zero Day Initiative

Entry updated October 8, 2019

Tag

#google