tvOS 18.6 Security Update: Fixes Multiple CVEs in WebKit/CoreAudio/libxml2

Critical Vulnerability Information tvOS 18.6 Update Details Release Date: August 29, 2023 Fixed multiple security vulnerabilities affecting the following components: afcldp Impact: Apple TV HD and Apple TV 4K (1st generation models) Description: Memory corruption issue when processing maliciously crafted files. CVE: CVE-2023-35701 CFNetwork Impact: Apple TV HD and Apple TV 4K (1st generation models) Description: Memory corruption issue when processing maliciously crafted files. CVE: CVE-2023-35328 CoreAudio Impact: Apple TV HD and Apple TV 4K (all models) Description: Memory corruption when processing maliciously crafted audio data. CVE: CVE-2023-40227 CoreMedia Impact: Apple TV HD and Apple TV 4K (1st generation models) Description: May lead to unexpected execution flow and process termination or crash when processing maliciously crafted media files. CVE: CVE-2023-35706 CoreMedia Playback Impact: Apple TV HD and Apple TV 4K (1st generation models) Description: Malicious actors could exploit this vulnerability to access user data. CVE: CVE-2023-35730 ICU Impact: Apple TV HD and Apple TV 4K (all models) Description: May lead to unexpected execution flow and process termination or crash when processing maliciously crafted internationalization content. CVE: CVE-2023-35201 ImageIO Impact: Apple TV HD and Apple TV 4K (all models) Description: Memory corruption when processing maliciously crafted content. CVE: CVE-2023-40220 libxml2 Impact: Apple TV HD and Apple TV 4K (all models) Description: Memory corruption when processing maliciously crafted content. CVE: CVE-2023-35745, CVE-2023-35746 llshtt Impact: Apple TV HD and Apple TV 4K (all models) Description: Memory corruption when processing maliciously crafted content. CVE: CVE-2023-35250 Metal Impact: Apple TV HD and Apple TV 4K (all models) Description: May lead to unexpected execution flow and process termination or crash when processing maliciously crafted content. CVE: CVE-2023-35226, CVE-2023-35227 Model I/O Impact: Apple TV HD and Apple TV 4K (all models) Description: May lead to unexpected execution flow and process termination or crash when processing maliciously crafted content. CVE: CVE-2023-35224, CVE-2023-35225 WebKit Impact: Apple TV HD and Apple TV 4K (all models) Description: Memory corruption when processing maliciously crafted content. CVE: CVE-2023-35278, CVE-2023-35279, CVE-2023-35280 Additional Recognition Bluetooth: Thanks to Liang Li, Wang Shuo, Dong Chen, and Cross of Source Code for discovering this vulnerability. CoreAudio: Thanks to Peter Wang for discovering this vulnerability. libxml2: Thanks to Google Project Zero for assistance. llshtt: Thanks to Google Project Zero for assistance. WebKit: Thanks to Google Security Team, Yuhao Hu, Yan Kang, Chengpeng Wu, and Xiaoqi Wei for discovering this vulnerability. ``` This summary outlines the critical vulnerabilities fixed in the tvOS 18.6 update, including their impact scope and descriptions.

Goal Reached Thanks to every supporter — we hit 100%!

tvOS 18.6 Security Update: Fixes Multiple CVEs in WebKit/CoreAudio/libxml2