Apple watchOS 6 Security Update Bulletin (Multiple CVE Fixes)

Key Information Summary Release Date - watchOS 6: September 19, 2019 Affected Scope - Apple Watch Series 3 and later models Vulnerability Details - Audio - CVE-2019-8706: Malicious audio files could lead to arbitrary code execution (Yu Zhou) - CVE-2019-8850: Malicious audio files could lead to leakage of restricted memory - CFNetwork - CVE-2019-8753: Malicious network content could lead to cross-site scripting attacks, resolved via improved input validation - CoreAudio - CVE-2019-8705: Malicious movie files could lead to process memory leakage - CoreCrypto - CVE-2019-8741: Large input could cause denial of service, resolved via improved input validation - Foundation - CVE-2019-8746: Remote attackers could cause unexpected application termination or arbitrary code execution - IOUSBDeviceFamily - CVE-2019-8718: Memory corruption issue resolved via improved memory handling - Kernel - Multiple CVEs, including CVE-2019-8809, CVE-2019-8712, etc., addressing memory corruption and privilege escalation issues - libxml2 - CVE-2019-8749 and CVE-2019-8756: Multiple memory corruption issues resolved via improved input validation - mDNSResponder - CVE-2019-8799: Physical proximity attackers could passively observe device names, resolved via randomized identifiers - UIFoundation - CVE-2019-8745 and CVE-2019-8831: Buffer overflow and memory corruption issues resolved respectively - WebKit - Multiple CVEs, including CVE-2019-8710, CVE-2019-8728, etc., addressing arbitrary code execution caused by malicious web content - Wi-Fi - CVE-2019-8854: User privacy issue resolved by removing broadcast MAC address Contributor Acknowledgments - Multiple components list researchers and teams who discovered vulnerabilities or provided assistance, such as VulWar Corp, Google Project Zero, etc.

Goal Reached Thanks to every supporter — we hit 100%!

Apple watchOS 6 Security Update Bulletin (Multiple CVE Fixes)