tvOS 14.3 Security Update Advisory (Multiple CVEs in Audio/WebKit/Wi-Fi)

Key Vulnerability Information Summary Document Description: Describes the security content of tvOS 14.3. Key Vulnerabilities Audio Impact: Processing malicious audio files may lead to limited memory disclosure. CVE ID: CVE-2020-29610 Fix: Improved input validation. CoreAudio Impact: Processing malicious audio files may lead to arbitrary code execution. CVE ID: CVE-2020-27948 Fix: Improved boundary checks. FontParser Impact: Remote attackers may disclose memory. CVE ID: CVE-2020-29608 Fix: Improved boundary checks. Impact: Processing malicious font files may lead to arbitrary code execution. CVE ID: CVE-2020-27943, CVE-2020-27944, CVE-2020-29624 Fix: Improved state management and input validation. ImageIO Impact: Processing malicious images may lead to denial of service, heap corruption, and arbitrary code execution. CVE ID: CVE-2020-29615, CVE-2020-29617, CVE-2020-29618, CVE-2020-29611 Fix: Improved input validation. Model I/O Impact: Processing malicious files may lead to heap corruption. CVE ID: CVE-2020-29614 Fix: Improved checks. Impact: Processing malicious USD files may lead to unexpected application termination. CVE ID: CVE-2020-9972 Fix: Improved memory handling. WebKit Storage Impact: Users may not be able to fully delete browsing history. CVE ID: CVE-2020-29623 Fix: Improved data deletion. WebRTC Impact: Processing malicious web content may lead to arbitrary code execution. CVE ID: CVE-2020-15969 Fix: Improved memory management. Wi-Fi Impact: Malicious applications may exploit kernel privileges to execute arbitrary code. CVE ID: CVE-2021-31077 Fix: Improved size validation. Release Date Document Release Date: November 2, 2023. Acknowledgments CoreAudio: Thanks to JunDong Xie and Xingwei Lin from Ant Security Light-Year Lab for their assistance.

Goal Reached Thanks to every supporter — we hit 100%!

tvOS 14.3 Security Update Advisory (Multiple CVEs in Audio/WebKit/Wi-Fi)