VARIoT IoT vulnerabilities database

EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10 has a command injection vulnerability that could potentially be exploited by malicious users to compromise the affected system. A local attacker can exploit this issue to bypass the Data Domain restricted shell (ddsh) to gain shell access and execute arbitrary commands with root privileges. An attacker could exploit this vulnerability to take control of an affected system. Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJYiiHDAAoJEHbcu+fsE81Zm9YH/jnkR68S9tmkFmoMmgv8opS9 aKZV6pi1wjeaCXhU9i6TMy9MCAD2tk6u5mRYYo7UVJ/suGVkAWkFKUlx0VkYOoB5 6HKV6JS0FaguclFieBqIbYF+uY1xiBZ+fuszavUJ+KAVkPfy6Rjir7Pvn8ackf9l LfDciLLvHzD2Z3pkQWGpIUrxRuamCNDiIn1/N+qhOT+SLqFoX+4NHWoH4IIE1lf9 BY0ctPA+VD8iOZdYwwilj5wWpOupAbdgRS16HWE5IqPqKbqdIKitjZ5SRXYSVK5F 0LWSWUVVBUOos3bDLh+LnGmTEKNG2Y+9sCATMdevm8owMDrY1AJD5kYXKQxQK+8= =26zs -----END PGP SIGNATURE-----

A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a reload of the affected system, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient size validation of user-supplied data. An attacker could exploit this vulnerability by sending crafted H.224 data in Real-Time Transport Protocol (RTP) packets in an H.323 call. An exploit could allow the attacker to overflow a buffer in a cache that belongs to the received packet parser, which will result in a crash of the application, resulting in a DoS condition. All versions of Cisco Expressway Series Software and Cisco TelePresence VCS Software prior to version X8.8.2 are vulnerable. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCus99263

A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could allow an unauthenticated, remote attacker to cause the CX module to be unable to process further traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of IP fragments. An attacker could exploit this vulnerability by sending crafted fragmented IP traffic across the CX module. An exploit could allow the attacker to exhaust free packet buffers in shared memory (SHM), causing the CX module to be unable to process further traffic, resulting in a DoS condition. This vulnerability affects all versions of the ASA CX Context-Aware Security module. Cisco has not released and will not release software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCva62946. Attackers can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. The vulnerability stems from the fact that the program does not process the IP segment correctly

The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any third party to call. An attacker can construct a malicious application to call it. Consequently, alert music will be played suddenly, compromising user experience. Huawei HwVmall Software contains permission-related vulnerabilities.Information may be tampered with. Huawei HwVmall is prone to a local security-bypass vulnerability. An attacker may exploit this issue to bypass certain security restrictions and cause denial-of-service conditions. Versions prior to HwVmall 1.5.2.0 are vulnerable. Huawei HwVmall is a set of e-commerce platform applications for national services of China Huawei (Huawei). AlarmService component is one of the alarm service components. The vulnerability is due to the fact that the program does not set call permission control, and any third-party application can call it

A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv4 or IPv6 fragments to a port receiving content in Passthrough content mode. An exploit could allow the attacker to overflow a buffer. If successful, the attacker could execute arbitrary code or cause a DoS condition on the affected system. Cisco TelePresence MCU platforms TelePresence MCU 5300 Series, TelePresence MCU MSE 8510 and TelePresence MCU 4500 are affected when running software version 4.3(1.68) or later configured for Passthrough content mode. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available, but mitigations are available. Cisco Bug IDs: CSCuu67675. Cisco TelePresence Multipoint Control Unit is prone to a remote code-execution vulnerability. Failed attempts will likely result in denial-of-service conditions. Cisco TelePresence Server is a set of video conferencing solutions called "TelePresence" system of Cisco (Cisco). Mobility Services Engine (MSE) is a set of platforms (mobile service engine) that can provide Wi-Fi services. The platform collects, stores and manages data from wireless clients, Cisco access points and controllers. 8710 Processors is one of those processes. Cisco TelePresence Software is one of the video conferencing software running on Cisco TelePresence Server. The solution provides components such as audio and video spaces, which can provide remote participants with a "face-to-face" virtual meeting room effect. kernel is one of the kernel components. The vulnerability is caused by the program not checking the packet size

The 'Find Phone' function in Nice smartphones with software versions earlier before Nice-AL00C00B0135 has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally. Nice Smartphone software contains vulnerabilities related to authorization, permissions, and access control.Service operation interruption (DoS) There is a possibility of being put into a state. HuaweiNice is a smartphone from China's Huawei company. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks. Versions prior to Nice AL00C00B0135 are vulnerable

The Keyguard application in ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B214 and earlier versions,ALE-L21C464B150 and earlier versions,ALE-L21C636B200 and earlier versions,ALE-L23C605B190 and earlier versions,ALE-TL00C01B250 and earlier versions,ALE-UL00C00B250 and earlier versions,MT7-L09C605B325 and earlier versions,MT7-L09C900B339 and earlier versions,MT7-TL10C900B339 and earlier versions,CRR-CL00C92B172 and earlier versions,CRR-L09C432B180 and earlier versions,CRR-TL00C01B172 and earlier versions,CRR-UL00C00B172 and earlier versions,CRR-UL20C432B171 and earlier versions,GRA-CL00C92B230 and earlier versions,GRA-L09C432B222 and earlier versions,GRA-TL00C01B230SP01 and earlier versions,GRA-UL00C00B230 and earlier versions,GRA-UL00C10B201 and earlier versions,GRA-UL00C432B220 and earlier versions,H60-L04C10B523 and earlier versions,H60-L04C185B523 and earlier versions,H60-L04C636B527 and earlier versions,H60-L04C900B530 and earlier versions,PLK-AL10C00B220 and earlier versions,PLK-AL10C92B220 and earlier versions,PLK-CL00C92B220 and earlier versions,PLK-L01C10B140 and earlier versions,PLK-L01C185B130 and earlier versions,PLK-L01C432B187 and earlier versions,PLK-L01C432B190 and earlier versions,PLK-L01C432B190 and earlier versions,PLK-L01C636B130 and earlier versions,PLK-TL00C01B220 and earlier versions,PLK-TL01HC01B220 and earlier versions,PLK-UL00C17B220 and earlier versions,ATH-AL00C00B210 and earlier versions,ATH-AL00C92B200 and earlier versions,ATH-CL00C92B210 and earlier versions,ATH-TL00C01B210 and earlier versions,ATH-TL00HC01B210 and earlier versions,ATH-UL00C00B210 and earlier versions,RIO-AL00C00B220 and earlier versions,RIO-CL00C92B220 and earlier versions,RIO-TL00C01B220 and earlier versions,RIO-UL00C00B220 and earlier versions have a privilege elevation vulnerability. An attacker may exploit it to launch command injection in order to gain elevated privileges. plural Huawei Smartphone software contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Huawei EMUI is prone to a directory-traversal vulnerability and a command-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Attackers can use a specially crafted request with directory-traversal sequences ('../') to decompress malicious files into the target path, or execute arbitrary commands and gain elevated privileges. Huawei Maimang 4, etc. are all smartphone products of China's Huawei (Huawei). EMUI is a smart terminal human-computer interaction system based on the Android platform used in it. keyguard is one of the lock screen applications. EMUI 3 in various Huawei products. The privilege escalation vulnerability exists in the keyguard application of version 1. The vulnerability stems from insufficient checking of specific parameters in the keyguard application

ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,ALE-L21C185B200 and earlier versions,ALE-L21C432B214 and earlier versions,ALE-L21C464B150 and earlier versions,ALE-L21C636B200 and earlier versions,ALE-L23C605B190 and earlier versions,ALE-TL00C01B250 and earlier versions,ALE-UL00C00B250 and earlier versions,MT7-L09C605B325 and earlier versions,MT7-L09C900B339 and earlier versions,MT7-TL10C900B339 and earlier versions,CRR-CL00C92B172 and earlier versions,CRR-L09C432B180 and earlier versions,CRR-TL00C01B172 and earlier versions,CRR-UL00C00B172 and earlier versions,CRR-UL20C432B171 and earlier versions,GRA-CL00C92B230 and earlier versions,GRA-L09C432B222 and earlier versions,GRA-TL00C01B230SP01 and earlier versions,GRA-UL00C00B230 and earlier versions,GRA-UL00C10B201 and earlier versions,GRA-UL00C432B220 and earlier versions,H60-L04C10B523 and earlier versions,H60-L04C185B523 and earlier versions,H60-L04C636B527 and earlier versions,H60-L04C900B530 and earlier versions,PLK-AL10C00B220 and earlier versions,PLK-AL10C92B220 and earlier versions,PLK-CL00C92B220 and earlier versions,PLK-L01C10B140 and earlier versions,PLK-L01C185B130 and earlier versions,PLK-L01C432B187 and earlier versions,PLK-L01C432B190 and earlier versions,PLK-L01C432B190 and earlier versions,PLK-L01C636B130 and earlier versions,PLK-TL00C01B220 and earlier versions,PLK-TL01HC01B220 and earlier versions,PLK-UL00C17B220 and earlier versions,ATH-AL00C00B210 and earlier versions,ATH-AL00C92B200 and earlier versions,ATH-CL00C92B210 and earlier versions,ATH-TL00C01B210 and earlier versions,ATH-TL00HC01B210 and earlier versions,ATH-UL00C00B210 and earlier versions,RIO-AL00C00B220 and earlier versions,RIO-CL00C92B220 and earlier versions,RIO-TL00C01B220 and earlier versions,RIO-UL00C00B220 and earlier versions have a path traversal vulnerability. An attacker may exploit it to decompress malicious files into a target path. plural Huawei There is a path traversal vulnerability in smartphone software.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Huawei EMUI is prone to a directory-traversal vulnerability and a command-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Huawei Maimang 4, etc. are all smartphone products of China's Huawei (Huawei). EMUI is a smart terminal human-computer interaction system based on the Android platform used in it. EMUI 3 in various Huawei products. There is a path traversal vulnerability in version 1, which is caused by the fact that the program does not fully verify the path when decompressing a specific type of file

EMC Data Protection Advisor 6.1.x, EMC Data Protection Advisor 6.2, EMC Data Protection Advisor 6.2.1, EMC Data Protection Advisor 6.2.2, EMC Data Protection Advisor 6.2.3 prior to patch 446 has a path traversal vulnerability that may potentially be exploited by malicious users to compromise the affected system. Authentication is not required to exploit this vulnerability.The specific flaw exists within the ImageServlet servlet which listens on TCP ports 9002 and 9004. The issue lies in the failure to properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose files under the context of SYSTEM. The solution enables the automation and centralization of all such data collection and analysis, obtaining a single comprehensive view of the data protection environment and activities, and more. Link to remedies: Registered EMC Online Support customers can download the required patch from support.emc.com at https://support.emc.com/downloads/829_Data-Protection-Advisor If you have any questions, contact DELL/EMC Support. Credits: EMC would like to thank rgod working with Trend Micro's Zero Day Initiative for reporting this vulnerability. Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJYiiHdAAoJEHbcu+fsE81ZK0MH/3ClnyYIsR4ztTld+TCIzWO1 ber0FmYs7iRUyiU6XPVxoOYvEQTTmZRwFzdKwXNQMwxwUc2TQoJy2Bqkf8OrMbB/ yA4sJkyCFD6pkX14Rp6RvOFYK+4MtkbLQkmyIyi4bpM19U33XIfojBH28zmFvQlG Tzj8wUkXP+/BLLz4c80Ffs9G4JbueBgCc24CVjVN8Ygh2ykAQLAyahfsw5nC3LZO qQdOo3yV6qn4OSHBqg6nLkFJXhvuUxl+OFm1C/Rl1xdIJ21tG54nKyxswQFr9M7+ MuvHCmooXSUNOtiznS/9cBRg5hKcB5Ug/OdWe3SzrP0D0sWekcsrGClUpES1EgI= =CMLs -----END PGP SIGNATURE-----

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "IOKit" component. It allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within IOReportUserClient. The process does not properly validate user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges under the context of the kernel. Versions prior to iOS 10.2, macOS 10.12.2 and watchOS 3.1.3 are vulnerable. Apple iOS is an operating system developed for mobile devices; tvOS is a smart TV operating system; watchOS is a smart watch operating system. IOKit is one of the components that read system information

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an application programing interface (API) response parser within the extension. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser. Cisco WebEx Is an online conferencing system. WebEx In online meetings using, participants typically join the meeting through a link on a web page. By following the link, through web browser extensions WebEx The software is started. (CWE-78) Exists. This issue is being tracked by Cisco Bug IDs CSCvc86959 and CSCvc88194. Cisco WebEx is a set of Web conferencing tools developed by American Cisco (Cisco), which can assist office workers in different places to coordinate and cooperate. WebEx services include Web conferencing, telepresence video conferencing and enterprise instant messaging (IM). Cisco WebEx extensions and plugins have security vulnerabilities

An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, which can allow a malicious entity to compromise Historian databases. In some installation scenarios, resources beyond those created by Wonderware Historian may be compromised as well. Schneider Electric Wonderware Historian is a set of industrial data management software from Schneider Electric that combines high-speed data acquisition storage systems with traditional relational database management systems. A remote attacker could exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. The vulnerability is caused by the program using insecure default passwords

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform's SELinux in permissive mode, which severely weakens it, by issuing: fastboot oem selinux permissive. OnePlus3and3T is one of the two smart phones from the company. OnePlus3and3T has a denial of service vulnerability. A remote attacker could exploit the vulnerability to restart the device, causing a denial of service. OnePlus 3 and 3T is prone to a local denial-of-service vulnerability

HollySys's HT7000 editing software includes two parts: a configuration environment and a running environment. Its configuration environment can run on various Microsoft-based 32-bit Windows platforms. The running environment is a real-time multi-tasking embedded operating system WindowsCE. There are applications in the field of automation. HollySys software HT7000 project file has a sensitive information disclosure vulnerability. Allows attackers to use vulnerabilities to add, delete, and modify existing users who can operate on the project.

An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking tool to establish SSH connections quickly. This will trigger an increase in the SSH login timeout (each of the login attempts will occupy a connection slot for a longer time). Once this occurs, legitimate login attempts via SSH/telnet will be refused, resulting in a denial of service; you must restart the device. FiberHome Fengine S5800 Switch has service disruption ( Reboot device ) There are vulnerabilities that are put into a state.An unauthenticated attacker SSH Service access is disrupted by accessing the service ( Reboot device ) There is a possibility of being put into a state. FiberHomeFengineS5800Switches is a new generation of Gigabit routing switches designed to meet multi-service access and high-density aggregation. The series of router switches are equipped with high-density Gigabit ports and 10 Gigabit uplinks, which can meet various applications such as broadband metropolitan area network, enterprise network, WLAN aggregation, and campus networking. A remote denial of service vulnerability exists in FiberHomeFengineS5800Switches

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "Contacts" component. It allows remote attackers to cause a denial of service (application crash) via a crafted contact card. Apple iOS is prone to a denial-of-service vulnerability and a security-bypass vulnerability. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions or cause a denial-of-service condition. This may aid in further attacks. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. Contacts is one of the mobile phone contact components. An input validation vulnerability exists in the Contacts component in versions prior to Apple iOS 10.2.1. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-01-23-1 iOS 10.2.1 iOS 10.2.1 is now available and addresses the following: Auto Unlock Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Auto Unlock may unlock when Apple Watch is off the user's wrist Description: A logic issue was addressed through improved state management. CVE-2017-2352: Ashley Fernandez of raptAware Pty Ltd Contacts Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing a maliciously crafted contact card may lead to unexpected application termination Description: An input validation issue existed in the parsing of contact cards. This issue was addressed through improved input validation. CVE-2017-2368: Vincent Desmurs (vincedes3) Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow issue was addressed through improved memory handling. CVE-2017-2370: Ian Beer of Google Project Zero Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-2017-2360: Ian Beer of Google Project Zero libarchive Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: A buffer overflow issue was addressed through improved memory handling. CVE-2016-8687: Agostino Sarubbo of Gentoo WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: A prototype access issue was addressed through improved exception handling. CVE-2017-2350: Gareth Heyes of Portswigger Web Security WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2017-2354: Neymar of Tencent's Xuanwu Lab (tencent.com) working with Trend Micro's Zero Day Initiative CVE-2017-2362: Ivan Fratric of Google Project Zero CVE-2017-2373: Ivan Fratric of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory initialization issue was addressed through improved memory handling. CVE-2017-2355: Team Pangu and lokihardt at PwnFest 2016 WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved input validation. CVE-2017-2356: Team Pangu and lokihardt at PwnFest 2016 CVE-2017-2366: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2017-2369: Ivan Fratric of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: Multiple validation issues existed in the handling of page loading. This issue was addressed through improved logic. CVE-2017-2363: lokihardt of Google Project Zero CVE-2017-2364: lokihardt of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious website can open popups Description: An issue existed in the handling of blocking popups. This was addressed through improved input validation. CVE-2017-2371: lokihardt of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: A validation issue existed in variable handling. This issue was addressed through improved validation. CVE-2017-2365: lokihardt of Google Project Zero WiFi Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An activation-locked device can be manipulated to briefly present the home screen Description: An issue existed with handling user input that caused a device to present the home screen even when activation locked. This was addressed through improved input validation. CVE-2017-2351: Sriram (@Sri_Hxor) of Primefort Pvt. Ltd., Hemanth Joseph Additional recognition WebKit hardening We would like to acknowledge Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, and Cristiano Giuffrida of the vusec group at Vrije Universiteit Amsterdam for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "10.2.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYgqLhAAoJEIOj74w0bLRGLBMP/2hLYLM6/FsH/npzPbCouZ3a 7WrIax5GAURyvKmeSHYwbZCyDa+U8RoR83xnm25QxVA0SYiqxYQTLavKkdiwL5dL QJHtbltb3BWF0ctkcN4q9dvA13kapdn7zr1Zp3MyvnqlsIuo5acsl8DwgNapxklP 6NNgLFuUUPDITMRX+CZlndS3ldas9nWBHGUw7FfVQd7+SCj8+u6CBpVm03SPjC4E 9rObbrDg6Ur7RW8sYz5TvfQ+JfL8ZJQgjCNLE99AV5n+y1SzUaW5+WgklmJzwabm P6VFCFI3qMctmiHDFh5Ab9eFCspL1ppl8gCj2+eqxCdi9cVPdiOxGUJXkfzUvLCq d68lHHSasRjoVMacMz9ttpR7IAQpM4L9KYgJ/AbwvOFKn5MkxAJYpbU2DDnlg4UY ZyZ8CqmIfZoEgDFSx4+LcfNeMoB0f0eDClXzCZkLMqyc7ZhRWcDPO7UTXl2l5IN9 1BoOZJ4AB6unI9/JmTz9x1mkfOMatsz3Mlw2aoqfYqhBYH4IMruIoIx9L7VawxY9 IZM1fJhEc1PejgZ48X95suaGm3LHzSqXo9gIcJ42SEevqFaoD96I5S+D1eeBOIe7 yvyQ8APU6W3io9vlfQG7oW+mtHg0uPJY6yLj+79NpvAeVHrFHi1Am+A/4uuEZLjZ toC5axX5Dn1ZXgiVJb2H =6bnQ -----END PGP SIGNATURE-----

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (buffer overflow) via a crafted app. Apple iOS/macOS/tvOS and watchOS are prone to a buffer overflow vulnerability. Failed exploit attempts will result in denial-of-service conditions. Apple iOS, macOS Sierra, tvOS, and watchOS are all products of the US company Apple (Apple). Apple iOS is an operating system developed for mobile devices; watchOS is an operating system for smart watches. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-01-23-1 iOS 10.2.1 iOS 10.2.1 is now available and addresses the following: Auto Unlock Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Auto Unlock may unlock when Apple Watch is off the user's wrist Description: A logic issue was addressed through improved state management. CVE-2017-2352: Ashley Fernandez of raptAware Pty Ltd Contacts Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing a maliciously crafted contact card may lead to unexpected application termination Description: An input validation issue existed in the parsing of contact cards. This issue was addressed through improved input validation. CVE-2017-2368: Vincent Desmurs (vincedes3) Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow issue was addressed through improved memory handling. CVE-2017-2370: Ian Beer of Google Project Zero Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-2017-2360: Ian Beer of Google Project Zero libarchive Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: A buffer overflow issue was addressed through improved memory handling. CVE-2016-8687: Agostino Sarubbo of Gentoo WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: A prototype access issue was addressed through improved exception handling. CVE-2017-2350: Gareth Heyes of Portswigger Web Security WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2017-2354: Neymar of Tencent's Xuanwu Lab (tencent.com) working with Trend Micro's Zero Day Initiative CVE-2017-2362: Ivan Fratric of Google Project Zero CVE-2017-2373: Ivan Fratric of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory initialization issue was addressed through improved memory handling. CVE-2017-2355: Team Pangu and lokihardt at PwnFest 2016 WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved input validation. CVE-2017-2356: Team Pangu and lokihardt at PwnFest 2016 CVE-2017-2366: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2017-2369: Ivan Fratric of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: Multiple validation issues existed in the handling of page loading. This issue was addressed through improved logic. CVE-2017-2363: lokihardt of Google Project Zero CVE-2017-2364: lokihardt of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious website can open popups Description: An issue existed in the handling of blocking popups. This was addressed through improved input validation. CVE-2017-2371: lokihardt of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: A validation issue existed in variable handling. This issue was addressed through improved validation. CVE-2017-2365: lokihardt of Google Project Zero WiFi Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An activation-locked device can be manipulated to briefly present the home screen Description: An issue existed with handling user input that caused a device to present the home screen even when activation locked. This was addressed through improved input validation. CVE-2017-2351: Sriram (@Sri_Hxor) of Primefort Pvt. Ltd., Hemanth Joseph Additional recognition WebKit hardening We would like to acknowledge Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, and Cristiano Giuffrida of the vusec group at Vrije Universiteit Amsterdam for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "10.2.1". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYgqLhAAoJEIOj74w0bLRGLBMP/2hLYLM6/FsH/npzPbCouZ3a 7WrIax5GAURyvKmeSHYwbZCyDa+U8RoR83xnm25QxVA0SYiqxYQTLavKkdiwL5dL QJHtbltb3BWF0ctkcN4q9dvA13kapdn7zr1Zp3MyvnqlsIuo5acsl8DwgNapxklP 6NNgLFuUUPDITMRX+CZlndS3ldas9nWBHGUw7FfVQd7+SCj8+u6CBpVm03SPjC4E 9rObbrDg6Ur7RW8sYz5TvfQ+JfL8ZJQgjCNLE99AV5n+y1SzUaW5+WgklmJzwabm P6VFCFI3qMctmiHDFh5Ab9eFCspL1ppl8gCj2+eqxCdi9cVPdiOxGUJXkfzUvLCq d68lHHSasRjoVMacMz9ttpR7IAQpM4L9KYgJ/AbwvOFKn5MkxAJYpbU2DDnlg4UY ZyZ8CqmIfZoEgDFSx4+LcfNeMoB0f0eDClXzCZkLMqyc7ZhRWcDPO7UTXl2l5IN9 1BoOZJ4AB6unI9/JmTz9x1mkfOMatsz3Mlw2aoqfYqhBYH4IMruIoIx9L7VawxY9 IZM1fJhEc1PejgZ48X95suaGm3LHzSqXo9gIcJ42SEevqFaoD96I5S+D1eeBOIe7 yvyQ8APU6W3io9vlfQG7oW+mtHg0uPJY6yLj+79NpvAeVHrFHi1Am+A/4uuEZLjZ toC5axX5Dn1ZXgiVJb2H =6bnQ -----END PGP SIGNATURE-----

An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the "Help Viewer" component, which allows XSS attacks via a crafted web site. Apple macOS is prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, execute arbitrary code, to obtain sensitive information or cause a denial-of-service condition. Help Viewer is one of the WebKit-based HTML viewers. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-01-23-2 macOS 10.12.3 macOS 10.12.3 is now available and addresses the following: apache_mod_php Available for: macOS Sierra 10.12.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 5.6.28. CVE-2016-8670 CVE-2016-9933 CVE-2016-9934 Bluetooth Available for: macOS Sierra 10.12.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-2017-2353: Ian Beer of Google Project Zero Graphics Drivers Available for: macOS Sierra 10.12.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-2017-2361: lokihardt of Google Project Zero IOAudioFamily Available for: macOS Sierra 10.12.2 Impact: An application may be able to determine kernel memory layout Description: An uninitialized memory issue was addressed through improved memory management. CVE-2017-2357: Team Pangu and lokihardt at PwnFest 2016 Kernel Available for: macOS Sierra 10.12.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow issue was addressed through improved memory handling. CVE-2017-2370: Ian Beer of Google Project Zero Kernel Available for: macOS Sierra 10.12.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-2017-2360: Ian Beer of Google Project Zero libarchive Available for: macOS Sierra 10.12.2 Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: A buffer overflow issue was addressed through improved memory handling. CVE-2016-8687: Agostino Sarubbo of Gentoo Vim Available for: macOS Sierra 10.12.2 Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution Description: An input validation issue existed in modelines. This was addressed through improved input validation. CVE-2016-1248: Florian Larysch WebKit Available for: macOS Sierra 10.12.2 Impact: A malicious website can open popups Description: An issue existed in the handling of blocking popups. This was addressed through improved input validation. CVE-2017-2371: lokihardt of Google Project Zero macOS 10.12.3 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYgqLhAAoJEIOj74w0bLRGymIQAMx3h6pTb1SLTCY4H4hUwQf2 tBd4osjrM7eX9kDBJXw9U3S5STs7Qyaiqjc+E3XvGXaeYQhZHurNEy+4HEaS2ctQ toj0S/meE1bhJ79SKnRuEso0dG2coYAMY4CMWZpF5haEPISunMDrmitIDX6BU8ds LhIvflT044wXzFsPbUfIMqG1a+1SHGoM3K0J61U6NU7dCSwyYmSGKH/0CTLuezy9 HOiPQJxvWVmfKVBZsYcaBp67AI5948LHdvat3gRq9WpgWpjUFjW/tLSbvZObaIjn +I3JkVZ9ETuXa+ig42h+CJTz/CozqlC1OpX1YLJLMh4h5+kY9PNwh1kcsv+8jKxo cbPNatn2uzoigRTWuhCe4Tic6kgri+3c8qR+ZPspNpUyLmentjpbygrkOKVLlNnG HmV0YIWA+zp4TVgeMnqoEPTHF9kxxhBSPOjgyL2oYwpMHyXb2gmho7Xl9gQirw5T Nyaoup4A7eT9jR5FBcAvhPPm5I+J44qEKB/D9hvWcQLGf1PR9/zxVd5QxlJZgm9u loqWBNhPAqD36SPIOsIbkcjAaBKsrEAV01AizkMrhrN1KySscXeZeZ84p4nJusdD M7bFysYMv7fvNe65V4I2Tc2iujqiPHsXdLRioAWSk7giNRggQtaM8s/C0KYtrJdK ykSG8JpyNuTNAl1HJtv6 =pBIh -----END PGP SIGNATURE-----

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. Apple iOS , Safari and tvOS Used in etc. WebKit is prone to multiple security vulnerabilities. Attackers can exploit these issues to obtain sensitive information or execute arbitrary code and perform unauthorized actions; this may aid in launching further attacks. Safari 10.0.3 may be obtained from the Mac App Store. ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2017-0002 ------------------------------------------------------------------------ Date reported : February 10, 2017 Advisory ID : WSA-2017-0002 Advisory URL : https://webkitgtk.org/security/WSA-2017-0002.html CVE identifiers : CVE-2017-2350, CVE-2017-2354, CVE-2017-2355, CVE-2017-2356, CVE-2017-2362, CVE-2017-2363, CVE-2017-2364, CVE-2017-2365, CVE-2017-2366, CVE-2017-2369, CVE-2017-2371, CVE-2017-2373. Several vulnerabilities were discovered in WebKitGTK+. Credit to Gareth Heyes of Portswigger Web Security. Impact: Processing maliciously crafted web content may exfiltrate data cross-origin. Description: A prototype access issue was addressed through improved exception handling. Credit to Neymar of Tencent's Xuanwu Lab (tencent.com) working with Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling. Credit to Team Pangu and lokihardt at PwnFest 2016. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A memory initialization issue was addressed through improved memory handling. Credit to Team Pangu and lokihardt at PwnFest 2016. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved input validation. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling. Credit to lokihardt of Google Project Zero. Impact: Processing maliciously crafted web content may exfiltrate data cross-origin. Description: Multiple validation issues existed in the handling of page loading. This issue was addressed through improved logic. Credit to lokihardt of Google Project Zero. Impact: Processing maliciously crafted web content may exfiltrate data cross-origin. Description: Multiple validation issues existed in the handling of page loading. This issue was addressed through improved logic. Credit to lokihardt of Google Project Zero. Impact: Processing maliciously crafted web content may exfiltrate data cross-origin. Description: A validation issue existed in variable handling. This issue was addressed through improved validation. Credit to Kai Kang of Tencent's Xuanwu Lab (tencent.com). Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved input validation. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved input validation. Credit to lokihardt of Google Project Zero. Impact: A malicious website can open popups. Description: An issue existed in the handling of blocking popups. This was addressed through improved input validation. Credit to Ivan Fratric of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed through improved memory handling. We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: https://webkitgtk.org/security.html The WebKitGTK+ team, February 10, 2017 . void Frame::setDocument(RefPtr<Document>&& newDocument) { ASSERT(!newDocument || newDocument->frame() == this); if (m_doc && m_doc->pageCacheState() != Document::InPageCache) m_doc->prepareForDestruction(); m_doc = newDocument.copyRef(); ... } Before setting |m_doc| to |newDocument|, it calls |prepareForDestruction| that fires unload event handlers. If we call |Frame::setDocument| with the new document |a|, and call |Frame::setDocument| again with the new document |b| in the unload event handler. Then |prepareForDestruction| will be never called on |b|, which means the frame will be never detached from |b|. PoC: "use strict"; let f = document.documentElement.appendChild(document.createElement("iframe")); let a = f.contentDocument.documentElement.appendChild(document.createElement("iframe")); a.contentWindow.onunload = () => { f.src = "javascript:''"; let b = f.contentDocument.appendChild(document.createElement("iframe")); b.contentWindow.onunload = () => { f.src = "javascript:''"; let doc = f.contentDocument; f.onload = () => { f.onload = () => { f.onload = null; let s = doc.createElement("form"); s.action = "javascript:alert(location)"; s.submit(); }; f.src = "<a href="https://abc.xyz/";" title="" class="" rel="nofollow">https://abc.xyz/";</a> }; }; }; f.src = "javascript:''"; Tested on Safari 10.0.2(12602.3.12.0.1). This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public. Found by: lokihardt . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-01-23-1 iOS 10.2.1 iOS 10.2.1 is now available and addresses the following: Auto Unlock Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Auto Unlock may unlock when Apple Watch is off the user's wrist Description: A logic issue was addressed through improved state management. CVE-2017-2352: Ashley Fernandez of raptAware Pty Ltd Contacts Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing a maliciously crafted contact card may lead to unexpected application termination Description: An input validation issue existed in the parsing of contact cards. CVE-2017-2368: Vincent Desmurs (vincedes3) Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow issue was addressed through improved memory handling. CVE-2017-2370: Ian Beer of Google Project Zero Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-2017-2360: Ian Beer of Google Project Zero libarchive Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: A buffer overflow issue was addressed through improved memory handling. CVE-2016-8687: Agostino Sarubbo of Gentoo WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: A prototype access issue was addressed through improved exception handling. CVE-2017-2354: Neymar of Tencent's Xuanwu Lab (tencent.com) working with Trend Micro's Zero Day Initiative CVE-2017-2362: Ivan Fratric of Google Project Zero CVE-2017-2373: Ivan Fratric of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory initialization issue was addressed through improved memory handling. CVE-2017-2356: Team Pangu and lokihardt at PwnFest 2016 CVE-2017-2366: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2017-2369: Ivan Fratric of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: Multiple validation issues existed in the handling of page loading. CVE-2017-2363: lokihardt of Google Project Zero CVE-2017-2364: lokihardt of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious website can open popups Description: An issue existed in the handling of blocking popups. CVE-2017-2371: lokihardt of Google Project Zero WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: A validation issue existed in variable handling. CVE-2017-2365: lokihardt of Google Project Zero WiFi Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An activation-locked device can be manipulated to briefly present the home screen Description: An issue existed with handling user input that caused a device to present the home screen even when activation locked. CVE-2017-2351: Sriram (@Sri_Hxor) of Primefort Pvt. Ltd., Hemanth Joseph Additional recognition WebKit hardening We would like to acknowledge Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, and Cristiano Giuffrida of the vusec group at Vrije Universiteit Amsterdam for their assistance. Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYgqLhAAoJEIOj74w0bLRGLBMP/2hLYLM6/FsH/npzPbCouZ3a 7WrIax5GAURyvKmeSHYwbZCyDa+U8RoR83xnm25QxVA0SYiqxYQTLavKkdiwL5dL QJHtbltb3BWF0ctkcN4q9dvA13kapdn7zr1Zp3MyvnqlsIuo5acsl8DwgNapxklP 6NNgLFuUUPDITMRX+CZlndS3ldas9nWBHGUw7FfVQd7+SCj8+u6CBpVm03SPjC4E 9rObbrDg6Ur7RW8sYz5TvfQ+JfL8ZJQgjCNLE99AV5n+y1SzUaW5+WgklmJzwabm P6VFCFI3qMctmiHDFh5Ab9eFCspL1ppl8gCj2+eqxCdi9cVPdiOxGUJXkfzUvLCq d68lHHSasRjoVMacMz9ttpR7IAQpM4L9KYgJ/AbwvOFKn5MkxAJYpbU2DDnlg4UY ZyZ8CqmIfZoEgDFSx4+LcfNeMoB0f0eDClXzCZkLMqyc7ZhRWcDPO7UTXl2l5IN9 1BoOZJ4AB6unI9/JmTz9x1mkfOMatsz3Mlw2aoqfYqhBYH4IMruIoIx9L7VawxY9 IZM1fJhEc1PejgZ48X95suaGm3LHzSqXo9gIcJ42SEevqFaoD96I5S+D1eeBOIe7 yvyQ8APU6W3io9vlfQG7oW+mtHg0uPJY6yLj+79NpvAeVHrFHi1Am+A/4uuEZLjZ toC5axX5Dn1ZXgiVJb2H =6bnQ -----END PGP SIGNATURE----- . =========================================================================== Ubuntu Security Notice USN-3200-1 February 16, 2017 webkit2gtk vulnerabilities =========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.10 - Ubuntu 16.04 LTS Summary: Several security issues were fixed in WebKitGTK+. Software Description: - webkit2gtk: Web content engine library for GTK+ Details: A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.10: libjavascriptcoregtk-4.0-18 2.14.5-0ubuntu0.16.10.1 libwebkit2gtk-4.0-37 2.14.5-0ubuntu0.16.10.1 Ubuntu 16.04 LTS: libjavascriptcoregtk-4.0-18 2.14.5-0ubuntu0.16.04.1 libwebkit2gtk-4.0-37 2.14.5-0ubuntu0.16.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use WebKitGTK+, such as Epiphany, to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-3200-1 CVE-2017-2350, CVE-2017-2354, CVE-2017-2355, CVE-2017-2356, CVE-2017-2362, CVE-2017-2363, CVE-2017-2364, CVE-2017-2365, CVE-2017-2366, CVE-2017-2369, CVE-2017-2371, CVE-2017-2373 Package Information: https://launchpad.net/ubuntu/+source/webkit2gtk/2.14.5-0ubuntu0.16.10.1 https://launchpad.net/ubuntu/+source/webkit2gtk/2.14.5-0ubuntu0.16.04.1

An issue was discovered in certain Apple products. Safari before 10.0.3 is affected. The issue involves the "Safari" component, which allows remote attackers to spoof the address bar via a crafted web site. An attacker may exploit this vulnerability to spoof the originating URL of a trusted web site. This issue may allow a remote attacker to carry out phishing-style attacks. Versions prior to Safari 10.0.3 are vulnerable. Apple Safari is a web browser developed by Apple (Apple), and is the default browser included with Mac OS X and iOS operating systems. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-01-23-5 Safari 10.0.3 Safari 10.0.3 is now available and addresses the following: Safari Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12.3 Impact: Visiting a malicious website may lead to address bar spoofing Description: A state management issue in the address bar was addressed through improved URL handling. CVE-2017-2359: xisigr of Tencent's Xuanwu Lab (tencent.com) WebKit Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12.3 Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: A prototype access issue was addressed through improved exception handling. CVE-2017-2350: Gareth Heyes of Portswigger Web Security WebKit Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12.3 Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2017-2354: Neymar of Tencent's Xuanwu Lab (tencent.com) working with Trend Micro's Zero Day Initiative CVE-2017-2362: Ivan Fratric of Google Project Zero CVE-2017-2373: Ivan Fratric of Google Project Zero WebKit Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12.3 Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory initialization issue was addressed through improved memory handling. CVE-2017-2355: Team Pangu and lokihardt at PwnFest 2016 WebKit Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12.3 Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved input validation. CVE-2017-2356: Team Pangu and lokihardt at PwnFest 2016 CVE-2017-2366: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2017-2369: Ivan Fratric of Google Project Zero WebKit Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12.3 Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: Multiple validation issues existed in the handling of page loading. This issue was addressed through improved logic. CVE-2017-2363: lokihardt of Google Project Zero CVE-2017-2364: lokihardt of Google Project Zero WebKit Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12.3 Impact: Processing maliciously crafted web content may exfiltrate data cross-origin Description: A validation issue existed in variable handling. This issue was addressed through improved validation. CVE-2017-2365: lokihardt of Google Project Zero Additional recognition WebKit hardening We would like to acknowledge Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, and Cristiano Giuffrida of the vusec group at Vrije Universiteit Amsterdam for their assistance. Safari 10.0.3 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYgqLhAAoJEIOj74w0bLRG1wEP/iZzmNGmGqYEEGXg+OXEhps8 Zb0akG3DLteZYCESpdsCUZnwlfOriXUNgjZv15o6iop+gN+bDGTQVzyGZFAiGvYu KJQwPVSNW6w0yzAuCeDFeFQX2VigGcAy2N5XE7g+pZklrWmn/JjAqc+x0UX5jUID Fz9H8MmzJi8NDZ56+7jlz6fHDo/XL8jNlhfvGw/3JPN7glusqHkQhazicoB7URqy X3LxPlIcDzkBD2cKdq56CoYzkgYWjhWFzdRCamVxsDQiH34OSwBrizPxi23NJfsN j4JklMdovaXoNtEQVnuBq4SKvdKxXN4hddBrNClO92681pgqP/y2RvCAzNxvEhhg vljGGOdY1q7wrg+9dKWuVVPnqOpaUHyQKF6d+TN6zp9F+rqQvGqR7ba474gbLQkA XYPyvP/GRI3vNc1n/ytjNUY1DbjxOSgA9a7EgwndAIeMC60plBt7WpfrFzpLsgFe KIADucwXLuueAWY4B7dk3Zdfe5AucV/PVcz/EnLE5ns2j1EuU8QvjxWu6zdEka1Q gERG+at3mYST0/uqHy2dc686c7p6bwVBoPZCYYMvHW5fpwmJtJQkxm/5bBgKFHNw RqIbQnGYTgSymYA5EaVib5Mh93TvB3iwN4EK2dLdtsu9P8uCbIsfB+4q2bVMBHOn e6ebA4//C0r54SmyfMv4 =sLyp -----END PGP SIGNATURE-----