About the security content of Apple TV 7.2.1

This document describes the security content of Apple TV 7.2.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other security updates, see Apple security updates.

Apple TV 7.2.1

  • bootp

    Available for: Apple TV (3rd generation)

    Impact: A malicious Wi-Fi network may be able to determine networks a device has previously accessed

    Description: Upon connecting to a Wi-Fi network, iOS may have broadcast MAC addresses of previously accessed networks via the DNAv4 protocol. This issue was addressed through disabling DNAv4 on unencrypted Wi-Fi networks.

    CVE-ID

    CVE-2015-3778 : Piers O'Hanlon of Oxford Internet Institute, University of Oxford (on the EPSRC Being There project)

  • CloudKit

    Available for: Apple TV (3rd generation)

    Impact: A malicious application may be able to access the iCloud user record of a previously signed in user

    Description: A state inconsistency existed in CloudKit when signing out users. This issue was addressed through improved state handling.

    CVE-ID

    CVE-2015-3782 : Deepkanwal Plaha of University of Toronto

  • CFPreferences

    Available for: Apple TV (3rd generation)

    Impact: A malicious app may be able to read other apps' managed preferences

    Description: An issue existed in the third-party app sandbox. This issue was addressed by improving the third-party sandbox profile.

    CVE-ID

    CVE-2015-3793 : Andreas Weinlein of the Appthority Mobility Threat Team

  • Code Signing

    Available for: Apple TV (3rd generation)

    Impact: A malicious application may be able to execute unsigned code

    Description: An issue existed that allowed unsigned code to be appended to signed code in a specially crafted executable file. This issue was addressed through improved code signature validation.

    CVE-ID

    CVE-2015-3806 : TaiG Jailbreak Team

  • Code Signing

    Available for: Apple TV (3rd generation)

    Impact: A specially crafted executable file could allow unsigned, malicious code to execute

    Description: An issue existed in the way multi-architecture executable files were evaluated that could have allowed unsigned code to be executed. This issue was addressed through improved validation of executable files.

    CVE-ID

    CVE-2015-3803 : TaiG Jailbreak Team

  • Code Signing

    Available for: Apple TV (3rd generation)

    Impact: A local user may be able to execute unsigned code

    Description: A validation issue existed in the handling of Mach-O files. This was addressed by adding additional checks.

    CVE-ID

    CVE-2015-3802 : TaiG Jailbreak Team

    CVE-2015-3805 : TaiG Jailbreak Team

  • CoreMedia Playback

    Available for: Apple TV (3rd generation)

    Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue existed in CoreMedia Playback. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2015-5777 : Apple

    CVE-2015-5778 : Apple

  • CoreText

    Available for: Apple TV (3rd generation)

    Impact: Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation.

    CVE-ID

    CVE-2015-5755 : John Villamil (@day6reak), Yahoo Pentest Team

    CVE-2015-5761 : John Villamil (@day6reak), Yahoo Pentest Team

  • DiskImages

    Available for: Apple TV (3rd generation)

    Impact: Processing a maliciously crafted DMG file may lead to an unexpected application termination or arbitrary code execution with system privileges

    Description: A memory corruption issue existed in parsing of malformed DMG images. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2015-3800 : Frank Graziano of the Yahoo Pentest Team

  • FontParser

    Available for: Apple TV (3rd generation)

    Impact: Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation.

    CVE-ID

    CVE-2015-3804 : Apple

    CVE-2015-5756 : John Villamil (@day6reak), Yahoo Pentest Team

    CVE-2015-5775 : Apple

  • ImageIO

    Available for: Apple TV (3rd generation)

    Impact: Processing a maliciously crafted .tiff file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue existed in the processing of .tiff files. This issue was addressed through improved bounds checking.

    CVE-ID

    CVE-2015-5758 : Apple

  • ImageIO

    Available for: Apple TV (3rd generation)

    Impact: Parsing maliciously crafted web content may result in the disclosure of process memory

    Description: An uninitialized memory access issue existed in ImageIO's handling of PNG images. This issue was addressed through improved memory initialization and additional validation of PNG images.

    CVE-ID

    CVE-2015-5781 : Michal Zalewski

  • ImageIO

    Available for: Apple TV (3rd generation)

    Impact: Parsing maliciously crafted web content may result in the disclosure of process memory

    Description: An uninitialized memory access issue existed in ImageIO's handling of TIFF images. This issue is addressed through improved memory initialization and additional validation of TIFF images.

    CVE-ID

    CVE-2015-5782 : Michal Zalewski

  • IOKit

    Available for: Apple TV (3rd generation)

    Impact: Parsing a maliciously crafted plist may lead to an unexpected application termination or arbitrary code execution with system privileges

    Description: A memory corruption existed in processing of malformed plists. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2015-3776 : Teddy Reed of Facebook Security, Patrick Stein (@jollyjinx) of Jinx Germany

  • IOHIDFamily

    Available for: Apple TV (3rd generation)

    Impact: A local user may be able to execute arbitrary code with system privileges

    Description: A buffer overflow issue existed in IOHIDFamily. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2015-5774 : TaiG Jailbreak Team

  • Kernel

    Available for: Apple TV (3rd generation)

    Impact: A malicious application may be able to determine kernel memory layout

    Description: An issue existed in the mach_port_space_info interface, which could have led to the disclosure of kernel memory layout. This was addressed by disabling the mach_port_space_info interface.

    CVE-ID

    CVE-2015-3766 : Cererdlong of Alibaba Mobile Security Team, @PanguTeam

  • Kernel

    Available for: Apple TV (3rd generation)

    Impact: A malicious application may be able to execute arbitrary code with system privileges

    Description: An integer overflow existed in the handling of IOKit functions. This issue was addressed through improved validation of IOKit API arguments.

    CVE-ID

    CVE-2015-3768 : Ilja van Sprundel

  • Libc

    Available for: Apple TV (3rd generation)

    Impact: Processing a maliciously crafted regular expression may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue existed in the TRE library. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2015-3796 : Ian Beer of Google Project Zero

    CVE-2015-3797 : Ian Beer of Google Project Zero

    CVE-2015-3798 : Ian Beer of Google Project Zero

  • Libinfo

    Available for: Apple TV (3rd generation)

    Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution

    Description: A memory corruption issue existed in handling AF_INET6 sockets. This issue was addressed by improved memory handling.

    CVE-ID

    CVE-2015-5776 : Apple

  • libpthread

    Available for: Apple TV (3rd generation)

    Impact: A malicious application may be able to execute arbitrary code with system privileges

    Description: A memory corruption issue existed in handling syscalls. This issue was addressed through improved lock state checking.

    CVE-ID

    CVE-2015-5757 : Lufeng Li of Qihoo 360

  • libxml2

    Available for: Apple TV (3rd generation)

    Impact: Parsing a maliciously crafted XML document may lead to disclosure of user information

    Description: A memory corruption issue existed in parsing of XML files. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2015-3807 : Michal Zalewski

  • libxml2

    Available for: Apple TV (3rd generation)

    Impact: Multiple vulnerabilities existed in libxml2 versions prior to 2.9.2, the most serious of which may allow a remote attacker to cause a denial of service

    Description: Multiple vulnerabilities existed in libxml2 versions prior to 2.9.2. These were addressed by updating libxml2 to version 2.9.2.

    CVE-ID

    CVE-2012-6685 : Felix Groebert of Google

    CVE-2014-0191 : Felix Groebert of Google

    CVE-2014-3660 : Felix Groebert of Google

  • libxpc

    Available for: Apple TV (3rd generation)

    Impact: A malicious application may be able to execute arbitrary code with system privileges

    Description: A memory corruption issue existed in handling of malformed XPC messages. This issue was improved through improved bounds checking.

    CVE-ID

    CVE-2015-3795 : Mathew Rowley

  • libxslt

    Available for: Apple TV (3rd generation)

    Impact: Processing maliciously crafted XML may lead to arbitrary code execution

    Description: A type confusion issue existed in libxslt. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2015-7995 : puzzor

  • Location Framework

    Available for: Apple TV (3rd generation)

    Impact: A local user may be able to modify protected parts of the filesystem

    Description: A symbolic link issue was addressed through improved path validation.

    CVE-ID

    CVE-2015-3759 : Cererdlong of Alibaba Mobile Security Team

  • Office Viewer

    Available for: Apple TV (3rd generation)

    Impact: Parsing maliciously crafted XML may lead to disclosure of user information

    Description: An external entity reference issue existed in XML parsing. This issue was addressed through improved parsing.

    CVE-ID

    CVE-2015-3784 : Bruno Morisson of INTEGRITY S.A.

  • QL Office

    Available for: Apple TV (3rd generation)

    Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue existed in parsing of office documents. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2015-5773 : Apple

  • Sandbox_profiles

    Available for: Apple TV (3rd generation)

    Impact: An malicious app may be able to read other apps' managed preferences

    Description: An issue existed in the third-party app sandbox. This issue was addressed by improving the third-party sandbox profile.

    CVE-ID

    CVE-2015-5749 : Andreas Weinlein of the Appthority Mobility Threat Team

  • WebKit

    Available for: Apple TV (3rd generation)

    Impact: Processing maliciously crafted web content may lead to an unexpected application termination or arbitrary code execution

    Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.

    CVE-ID

    CVE-2015-3730 : Apple

    CVE-2015-3731 : Apple

    CVE-2015-3732 : Apple

    CVE-2015-3733 : Apple

    CVE-2015-3734 : Apple

    CVE-2015-3735 : Apple

    CVE-2015-3736 : Apple

    CVE-2015-3737 : Apple

    CVE-2015-3738 : Apple

    CVE-2015-3739 : Apple

    CVE-2015-3740 : Apple

    CVE-2015-3741 : Apple

    CVE-2015-3742 : Apple

    CVE-2015-3743 : Apple

    CVE-2015-3744 : Apple

    CVE-2015-3745 : Apple

    CVE-2015-3746 : Apple

    CVE-2015-3747 : Apple

    CVE-2015-3748 : Apple

    CVE-2015-3749 : Apple

  • WebKit

    Available for: Apple TV (3rd generation)

    Impact: Maliciously crafted web content may exfiltrate image data cross-origin

    Description: Images fetched through URLs that redirected to a data:image resource could have been exfiltrated cross-origin. This issue was addressed through improved canvas taint tracking.

    CVE-ID

    CVE-2015-3753 : Antonio Sanso and Damien Antipa of Adobe

  • WebKit

    Available for: Apple TV (3rd generation)

    Impact: Maliciously crafted web content may trigger plaintext requests to an origin under HTTP Strict Transport Security

    Description: An issue existed where Content Security Policy report requests would not honor HTTP Strict Transport Security (HSTS). The issue was addressed by applying HSTS to CSP.

    CVE-ID

    CVE-2015-3750 : Muneaki Nishimura (nishimunea)

  • WebKit

    Available for: Apple TV (3rd generation)

    Impact: Content Security Policy report requests may leak cookies

    Description: Two issues existed in how cookies were added to Content Security Policy report requests. Cookies were sent in cross-origin report requests in violation of the standard. Cookies set during regular browsing were sent in private browsing. These issues were addressed through improved cookie handling.

    CVE-ID

    CVE-2015-3752 : Muneaki Nishimura (nishimunea)

  • WebKit

    Available for: Apple TV (3rd generation)

    Impact: Image loading may violate a website's Content Security Policy directive

    Description: An issue existed where processing web content with video controls would load images nested in object elements in violation of the website's Content Security Policy directive. This issue was addressed through improved Content Security Policy enforcement.

    CVE-ID

    CVE-2015-3751 : Muneaki Nishimura (nishimunea)

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: