VARIoT IoT vulnerabilities database

An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. macOS Has an out-of-bounds reading vulnerability due to a lack of input validation.Information is obtained and service operation is interrupted (DoS) There is a possibility of being put into a state. Apple macOS Mojave is a set of dedicated operating systems developed by Apple for Mac computers. Intel Graphics Driver is one of the integrated graphics drivers. The vulnerability stems from incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in execution to other associated memory locations. erroneous read and write operations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-2 macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra are now available and addresses the following: Airport Available for: macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) AMD Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4462: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team Carbon Core Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4463: Maksymilian Arciemowicz (cxsecurity.com) Disk Images Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team Intel Graphics Driver Available for: macOS Mojave 10.14.1 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2018-4434: Zhuo Liang of Qihoo 360 Nirvan Team IOHIDFamily Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4427: Pangu Team Kernel Available for: macOS Mojave 10.14.1 Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero WindowServer Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. NetAuth We would like to acknowledge Vladimir Ivanov of Digital Security for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance. Installation note: macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3FxTw// fUx30FH3eQXRRc/dlM5LgBdDqx/TOHtSwjiTLkVRHC1czz9ledAmHmGkg00z6b+p 5LsZNaZRUF3FVxuWUcm0rQQ+MpSj+BpCDZX0X+pXHX+QvNjad8ZcQsIqjtnJ1omZ jr2eUQtnkmbnaFX+TiesIN8tGBQ2Gve1/fqzrXdpqlF6j9U76gw4djI4JbAnLGxH IzjIp1FukQy1phfZZcHd++aEHvsQeJ0bT0INajqtNOkDQSZ0H7/NIW1BoUQlcpLG cqz+dwTYFwfqvNUmQ5PUTFXQJHxiVBRgMDdyesrVSKSuvEqTNAQKCOXMxayVbotf LBlghqpPr2XTS7enRkY87BU+aSdTTzjTX7fvQBOQgAJPb7L3FXhA/dCTHWV3RyWY 1qrTFOIvbfAtCjsBIqHC0nD5GWXB7vuxPvcYQXlNYl/MxMv3vAANHi8aI+YJ8Usp 6qLLD02Z4H4E8ZpmakqqFJT6ORGUIBpvqG9rYxhACTe/z2uqZ7scD4I4crpfPIIk WRyh17q87z+dTCIS4P9PbYdrx7Y8SHN8K9uaBmZVq9WqaAVtCet9S0zNBrLai2Sj ar3y5Sgso7RMI5KhB0IGNyS2LZL0a3ypQVfVEWpxoRjIHyI2sJSPAuXOLrwV6pRU +61jWoLyn0cbMWMEhfrw/ulTOcMBjIXV7EHZNge8H5Ex+L -----END PGP SIGNATURE-----

A certificate validation issue existed in configuration profiles. This was addressed with additional checks. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple watchOS is a smart watch operating system. A trust management issue vulnerability exists in the Profiles component of several Apple products. This vulnerability stems from the lack of an effective trust management mechanism in network systems or products. Attackers can use default passwords or hard-coded passwords, hard-coded certificates, etc. to attack affected components. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE-----

A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. FaceTime is one of those video calling software. An information disclosure vulnerability exists in the FaceTime component of Apple iOS prior to 12.1.1. This vulnerability stems from configuration errors in network systems or products during operation. An unauthorized attacker could exploit the vulnerability to obtain sensitive information of the affected components. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE-----

A logic issue was addressed with improved restrictions. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. plural Apple The product contains a logic vulnerability due to a flaw in handling restrictions.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of the shared memory module (shm). The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges in the context of the kernel. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Kernel is one of the kernel components. An input validation error vulnerability exists in the Kernel component of several Apple products. The vulnerability stems from the failure of the network system or product to properly validate the input data. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE----- . CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance

A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Kernel is one of the kernel components. Kernel components in several Apple products have information disclosure vulnerabilities. This vulnerability stems from configuration errors in network systems or products during operation. An unauthorized attacker could exploit the vulnerability to obtain sensitive information of the affected components. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE----- . CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance

A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. iOS and watchOS of URL There is a spoofing vulnerability in the process of because there is a flaw in the process related to input validation.There is a possibility of being impersonated. Both Apple iOS and Apple watchOS are products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices. Apple watchOS is a smart watch operating system. LinkPresentation is one of the presentation display components. The vulnerability stems from the failure of the network system or product to properly validate the input data. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE-----

An input validation issue was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14, iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. plural Apple The product contains an input validation vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Airport is one of the wireless access components. An input validation error vulnerability exists in the Airport component of several Apple products. The vulnerability stems from the failure of the network system or product to properly validate the input data. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE----- . CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. macOS Mojave Contains a memory corruption vulnerability due to a flaw in memory handling.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. macOS Mojave is a different version of a dedicated operating system developed specifically for Mac computers. A security vulnerability exists in the Carbon Core component of Apple macOS Mojave prior to 10.14.2. An attacker could exploit this vulnerability to execute arbitrary code with system privileges. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-2 macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra are now available and addresses the following: Airport Available for: macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) AMD Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4462: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team Carbon Core Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4463: Maksymilian Arciemowicz (cxsecurity.com) Disk Images Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team Intel Graphics Driver Available for: macOS Mojave 10.14.1 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2018-4434: Zhuo Liang of Qihoo 360 Nirvan Team IOHIDFamily Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4427: Pangu Team Kernel Available for: macOS Mojave 10.14.1 Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero WindowServer Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. NetAuth We would like to acknowledge Vladimir Ivanov of Digital Security for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance. Installation note: macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3FxTw// fUx30FH3eQXRRc/dlM5LgBdDqx/TOHtSwjiTLkVRHC1czz9ledAmHmGkg00z6b+p 5LsZNaZRUF3FVxuWUcm0rQQ+MpSj+BpCDZX0X+pXHX+QvNjad8ZcQsIqjtnJ1omZ jr2eUQtnkmbnaFX+TiesIN8tGBQ2Gve1/fqzrXdpqlF6j9U76gw4djI4JbAnLGxH IzjIp1FukQy1phfZZcHd++aEHvsQeJ0bT0INajqtNOkDQSZ0H7/NIW1BoUQlcpLG cqz+dwTYFwfqvNUmQ5PUTFXQJHxiVBRgMDdyesrVSKSuvEqTNAQKCOXMxayVbotf LBlghqpPr2XTS7enRkY87BU+aSdTTzjTX7fvQBOQgAJPb7L3FXhA/dCTHWV3RyWY 1qrTFOIvbfAtCjsBIqHC0nD5GWXB7vuxPvcYQXlNYl/MxMv3vAANHi8aI+YJ8Usp 6qLLD02Z4H4E8ZpmakqqFJT6ORGUIBpvqG9rYxhACTe/z2uqZ7scD4I4crpfPIIk WRyh17q87z+dTCIS4P9PbYdrx7Y8SHN8K9uaBmZVq9WqaAVtCet9S0zNBrLai2Sj ar3y5Sgso7RMI5KhB0IGNyS2LZL0a3ypQVfVEWpxoRjIHyI2sJSPAuXOLrwV6pRU +61jWoLyn0cbMWMEhfrw/ulTOcMBjIXV7EHZNge8H5Ex+L -----END PGP SIGNATURE-----

A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of the getPixelInformationFromTiming method. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before reading from memory. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges in the context of the kernel. Apple macOS Mojave is a set of dedicated operating systems developed by Apple for Mac computers. AMD is one of the components used in AMD products. The vulnerability stems from the failure of the network system or product to properly validate the input data. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-2 macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra are now available and addresses the following: Airport Available for: macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) AMD Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4462: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team Carbon Core Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4463: Maksymilian Arciemowicz (cxsecurity.com) Disk Images Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team Intel Graphics Driver Available for: macOS Mojave 10.14.1 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2018-4434: Zhuo Liang of Qihoo 360 Nirvan Team IOHIDFamily Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4427: Pangu Team Kernel Available for: macOS Mojave 10.14.1 Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero WindowServer Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. NetAuth We would like to acknowledge Vladimir Ivanov of Digital Security for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance. Installation note: macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3FxTw// fUx30FH3eQXRRc/dlM5LgBdDqx/TOHtSwjiTLkVRHC1czz9ledAmHmGkg00z6b+p 5LsZNaZRUF3FVxuWUcm0rQQ+MpSj+BpCDZX0X+pXHX+QvNjad8ZcQsIqjtnJ1omZ jr2eUQtnkmbnaFX+TiesIN8tGBQ2Gve1/fqzrXdpqlF6j9U76gw4djI4JbAnLGxH IzjIp1FukQy1phfZZcHd++aEHvsQeJ0bT0INajqtNOkDQSZ0H7/NIW1BoUQlcpLG cqz+dwTYFwfqvNUmQ5PUTFXQJHxiVBRgMDdyesrVSKSuvEqTNAQKCOXMxayVbotf LBlghqpPr2XTS7enRkY87BU+aSdTTzjTX7fvQBOQgAJPb7L3FXhA/dCTHWV3RyWY 1qrTFOIvbfAtCjsBIqHC0nD5GWXB7vuxPvcYQXlNYl/MxMv3vAANHi8aI+YJ8Usp 6qLLD02Z4H4E8ZpmakqqFJT6ORGUIBpvqG9rYxhACTe/z2uqZ7scD4I4crpfPIIk WRyh17q87z+dTCIS4P9PbYdrx7Y8SHN8K9uaBmZVq9WqaAVtCet9S0zNBrLai2Sj ar3y5Sgso7RMI5KhB0IGNyS2LZL0a3ypQVfVEWpxoRjIHyI2sJSPAuXOLrwV6pRU +61jWoLyn0cbMWMEhfrw/ulTOcMBjIXV7EHZNge8H5Ex+L -----END PGP SIGNATURE-----

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. plural Apple The product has a memory corruption vulnerability due to incomplete memory handling.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. in the United States. Apple iOS is an operating system developed for mobile devices. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Disk Images is one of the disk image format components. An attacker could exploit this vulnerability to execute arbitrary code with kernel privileges. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE----- . CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. macOS Mojave Contains a memory corruption vulnerability due to a flaw in memory handling.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-2 macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra are now available and addresses the following: Airport Available for: macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) AMD Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4462: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team Carbon Core Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4463: Maksymilian Arciemowicz (cxsecurity.com) Disk Images Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team Intel Graphics Driver Available for: macOS Mojave 10.14.1 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2018-4434: Zhuo Liang of Qihoo 360 Nirvan Team IOHIDFamily Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4427: Pangu Team Kernel Available for: macOS Mojave 10.14.1 Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero WindowServer Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. NetAuth We would like to acknowledge Vladimir Ivanov of Digital Security for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance. Installation note: macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3FxTw// fUx30FH3eQXRRc/dlM5LgBdDqx/TOHtSwjiTLkVRHC1czz9ledAmHmGkg00z6b+p 5LsZNaZRUF3FVxuWUcm0rQQ+MpSj+BpCDZX0X+pXHX+QvNjad8ZcQsIqjtnJ1omZ jr2eUQtnkmbnaFX+TiesIN8tGBQ2Gve1/fqzrXdpqlF6j9U76gw4djI4JbAnLGxH IzjIp1FukQy1phfZZcHd++aEHvsQeJ0bT0INajqtNOkDQSZ0H7/NIW1BoUQlcpLG cqz+dwTYFwfqvNUmQ5PUTFXQJHxiVBRgMDdyesrVSKSuvEqTNAQKCOXMxayVbotf LBlghqpPr2XTS7enRkY87BU+aSdTTzjTX7fvQBOQgAJPb7L3FXhA/dCTHWV3RyWY 1qrTFOIvbfAtCjsBIqHC0nD5GWXB7vuxPvcYQXlNYl/MxMv3vAANHi8aI+YJ8Usp 6qLLD02Z4H4E8ZpmakqqFJT6ORGUIBpvqG9rYxhACTe/z2uqZ7scD4I4crpfPIIk WRyh17q87z+dTCIS4P9PbYdrx7Y8SHN8K9uaBmZVq9WqaAVtCet9S0zNBrLai2Sj ar3y5Sgso7RMI5KhB0IGNyS2LZL0a3ypQVfVEWpxoRjIHyI2sJSPAuXOLrwV6pRU +61jWoLyn0cbMWMEhfrw/ulTOcMBjIXV7EHZNge8H5Ex+L -----END PGP SIGNATURE-----

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. macOS Mojave Contains a memory corruption vulnerability due to a flaw in memory handling.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-2 macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra are now available and addresses the following: Airport Available for: macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) AMD Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4462: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team Carbon Core Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4463: Maksymilian Arciemowicz (cxsecurity.com) Disk Images Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team Intel Graphics Driver Available for: macOS Mojave 10.14.1 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2018-4434: Zhuo Liang of Qihoo 360 Nirvan Team IOHIDFamily Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4427: Pangu Team Kernel Available for: macOS Mojave 10.14.1 Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero WindowServer Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. NetAuth We would like to acknowledge Vladimir Ivanov of Digital Security for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance. Installation note: macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3FxTw// fUx30FH3eQXRRc/dlM5LgBdDqx/TOHtSwjiTLkVRHC1czz9ledAmHmGkg00z6b+p 5LsZNaZRUF3FVxuWUcm0rQQ+MpSj+BpCDZX0X+pXHX+QvNjad8ZcQsIqjtnJ1omZ jr2eUQtnkmbnaFX+TiesIN8tGBQ2Gve1/fqzrXdpqlF6j9U76gw4djI4JbAnLGxH IzjIp1FukQy1phfZZcHd++aEHvsQeJ0bT0INajqtNOkDQSZ0H7/NIW1BoUQlcpLG cqz+dwTYFwfqvNUmQ5PUTFXQJHxiVBRgMDdyesrVSKSuvEqTNAQKCOXMxayVbotf LBlghqpPr2XTS7enRkY87BU+aSdTTzjTX7fvQBOQgAJPb7L3FXhA/dCTHWV3RyWY 1qrTFOIvbfAtCjsBIqHC0nD5GWXB7vuxPvcYQXlNYl/MxMv3vAANHi8aI+YJ8Usp 6qLLD02Z4H4E8ZpmakqqFJT6ORGUIBpvqG9rYxhACTe/z2uqZ7scD4I4crpfPIIk WRyh17q87z+dTCIS4P9PbYdrx7Y8SHN8K9uaBmZVq9WqaAVtCet9S0zNBrLai2Sj ar3y5Sgso7RMI5KhB0IGNyS2LZL0a3ypQVfVEWpxoRjIHyI2sJSPAuXOLrwV6pRU +61jWoLyn0cbMWMEhfrw/ulTOcMBjIXV7EHZNge8H5Ex+L -----END PGP SIGNATURE-----

This issue was addressed with improved entitlements. This issue affected versions prior to iOS 12.1.1. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. iOS Contains a flaw in input validation due to incomplete handling of entitlements.Information may be obtained. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. File Provider is one of the inter-application file sharing components. An input validation error vulnerability exists in the File Provider component of Apple iOS prior to 12.1.1. The vulnerability stems from the failure of the network system or product to properly validate the input data. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE-----

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. in the United States. Apple Safari is a web browser that comes with the default browser on MacOSX and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Safari 12.0.2 may be obtained from the Mac App Store. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE-----

A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. plural Apple The product has a memory corruption vulnerability due to incomplete processing related to input validation.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Kernel is one of the kernel components. A buffer error vulnerability exists in the Kernel component of several Apple products. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE----- . CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance

A denial of service issue was addressed by removing the vulnerable code. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. plural Apple Since the product contains vulnerable code, service disruption (DoS) There are vulnerabilities that are put into a state.Service operation interruption (DoS) There is a possibility of being put into a state. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Kernel is one of the kernel components. An input validation error vulnerability exists in the Kernel component of several Apple products. The vulnerability stems from the failure of the network system or product to properly validate the input data. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE----- . CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance

A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that comes with the default browser on MacOSX and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple iTunes for Windows is a media player application based on the Windows platform. A security vulnerability exists in the Safari component of several Apple products. An attacker could exploit this vulnerability by using a specially crafted website to forge the contents of the address bar. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Safari 12.0.2 may be obtained from the Mac App Store. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE-----

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. plural Apple There are multiple memory corruption vulnerabilities in the product due to flaws in memory handling.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A buffer error vulnerability exists in the WebKit component of several Apple products. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Safari 12.0.2 may be obtained from the Mac App Store. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". ------------------------------------------------------------------------ WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0009 ------------------------------------------------------------------------ Date reported : December 13, 2018 Advisory ID : WSA-2018-0009 WebKitGTK+ Advisory URL : https://webkitgtk.org/security/WSA-2018-0009.html WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2018-0009.html CVE identifiers : CVE-2018-4437, CVE-2018-4438, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464. Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. CVE-2018-4437 Versions affected: WebKitGTK+ before 2.22.5 and WPE WebKit before 2.22.3. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4438 Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1. Credit to lokihardt of Google Project Zero. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4441 Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1. Credit to lokihardt of Google Project Zero. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4442 Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1. Credit to lokihardt of Google Project Zero. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4443 Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1. Credit to lokihardt of Google Project Zero. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4464 Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0. Processing maliciously crafted web content may lead to arbitrary code execution. We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/. The WebKitGTK+ and WPE WebKit team, December 13, 2018 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE-----

A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. This vulnerability allows local attackers to escalate privileges on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of the watchevent system call. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this to escalate privileges in the context of the kernel. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Kernel is one of the kernel components. A buffer error vulnerability exists in the Kernel component of several Apple products. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE----- . CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab Additional recognition LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance. Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A buffer error vulnerability exists in the WebKit component of several Apple products. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Safari 12.0.2 may be obtained from the Mac App Store. CVE-2018-4438: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". ------------------------------------------------------------------------ WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0009 ------------------------------------------------------------------------ Date reported : December 13, 2018 Advisory ID : WSA-2018-0009 WebKitGTK+ Advisory URL : https://webkitgtk.org/security/WSA-2018-0009.html WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2018-0009.html CVE identifiers : CVE-2018-4437, CVE-2018-4438, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464. Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. CVE-2018-4437 Versions affected: WebKitGTK+ before 2.22.5 and WPE WebKit before 2.22.3. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4438 Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1. Credit to lokihardt of Google Project Zero. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4441 Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1. Credit to lokihardt of Google Project Zero. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4442 Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1. Credit to lokihardt of Google Project Zero. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4443 Versions affected: WebKitGTK+ before 2.22.3 and WPE WebKit before 2.22.1. Credit to lokihardt of Google Project Zero. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2018-4464 Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0. Processing maliciously crafted web content may lead to arbitrary code execution. We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/. The WebKitGTK+ and WPE WebKit team, December 13, 2018 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-12-05-1 iOS 12.1.1 iOS 12.1.1 is now available and addresses the following: Airport Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36) Disk Images Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local attacker may be able to view contacts from the lock screen Description: A lock screen issue allowed access to contacts on a locked device. CVE-2018-4430: videosdebarraquito File Provider Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to learn information about the presence of other applications on the device Description: This issue was addressed with improved entitlements. CVE-2018-4446: Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted email may lead to user interface spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4429: Victor Le Pochat of imec-DistriNet, KU Leuven Profiles Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An untrusted configuration profile may be incorrectly displayed as verified Description: A certificate validation issue existed in configuration profiles. This was addressed with additional checks. CVE-2018-4436: James Seeley @Code4iOS, Joseph S. of Wyong High School Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to user interface spoofing Description: A logic issue was addressed with improved validation. CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: A logic issue was addressed with improved state management. CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab (xlab.tencent.com) Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. CVE-2018-4445: William Breuer WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4441: lokihardt of Google Project Zero CVE-2018-4442: lokihardt of Google Project Zero CVE-2018-4443: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A logic issue existed resulting in memory corruption. CVE-2018-4438: lokihardt of Google Project Zero WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST Softsec Lab, Korea Additional recognition Profiles We would like to acknowledge Luke Deshotels, Jordan Beichler, and William Enck of North Carolina State University; Costin CarabaE and RAzvan Deaconescu of University POLITEHNICA of Bucharest for their assistance. SafariViewController We would like to acknowledge YiAit Can YILMAZ (@yilmazcanyigit) for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F1FhAA vJoYbLbK0j4TDxVDWzcyTTNdF/B2vaz3Ljw8WpsYmJaMazHxsvRe3UfqBdbz1hGL 8hYBqdnjh+O9qck61tCWfH3A8f284onjL2XYdJC1NaRHr6pnJNJYU7peaavxbEty sduSMVImtPl8s9LROC0qpldpGWiRlORXUa3HZ7FDoagsy6BWW6J0srFIzylhyqZ4 LxOZ/zWJE7J50dGRA2ixGT42OgeZhVJjJTSazA44pFepfSPYEogt57A3h3sfRHIg 8Yj4rOeK+u92UqA4cTTaUwN+OZgy1HuL33tKFduYQU7IXxpNKoqL+HR0LR+HZ53O lLjOCAaxrEV4kWAMB5zt41JcFJu9fNfoCFG3jc+HQnlXfjP9/IZ/hH5vAQju8TO8 JKs3Om1BdMc+UVm1JhdmxNGB3I1bE5TllyanfU2B7LR/RGXNYbnE0ibEiuTtwX1x hZN6a2MV3dBJajCeLT/t7tMiaHYbJ44KBLIRpnzvzbY2tSLjyWAxA/xpfFBSPCwM mGJo8uWj6KcgiM4rHEgas3FVK/9BRvDj7mpP+tYuMA5wTuJPZOsa2kMiIXcgjaLB ykPlc/1GYrzkK9lRTXfu6y8+J1ngx1QGX5tMv7HyrdvCdp9c5OIOA3G9iVCUwRNr i10Ydh86HYDDPjbsGhNH+CT3fWnoFyYNg7F05Y+4piY= =aFkK -----END PGP SIGNATURE-----