tvOS 14.7 Security Update Advisory (Multiple CVEs)

tvOS 14.7 Security Content Summary Release Date: July 19, 2021 Device Coverage: Apple TV 4K and Apple TV HD Key Vulnerabilities 1. Analytics - CVE: CVE-2021-30871 - Impact: Local attacker may access analytics data. 2. App Store - CVE: CVE-2021-31006 - Impact: Malicious app may bypass Privacy preferences. 3. Audio - CVE: CVE-2021-30781 - Impact: Local attacker may cause unexpected application termination or arbitrary code execution. 4. AVEVideoEncoder - CVE: CVE-2021-30748 - Impact: Application may execute arbitrary code with kernel privileges. 5. CoreAudio - CVE: CVE-2021-30776 - Impact: Processing a malicious audio file may lead to arbitrary code execution. 6. CoreText - CVE: CVE-2021-30789 - Impact: Processing a malicious font file may lead to arbitrary code execution. 7. Crash Reporter - CVE: CVE-2021-30774 - Impact: Malicious application may gain root privileges. 8. CVMS - CVE: CVE-2021-30780 - Impact: Malicious application may gain root privileges. 9. dyld - CVE: CVE-2021-30768 - Impact: Sandboxed process may circumvent sandbox restrictions. 10. FontParser - CVEs: CVE-2021-30760, CVE-2021-30759, CVE-2021-30788 - Impact: Processing malicious font/tiff files may lead to arbitrary code execution or denial-of-service. Recognitions Various components like WebKit, Audio, and Sysdiagnose include contributions and fixes reported by external researchers and security teams. This document outlines multiple security improvements and fixes for various CVEs, addressing potential risks specific to different components used in Apple TV.

Goal Reached Thanks to every supporter — we hit 100%!

tvOS 14.7 Security Update Advisory (Multiple CVEs)