Apple watchOS 10 Security Update Advisory: Multiple CVEs (RCE, KPE, Info Disclosure)

Critical Vulnerability Information Affected Scope watchOS 10: Applies to Apple Watch Series 4 and later models. Vulnerability Details 1. App Store - CVE-2023-40486: Remote attackers may exploit this vulnerability to bypass the Web Content sandbox. - Fix: Improved protocol handling. 2. Apple Neural Engine - CVE-2023-40570: Could lead to arbitrary code execution or kernel privilege escalation. - Description: Improper memory management. - Fix: Improved memory management. 3. AuthKit - CVE-2023-39984: Could result in leakage of sensitive user data. - Description: Improper handling. - Fix: Improved handling. 4. Bluetooth - CVE-2023-40584: Limited write operations possible with physical proximity. - Description: Insufficient validation. - Fix: Improved validation checks. 5. CFNetwork - CVE-2023-39986: Could allow bypassing Transport Security. - Description: Improper protocol handling. - Fix: Improved protocol handling. 6. CoreAnimation - CVE-2023-40493: Processing malicious content may cause denial of service. - Description: Improper memory management. - Fix: Improved memory management. 7. Core Data - CVE-2023-39996: Could lead to leakage of private data in log entries. - Description: Inadequate data protection. - Fix: Improved data protection. 8. Dev Tools - CVE-2023-40395: Could result in privilege escalation. - Description: Improper handling. - Fix: Improved handling. 9. Game Center - CVE-2023-40400: Could lead to access control issues. - Description: Improper handling. - Fix: Improved handling. 10. IOUserEthernet - CVE-2023-40507: Could lead to arbitrary code execution and kernel privilege escalation. - Description: Improper memory management. - Fix: Improved memory management. 11. Kernel - CVE-2023-40429: Could result in kernel memory corruption. - Description: Insufficient validation. - Fix: Improved validation. 12. libcap - CVE-2023-40454: Could lead to unauthorized terminal access or arbitrary code execution. - Description: Insufficient checks. - Fix: Improved checks. 13. libzip - CVE-2023-40456: Could result in file deletion. - Description: Improper permission management. - Fix: Improved permission management. 14. libxml - CVE-2023-40458: Could lead to sensitive information disclosure. - Description: Improper memory management. - Fix: Improved memory management. 15. Maps - CVE-2023-40401: Could result in leakage of sensitive location information. - Description: Buffer overflow. - Fix: Improved buffer management. 16. MobileConfiguration - CVE-2023-40418: Could lead to privilege escalation. - Description: Improper access control. - Fix: Improved access control. 17. Passcode - CVE-2023-40395: Lock screen on Apple Watch Ultra may be bypassed by Deep app. - Description: Improper state management. - Fix: Improved state management. 18. Photos - CVE-2023-40486: Could result in photos being saved to temporary directory. - Description: Inadequate data protection. - Fix: Improved data protection. 19. Photos Storage - CVE-2023-40486: Could result in photos being saved to temporary directory. - Description: Inadequate data protection. - Fix: Improved data protection. 20. Safari - CVE-2023-40477: Could allow detection of other app installations. - Description: Insufficient checks. - Fix: Improved checks. 21. ScreenTime - CVE-2023-40430: Could result in excessive file restrictions. - Description: Insufficient checks. - Fix: Improved checks. 22. Share Sheet - CVE-2023-40434: Could lead to sensitive data disclosure. - Description: Insufficient checks. - Fix: Improved checks. 23. Simulator - CVE-2023-40438: Could result in privilege escalation. - Description: Insufficient checks. - Fix: Improved checks. 24. SoftwareUpdate - CVE-2023-40576: Could lead to arbitrary code execution. - Description: Improper memory management. - Fix: Improved memory management. 25. WebKit - CVE-2023-40576: Could lead to arbitrary code execution. - Description: Improper memory management. - Fix: Improved memory management. ``` These vulnerabilities cover a wide range of security issues from kernel-level to application-level, involving memory management, permission control, data protection, and more. Promptly updating the system to apply these fixes is crucial.

Goal Reached Thanks to every supporter — we hit 100%!

Apple watchOS 10 Security Update Advisory: Multiple CVEs (RCE, KPE, Info Disclosure)