About the security content of watchOS 6.2.8
This document describes the security content of watchOS 6.2.8.
About Apple security updates
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
watchOS 6.2.8
Audio
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2020-9884: Yu Zhou(@yuzhou6666) of 小鸡帮 working with Trend Micro Zero Day Initiative
CVE-2020-9889: Anonymous working with Trend Micro’s Zero Day Initiative, JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab
Audio
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2020-9888: JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-9890: JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-9891: JunDong Xie and XingWei Lin of Ant-Financial Light-Year Security Lab
CoreGraphics
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2020-9883: an anonymous researcher, Mickey Jin of Trend Micro
Crash Reporter
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to break out of its sandbox
Description: A memory corruption issue was addressed by removing the vulnerable code.
CVE-2020-9865: Zhuo Liang of Qihoo 360 Vulcan Team working with 360 BugCloud
Crash Reporter
Available for: Apple Watch Series 1 and later
Impact: A local attacker may be able to elevate their privileges
Description: An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization.
CVE-2020-9900: Cees Elzinga, Zhongcheng Li (CK01) from Zero-dayits Team of Legendsec at Qi'anxin Group
FontParser
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2020-9980: Xingwei Lin of Ant Security Light-Year Lab
GeoServices
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to read sensitive location information
Description: An authorization issue was addressed with improved state management.
CVE-2020-9933: Min (Spark) Zheng and Xiaolong Bai of Alibaba Inc.
ImageIO
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2020-27933: Xingwei Lin of Ant-Financial Light-Year Security Lab
ImageIO
Available for: Apple Watch Series 1 and later
Impact: Multiple buffer overflow issues existed in openEXR
Description: Multiple issues in openEXR were addressed with improved checks.
CVE-2020-11758: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-11759: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-11760: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-11761: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-11762: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-11763: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-11764: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-11765: Xingwei Lin of Ant-Financial Light-Year Security Lab
ImageIO
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2020-9871: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-9872: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-9874: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-9879: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-9936: Mickey Jin of Trend Micro
CVE-2020-9937: Xingwei Lin of Ant-Financial Light-Year Security Lab
ImageIO
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2020-9919: Mickey Jin of Trend Micro
ImageIO
Available for: Apple Watch Series 1 and later
Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2020-9876: Mickey Jin of Trend Micro
ImageIO
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2020-9873: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-9938: Xingwei Lin of Ant-Financial Light-Year Security Lab
CVE-2020-9984: an anonymous researcher
ImageIO
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2020-9877: Xingwei Lin of Ant-Financial Light-Year Security Lab
ImageIO
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: An integer overflow was addressed through improved input validation.
CVE-2020-9875: Mickey Jin of Trend Micro
Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2020-9923: Proteas
Kernel
Available for: Apple Watch Series 1 and later
Impact: An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2020-9909: Brandon Azad of Google Project Zero
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved state management.
CVE-2020-9904: Tielei Wang of Pangu Lab
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2020-9863: Xinru Chi of Pangu Lab
Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: Multiple memory corruption issues were addressed with improved state management.
CVE-2020-9892: Andy Nguyen of Google
Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to determine kernel memory layout
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2020-9902: Xinru Chi and Tielei Wang of Pangu Lab
Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may disclose restricted memory
Description: An information disclosure issue was addressed with improved state management.
CVE-2020-9997: Catalin Valeriu Lita of SecurityScorecard
libxml2
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
CVE-2020-9926: Found by OSS-Fuzz
Available for: Apple Watch Series 1 and later
Impact: A malicious mail server may overwrite arbitrary mail files
Description: A path handling issue was addressed with improved validation.
CVE-2020-9920: YongYue Wang AKA BigChan of Hillstone Networks AF Team
Messages
Available for: Apple Watch Series 1 and later
Impact: A user that is removed from an iMessage group could rejoin the group
Description: An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification.
CVE-2020-9885: an anonymous researcher, Suryansh Mansharamani, of WWP High School North (medium.com/@suryanshmansha)
Model I/O
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution
Description: A buffer overflow was addressed with improved bounds checking.
CVE-2020-9880: Holger Fuhrmannek of Deutsche Telekom Security
Model I/O
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2020-9878: Aleksandar Nikolic of Cisco Talos, Holger Fuhrmannek of Deutsche Telekom Security
CVE-2020-9881: Holger Fuhrmannek of Deutsche Telekom Security
CVE-2020-9882: Holger Fuhrmannek of Deutsche Telekom Security
CVE-2020-9985: Holger Fuhrmannek of Deutsche Telekom Security
Security
Available for: Apple Watch Series 1 and later
Impact: An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate
Description: A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation.
CVE-2020-9868: Brian Wolff of Asana
WebKit
Available for: Apple Watch Series 1 and later
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2020-9894: 0011 working with Trend Micro Zero Day Initiative
WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Description: An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions.
CVE-2020-9915: Ayoub AIT ELMOKHTAR of Noon
WebKit
Available for: Apple Watch Series 1 and later
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A logic issue was addressed with improved state management.
CVE-2020-9925: an anonymous researcher
WebKit
Available for: Apple Watch Series 1 and later
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
CVE-2020-9893: 0011 working with Trend Micro Zero Day Initiative
CVE-2020-9895: Wen Xu of SSLab, Georgia Tech
WebKit
Available for: Apple Watch Series 1 and later
Impact: A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication
Description: Multiple issues were addressed with improved logic.
CVE-2020-9910: Samuel Groß of Google Project Zero
WebKit Page Loading
Available for: Apple Watch Series 1 and later
Impact: A malicious attacker may be able to conceal the destination of a URL
Description: A URL Unicode encoding issue was addressed with improved state management.
CVE-2020-9916: Rakesh Mane (@RakeshMane10)
WebKit Web Inspector
Available for: Apple Watch Series 1 and later
Impact: Copying a URL from Web Inspector may lead to command injection
Description: A command injection issue existed in Web Inspector. This issue was addressed with improved escaping.
CVE-2020-9862: Ophir Lojkine (@lovasoa)
WebRTC
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to cause heap corruption via a crafted SCTP stream
Description: A memory corruption issue was addressed with improved state management.
CVE-2020-6514: natashenka of Google Project Zero
Wi-Fi
Available for: Apple Watch Series 1 and later
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2020-9918: Jianjun Dai of 360 Alpha Lab working with 360 BugCloud (bugcloud.360.cn)
Wi-Fi
Available for: Apple Watch Series 1 and later
Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Description: A memory corruption issue was addressed with improved input validation.
CVE-2020-9906: Ian Beer of Google Project Zero
Additional recognition
CoreFoundation
We would like to acknowledge Bobby Pelletier for their assistance.
Kernel
We would like to acknowledge Brandon Azad of Google Project Zero for their assistance.
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.