-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-9-24-5 Additional information for APPLE-SA-2018-9-17-2 watchOS 5 watchOS 5 addresses the following: iTunes Store Available for: Apple Watch Series 1 and later Impact: An attacker in a privileged network position may be able to spoof password prompts in the iTunes Store Description: An input validation issue was addressed with improved input validation. CVE-2018-4305: Jerry Decime Kernel Available for: Apple Watch Series 1 and later Impact: An application may be able to read restricted memory Description: An input validation issue existed in the kernel. This issue was addressed with improved input validation. CVE-2018-4363: Ian Beer of Google Project Zero Kernel Available for: Apple Watch Series 1 and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4336: Brandon Azad CVE-2018-4344: The UK's National Cyber Security Centre (NCSC) Entry added September 24, 2018 Safari Available for: Apple Watch Series 1 and later Impact: A local user may be able to discover websites a user has visited Description: A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of application snapshots. CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu of Abdullah Mürşide Özünenek Anadolu Lisesi - Ankara/Türkiye, Mehmet Ferit Daştan of Van Yüzüncü Yıl University, Metin Altug Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western Governor's University (WGU) Security Available for: Apple Watch Series 1 and later Impact: An attacker may be able to exploit weaknesses in the RC4 cryptographic algorithm Description: This issue was addressed by removing RC4. CVE-2016-1777: Pepi Zawodsky WebKit Available for: Apple Watch Series 1 and later Impact: Unexpected interaction causes an ASSERT failure Description: A memory corruption issue was addressed with improved validation. CVE-2018-4191: found by OSS-Fuzz Entry added September 24, 2018 WebKit Available for: Apple Watch Series 1 and later Impact: Cross-origin SecurityErrors includes the accessed frame's origin Description: The issue was addressed by removing origin information. CVE-2018-4311: Erling Alf Ellingsen (@steike) Entry added September 24, 2018 WebKit Available for: Apple Watch Series 1 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4299: Samuel Groβ (saelo) working with Trend Micro's Zero Day Initiative CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with Trend Micro's Zero Day Initiative CVE-2018-4359: Samuel Groß (@5aelo) Entry added September 24, 2018 WebKit Available for: Apple Watch Series 1 and later Impact: A malicious website may cause unexepected cross-origin behavior Description: A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. CVE-2018-4319: John Pettitt of Google Entry added September 24, 2018 WebKit Available for: Apple Watch Series 1 and later Impact: Unexpected interaction causes an ASSERT failure Description: A memory consumption issue was addressed with improved memory handling. CVE-2018-4361: found by Google OSS-Fuzz Entry added September 24, 2018 Additional recognition Core Data We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security Labs GmbH for their assistance. Sandbox Profiles We would like to acknowledge Tencent Keen Security Lab working with Trend Micro's Zero Day Initiative for their assistance. SQLite We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security Labs GmbH for their assistance. WebKit We would like to acknowledge Tencent Keen Security Lab working with Trend Micro's Zero Day Initiative for their assistance. Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlupFUMACgkQeC9tht7T K3FlkA/+M8ZAHAIh7DJNvRNa+oRd9iQ+u1nKxGqKrSOZadu4A6YpY0ccMkTIk3Hd LIkmFtn4y/p+ZJ49A2k50+Hr5rcuW0XfjgHXb0l7wEkgKFOx1gMQNt52Jm34skyK gQWrCu10xQD3tNXUTjn4/F9FU6hTUPP+2IizCfuL77MdQ0j4eFLjOzMNjdgvgpYt VYgR7GgW4vBgEO4KBG09JqG6ghej4CWHuxghMZVK5hZZ6xOCSHuwZMoRzpg9yE8U VkVomuFTmPm8AE1xvWQGSJLJNjuYahs6FUOccwBlwDgdG9s5PYud9ZR7qKGevUTL Wa3+vJHnijvua+pvz7wOIXrfP0eI4LWMBvm9ub+ftNEQxcNE+Nl/ErqoHMpyuqrW Be+B61TvOuN4oc2m4xU4vbx/kOWOCOgvUO+sDxZOkfKe1fQCkxLgsSjCBViCsitT zmNBhSQIsCs+aYX1ZpC8qn5XYEWVb/Ois+Zc20Z6FdkC3BFUen6K21qKdTKo+AjM jYQqtcbUUG2crcnCSRFJfHF0iGQl+PtWInRHH007wqeBNoiAUbsxbjtiWslgvuzq p3O+5sPeWlp1haMRhG9GjCi+9JoFGu1gYKon02XrdXrLnUaD6iH9qkHXmKVPgmn6 +SfVKYNHX2AQwuRTSDe0ziHRZ/5oKrCBHDoNXHh+YOUeREGOVpA= =DoWw -----END PGP SIGNATURE-----
