About the security content of tvOS 16.4

This document describes the security content of tvOS 16.4.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

tvOS 16.4

Released March 27, 2023

AppleMobileFileIntegrity

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: A user may gain access to protected parts of the file system

Description: The issue was addressed with improved checks.

CVE-2023-23527: Mickey Jin (@patch1t)

ColorSync

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to read arbitrary files

Description: The issue was addressed with improved checks.

CVE-2023-27955: JeongOhKyea

Entry added June 8, 2023

Core Bluetooth

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: Processing a maliciously crafted Bluetooth packet may result in disclosure of process memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2023-23528: Jianjun Dai and Guang Gong of 360 Vulnerability Research Institute

CoreCapture

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: The issue was addressed with improved memory handling.

CVE-2023-28181: Tingting Yin of Tsinghua University

FontParser

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: Processing a maliciously crafted image may result in disclosure of process memory

Description: The issue was addressed with improved memory handling.

CVE-2023-27956: Ye Zhang of Baidu Security

Foundation

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: Parsing a maliciously crafted plist may lead to an unexpected app termination or arbitrary code execution

Description: An integer overflow was addressed with improved input validation.

CVE-2023-27937: an anonymous researcher

Identity Services

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to access information about a user’s contacts

Description: A privacy issue was addressed with improved private data redaction for log entries.

CVE-2023-27928: Csaba Fitzl (@theevilbit) of Offensive Security

ImageIO

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: Processing a maliciously crafted image may result in disclosure of process memory

Description: The issue was addressed with improved memory handling.

CVE-2023-23535: ryuzaki

ImageIO

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: Processing a maliciously crafted image may result in disclosure of process memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2023-27929: Meysam Firouzi (@R00tkitSMM) of Mbition Mercedes-Benz Innovation Lab and jzhu working with Trend Micro Zero Day Initiative

ImageIO

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: Processing an image may result in disclosure of process memory

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2023-42862: Meysam Firouzi @R00tkitSMM

CVE-2023-42865: jzhu working with Trend Micro Zero Day Initiative, and Meysam Firouzi (@R00tkitSMM) of Mbition Mercedes-Benz Innovation Lab

Entry added December 21, 2023

Kernel

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: The issue was addressed with improved bounds checks.

CVE-2023-23536: Félix Poulin-Bélanger and David Pan Ogea

Entry added June 8, 2023, updated December 21, 2023

Kernel

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: A use after free issue was addressed with improved memory management.

CVE-2023-27969: Adam Doupé of ASU SEFCOM

Kernel

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges

Description: The issue was addressed with improved memory handling.

CVE-2023-27933: sqrtpwn

Kernel

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to cause a denial-of-service

Description: An integer overflow was addressed through improved input validation.

CVE-2023-28185: Pan ZhenPeng of STAR Labs SG Pte. Ltd.

Entry added December 21, 2023

Podcasts

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to access user-sensitive data

Description: The issue was addressed with improved checks.

CVE-2023-27942: Mickey Jin (@patch1t)

Sandbox

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to bypass Privacy preferences

Description: A logic issue was addressed with improved validation.

CVE-2023-28178: Yiğit Can YILMAZ (@yilmazcanyigit)

Entry added June 8, 2023

Shortcuts

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: A shortcut may be able to use sensitive data with certain actions without prompting the user

Description: The issue was addressed with additional permissions checks.

CVE-2023-27963: Wenchao Li and Xiaolong Bai of Alibaba Group, and Jubaer Alnazi Jabin of TRS Group Of Companies

Entry added June 8, 2023

TCC

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: An app may be able to access user-sensitive data

Description: This issue was addressed by removing the vulnerable code.

CVE-2023-27931: Mickey Jin (@patch1t)

WebKit

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: Processing maliciously crafted web content may bypass Same Origin Policy

Description: This issue was addressed with improved state management.

WebKit Bugzilla: 248615

CVE-2023-27932: an anonymous researcher

WebKit

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: A website may be able to track sensitive user information

Description: The issue was addressed by removing origin information.

WebKit Bugzilla: 250837

CVE-2023-27954: an anonymous researcher

WebKit Web Inspector

Available for: Apple TV 4K (all models) and Apple TV HD

Impact: A remote attacker may be able to cause unexpected app termination or arbitrary code execution

Description: This issue was addressed with improved state management.

CVE-2023-28201: Dohyun Lee (@l33d0hyun), and crixer (@pwning_me) of SSD Labs

Entry added June 8, 2023

Additional recognition

CFNetwork

We would like to acknowledge an anonymous researcher for their assistance.

CoreServices

We would like to acknowledge Mickey Jin (@patch1t) for their assistance.

ImageIO

We would like to acknowledge Meysam Firouzi @R00tkitSMM for their assistance.

WebKit

We would like to acknowledge an anonymous researcher for their assistance.

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: