SB2019121838 - Multiple vulnerabilities in Apple watchOS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2019-8747)

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in watchOS 6.1. An application may be able to execute arbitrary code with kernel privileges.

2) Buffer overflow (CVE-ID: CVE-2019-8750)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in watchOS 6.1, iCloud for Windows 11.0. Multiple issues in libxslt.

Remediation

Install update from vendor's website.

References

• https://support.apple.com/HT210724
• https://support.apple.com/HT210727