Apple today released watchOS 4.2.2 which addresses the following security issues:
Audio
Available for: All Apple Watch models
Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth
Available for: All Apple Watch models
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team
CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel
Available for: All Apple Watch models
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: All Apple Watch models
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: All Apple Watch models
Impact: A malicious application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed through improved input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: All Apple Watch models
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: All Apple Watch models
Impact: Processing a maliciously crafted text message may lead to application denial of service
Description: A resource exhaustion issue was addressed through improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore
Available for: All Apple Watch models
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue existed in the processing of web content. This issue was addressed through improved input validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro’s Zero Day Initiative
Security
Available for: All Apple Watch models
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling of name constraints. This issue was addressed through improved trust evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: All Apple Watch models
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4096: found by OSS-Fuzz
MacDailyNews Take: Get it so you can continue to be square (with rounded corners).
It’s also schnappy! 🙂
At the time of the chip scandal I saw reports claiming Apple Watch was not impacted. Apparently that was wrong.
Yeah, but does it fix breathe notifications? Cause that is broken and has been for awhile.
My Series 3 (GPS+LTE) started failing to load as much music as was originally allowed on its 16GB of storage. Hope that’s part of the update.