tvOS 17 Security Update Advisory (Multiple CVEs including RCE/LPE)

Key Information tvOS 17: Released on September 18, 2023. Airport: Fixed a vulnerability allowing remote reading of sensitive location information (CVE-2023-40368). App Store: Fixed a vulnerability that could allow remote attackers to bypass Web content sandboxing (CVE-2023-40454). Apple Neural Engine: Fixed multiple vulnerabilities enabling arbitrary code execution and kernel privilege escalation (CVE-2023-40398, CVE-2023-40474, CVE-2023-40494, CVE-2023-40402). AuthKit: Fixed a vulnerability allowing access to user-sensitive data (CVE-2023-32385). Bluetooth: Fixed a vulnerability causing limited out-of-bounds writes in physical proximity (CVE-2023-38886). bootip: Fixed a vulnerability allowing reading of sensitive location information (CVE-2023-40905). CFNetwork: Fixed a denial-of-service vulnerability in secure transport (CVE-2023-38906). CoreAnimation: Fixed memory management issues during cache handling (CVE-2023-40390). Core Data: Fixed a vulnerability leaking privacy preferences (CVE-2023-40528). DevTools: Fixed a vulnerability enabling privilege escalation (CVE-2023-32398). Game Center: Fixed a vulnerability allowing access to contacts (CVE-2023-40529). GPUSurface: Fixed a vulnerability enabling kernel memory deletion (CVE-2023-40399). iCloudUserDaemon: Fixed vulnerabilities enabling arbitrary code execution and kernel privilege escalation (CVE-2023-40400). Kernel: Fixed a vulnerability bypassing kernel memory mitigations (CVE-2023-40404). libpcap: Fixed vulnerabilities allowing unauthorized termination or arbitrary code execution (CVE-2023-40400). libxslt: Fixed a vulnerability disclosing sensitive information during web content processing (CVE-2023-40435). Maps: Fixed a vulnerability allowing reading of sensitive location information (CVE-2023-40436). MobileBridgeMounter: Fixed a vulnerability enabling privilege escalation (CVE-2023-40406). Photos: Fixed vulnerabilities related to saving photos to temporary directories (CVE-2023-40438, CVE-2023-40450). Pre Res: Fixed vulnerabilities enabling arbitrary code execution and kernel privilege escalation (CVE-2023-40503). Sandbox: Fixed a vulnerability allowing access to arbitrary files (CVE-2023-40452). StorageKit: Fixed a vulnerability allowing reading of arbitrary files (CVE-2023-40470). WebKit: Fixed multiple vulnerabilities enabling arbitrary code execution (CVE-2023-39343, CVE-2023-40424, CVE-2023-40395).

Goal Reached Thanks to every supporter — we hit 100%!

tvOS 17 Security Update Advisory (Multiple CVEs including RCE/LPE)