watchOS 6.1.1 Security Update Advisory (Multiple CVEs)

Security Content in watchOS 6.1.1 Apple Security Update Overview Apple does not discuss security issues publicly until they have been investigated and resolved. The latest security updates can be found on the Apple security updates page. Security advisories typically use CVE-ID to identify vulnerabilities. watchOS 6.1.1 Update Information Release Date: December 10, 2019 Vulnerability Details CallKit - Impact: Siri-initiated calls may use incorrect cellular data plans. - Description: Fixed an issue in the API when handling outbound calls initiated via Siri. - CVE-2019-8856 CFNetwork - Impact: An attacker with network privileges may bypass HSTS. - Description: Resolved by adding restrictions to address configuration issues. - CVE-2019-8834 CFNetwork Proxies - Impact: Applications may gain elevated privileges. - Description: Resolved by improving validation checks. - CVE-2019-8848 FaceTime - Impact: Processing malicious video content may lead to arbitrary code execution. - Description: Fixed a buffer overflow issue by improving input validation. - CVE-2019-8830 Kernel - Impact: Applications may execute arbitrary code with kernel privileges. - Description: Fixed memory corruption by removing vulnerable code. - CVE-2019-8833, CVE-2019-8828, CVE-2019-8838 libexpat - Impact: Parsing malicious XML files may lead to user information disclosure. - Description: Updated to expat 2.2.8 to resolve the issue. - CVE-2019-15903 libpcap - Impact: Multiple issues exist in libpcap. - Description: Updated to libpcap 1.9.1 to resolve these issues. - CVE-2019-15161 to CVE-2019-15165 Security - Impact: Applications may execute arbitrary code with system privileges. - Description: Fixed memory corruption by improving memory handling. - CVE-2019-8832 WebKit - Impact: Processing malicious web content may lead to arbitrary code execution. - Description: Fixed multiple memory corruption issues by improving memory handling. - CVE-2019-8844 Acknowledgments The document also lists individuals and teams who contributed to the discovery and resolution of these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

watchOS 6.1.1 Security Update Advisory (Multiple CVEs)