tvOS 13.4.8 Security Update Advisory: RCE and DoS Fixes (CVE-2020-9884, CVE-2020-9889, CVE-2020-9907)

Security Content in tvOS 13.4.8 Critical Vulnerability Information 1. Audio CVE-2020-9884: Processing maliciously crafted audio files may lead to arbitrary code execution. CVE-2020-9889: Anonymous work with Trend Micro's Zero Day Initiative; described as a memory corruption issue leading to arbitrary code execution. 2. AVEVideoEncoder CVE-2020-9907: Applications may execute arbitrary code with kernel privileges; memory corruption issue resolved by removing vulnerable code. 3. CoreGraphics CVE-2020-9883: Processing maliciously crafted images may lead to arbitrary code execution; memory corruption issue resolved by improved memory handling. 4. Crash Reporter CVE-2020-9865: Malicious applications may bypass sandbox; memory corruption issue resolved by removing vulnerable code. 5. FontParser CVE-2020-9980: Processing maliciously crafted font files may lead to arbitrary code execution; boundary check issue resolved by improved handling. 6. IAP CVE-2020-9914: Attackers with privileged network positions may perform DoS attacks using malformed Bluetooth packets; input validation issue resolved by improvements. 7. ImageIO CVE-2020-9871: Processing maliciously crafted images may lead to arbitrary code execution; memory corruption issue resolved by improved checks. 8. Kernel CVE-2019-14899: Routing issue resolved by improved restrictions. CVE-2020-9909: Boundary check issue resolved by improvements. 9. Wi-Fi CVE-2020-9918: Boundary check issue resolved by improved input validation, preventing remote DoS attacks. Release Date November 3, 2023 Conclusion This update fixes critical vulnerabilities affecting multiple components including audio, video encoding, images, font parsing, and the kernel, primarily involving arbitrary code execution, memory corruption, and DoS attacks.

Goal Reached Thanks to every supporter — we hit 100%!

tvOS 13.4.8 Security Update Advisory: RCE and DoS Fixes (CVE-2020-9884, CVE-2020-9889, CVE-2020-9907)