-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-6 tvOS 26.4 tvOS 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126797. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available for: Apple TV HD and Apple TV 4K (all models) Impact: An attacker in a privileged network position may be able to intercept network traffic Description: An authentication issue was addressed with improved state management. CVE-2026-28865: Héloïse Gollier and Mathy Vanhoef (KU Leuven) Audio Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. CVE-2026-28879: Justin Cohen of Google Audio Available for: Apple TV HD and Apple TV 4K (all models) Impact: An attacker may be able to cause unexpected app termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-28822: Jex Amro CoreMedia Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative CoreUtils Available for: Apple TV HD and Apple TV 4K (all models) Impact: A user in a privileged network position may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved input validation. CVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault) Crash Reporter Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to enumerate a user's installed apps Description: A privacy issue was addressed by removing sensitive data. CVE-2026-28878: Zhongcheng Li from IES Red Team curl Available for: Apple TV HD and Apple TV 4K (all models) Impact: An issue existed in curl which may result in unintentionally sending sensitive information via an incorrect connection Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-14524 GeoServices Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data Description: An information leakage was addressed with additional validation. CVE-2026-28870: XiguaSec ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2025-64505 Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to leak sensitive kernel state Description: This issue was addressed with improved authentication. CVE-2026-28867: Jian Lee (@speedyfriend433) Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-20698: DARKNAVY (@DarkNavyOrg) Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-20687: Johnny Franks (@zeroxjf) libxpc Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to enumerate a user's installed apps Description: This issue was addressed with improved checks. CVE-2026-28882: Ilias Morad (A2nkF) of Voynich Group, Duy Trần (@khanhduytran0), @hugeBlack Sandbox Profiles Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-28863: Gongyu Ma (@Mezone0) UIFoundation Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause a denial-of-service Description: A stack overflow was addressed with improved input validation. CVE-2026-28852: Caspian Tarafdar WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced Description: This issue was addressed through improved state management. WebKit Bugzilla: 304951 CVE-2026-20665: webb WebKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: A malicious website may be able to process restricted web content outside the sandbox Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 308248 CVE-2026-28859: greenbynox, Arni Hardarson Additional recognition AirPort We would like to acknowledge Yashar Shahinzadeh, Saman Ebrahimnezhad, Amir Safari, Omid Rezaii for their assistance. Bluetooth We would like to acknowledge Hamid Mahmoud for their assistance. Captive Network We would like to acknowledge Kun Peeks (@SwayZGl1tZyyy) for their assistance. CoreUI We would like to acknowledge Peter Malone for their assistance. Find My We would like to acknowledge Salemdomain for their assistance. GPU Drivers We would like to acknowledge Jian Lee (@speedyfriend433) for their assistance. ICU We would like to acknowledge Jian Lee (@speedyfriend433) for their assistance. Kernel We would like to acknowledge DARKNAVY (@DarkNavyOrg), Kylian Boulard De Pouqueville From Fuzzinglabs, Patrick Ventuzelo From Fuzzinglabs, Robert Tran, Suresh Sundaram for their assistance. libarchive We would like to acknowledge Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Arni Hardarson for their assistance. libc We would like to acknowledge Vitaly Simonovich for their assistance. Libnotify We would like to acknowledge Ilias Morad (@A2nkF_) for their assistance. LLVM We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. Messages We would like to acknowledge JZ for their assistance. MobileInstallation We would like to acknowledge Gongyu Ma (@Mezone0) for their assistance. ppp We would like to acknowledge Dave G. for their assistance. Quick Look We would like to acknowledge Wojciech Regula of SecuRing (wojciechregula.blog), an anonymous researcher for their assistance. Safari We would like to acknowledge @RenwaX23, Farras Givari, Syarif Muhammad Sajjad, Yair for their assistance. Shortcuts We would like to acknowledge Waleed Barakat (@WilDN00B) and Paul Montgomery (@nullevent) for their assistance. Siri We would like to acknowledge Anand Mallaya, Tech consultant, Anand Mallaya and Co., Harsh Kirdolia, Hrishikesh Parmar of Self-Employed for their assistance. Spotlight We would like to acknowledge Bilge Kaan Mızrak, Claude & Friends: Risk Analytics Research Group, Zack Tickman for their assistance. Time Zone We would like to acknowledge Abhay Kailasia (@abhay_kailasia) from Safran Mumbai India for their assistance. UIKit We would like to acknowledge AEC, Abhay Kailasia (@abhay_kailasia) from Safran Mumbai India, Bishal Kafle (@whoisbishal.k), Carlos Luna (U.S. Department of the Navy), Dalibor Milanovic, Daren Goodchild, JS De Mattei, Maxwell Garn, Zack Tickman, fuyuu12, incredincomp for their assistance. Wallet We would like to acknowledge Zhongcheng Li from IES Red Team of ByteDance for their assistance. Web Extensions We would like to acknowledge Carlos Jeurissen, Rob Wu (robwu.nl) for their assistance. WebKit We would like to acknowledge Vamshi Paili for their assistance. WebKit Process Model We would like to acknowledge Joseph Semaan for their assistance. Wi-Fi We would like to acknowledge Kun Peeks (@SwayZGl1tZyyy), an anonymous researcher for their assistance. Wi-Fi Connectivity We would like to acknowledge Alex Radocea of Supernetworks, Inc for their assistance. Widgets We would like to acknowledge Marcel Voß, Mitul Pranjay, Serok Çelik for their assistance. Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDIzMACgkQ4Ifiq8DH 7PWMkhAAvsa20SixWVdx++wzPw2ZA2Nhg1y2SSKV55Jv5pyHri1j8aWMZBo8M+zs XFXjAffMq6sYr00TA72PKYKaeMr4EgmR9QF8dLH4TiapGTm2Dt2GzjJpVoNM+bUe 5Ni/LsWNqwvp2REojDBmnUiRW7zAulkr1llW66F37IbxEI0oLjwUpKxNMDdeRulz Jy2d36QWO+kn0gHoanwWH71xBIC8iDPTyo46746ph5mVIh5IubrGV/JbKQtJj+RD srQQOqJL4OSau3mby7GB8s+jl0Vn2scrS+bGsj9zGHe81Jd8q9Twk5QLVZmpziB9 w7ACs2uOt/JoG6IafXCb9trWp8Xyvouq9CCV9oneCzio4biXU3ByJQM1GIzxyVx4 gbGo4HepN4+UPPZuhti9UrJ430zg3E1koqP43gNsGFKw4whfBODi62DkhuhZJ5cA AfCATNPfLXm4JPt2kpO0OxQ86lzK1xoeo5H7ZuG2qye60JqMUp4bqooEl18EjqC6 La9L19BS+iqcgcEASdITrgSqvI41Kv3EhZCkM0nwoaiuzHI8V2qJIO88tYurWYEi otgRWxwGmvhqlVUWjHaOtexu7qip/WWUwPx3rL6Ba4YHzstkotySVkLxIU6F3F/Q Imsm5uq1HqTi7ynbeUrAadi3N9pT9rez7gc+wmn9a7CJwR6bcrY= =HWjr -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。