About the security content of watchOS 3.1

This document describes the security content of watchOS 3.1.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.

Apple security documents reference vulnerabilities by CVE-ID when possible.

watchOS 3.1

AppleMobileFileIntegrity

Available for: All Apple Watch models

Impact: A signed executable may substitute code with the same team ID

Description: A validation issue existed in the handling of code signatures. This issue was addressed through additional validation.

CVE-2016-7584: Mark Mentovai and Boris Vidolov of Google Inc.

CoreGraphics

Available for: All Apple Watch models

Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution

Description: A memory corruption issue was addressed through improved memory handling.

CVE-2016-4673: Marco Grassi (@marcograss) of KeenLab (@keen_lab), Tencent

FontParser

Available for: All Apple Watch models

Impact: Parsing a maliciously crafted font may disclose sensitive user information

Description: An out-of-bounds read was addressed through improved bounds checking.

CVE-2016-4660: Ke Liu of Tencent's Xuanwu Lab

FontParser

Available for: All Apple Watch models

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking.

CVE-2016-4688: Simon Huang of Alipay company, thelongestusernameofall@gmail.com

Kernel

Available for: All Apple Watch models

Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel

Description: Multiple input validation issues existed in MIG generated code. These issues were addressed through improved validation.

CVE-2016-4669: Ian Beer of Google Project Zero

Kernel

Available for: All Apple Watch models

Impact: An application may be able to disclose kernel memory

Description: A validation issue was addressed through improved input sanitization.

CVE-2016-4680: Max Bazaliy of Lookout and in7egral

Kernel

Available for: All Apple Watch models

Impact: A local application may be able to execute arbitrary code with root privileges

Description: Multiple object lifetime issues existed when spawning new processes. These were addressed through improved validation.

CVE-2016-7613: Ian Beer of Google Project Zero

libarchive

Available for: All Apple Watch models

Impact: A malicious archive may be able to overwrite arbitrary files

Description: An issue existed within the path validation logic for symlinks. This issue was addressed through improved path sanitization.

CVE-2016-4679: Omer Medan of enSilo Ltd

libxpc

Available for: All Apple Watch models

Impact: An application may be able to execute arbitrary code with root privileges

Description: A logic issue was addressed through additional restrictions.

CVE-2016-4675: Ian Beer of Google Project Zero

Sandbox Profiles

Available for: All Apple Watch models

Impact: An application may be able to retrieve metadata of photo directories

Description: An access issue was addressed through additional sandbox restrictions on third party applications.

CVE-2016-4664: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt)

Sandbox Profiles

Available for: All Apple Watch models

Impact: An application may be able to retrieve metadata of audio recording directories

Description: An access issue was addressed through additional sandbox restrictions on third party applications.

CVE-2016-4665: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt)