From: Apple Product Security
Reply to list

APPLE-SA-2016-02-25-1 Apple TV 7.2.1

Apple TV 7.2.1 is now available and addresses the following:

bootp
Available for:  Apple TV (3rd Generation)
Impact:  A malicious Wi-Fi network may be able to determine networks
a device has previously accessed
Description:  Upon connecting to a Wi-Fi network, iOS may have
broadcast MAC addresses of previously accessed networks via the DNAv4
protocol. This issue was addressed through disabling DNAv4 on
unencrypted Wi-Fi networks.
CVE-ID
CVE-2015-3778 : Piers O'Hanlon of Oxford Internet Institute,
University of Oxford (on the EPSRC Being There project)

CloudKit
Available for:  Apple TV (3rd Generation)
Impact:  A malicious application may be able to access the iCloud
user record of a previously signed in user
Description:  A state inconsistency existed in CloudKit when signing
out users. This issue was addressed through improved state handling.
CVE-ID
CVE-2015-3782 : Deepkanwal Plaha of University of Toronto

CFPreferences
Available for:  Apple TV (3rd Generation)
Impact:  A malicious app may be able to read other apps' managed
preferences
Description:  An issue existed in the third-party app sandbox. This
issue was addressed by improving the third-party sandbox profile.
CVE-ID
CVE-2015-3793 : Andreas Weinlein of the Appthority Mobility Threat
Team

Code Signing
Available for:  Apple TV (3rd Generation)
Impact:  A malicious application may be able to execute unsigned code
Description:  An issue existed that allowed unsigned code to be
appended to signed code in a specially crafted executable file. This
issue was addressed through improved code signature validation.
CVE-ID
CVE-2015-3806 : TaiG Jailbreak Team

Code Signing
Available for:  Apple TV (3rd Generation)
Impact:  A specially crafted executable file could allow unsigned,
malicious code to execute
Description:  An issue existed in the way multi-architecture
executable files were evaluated that could have allowed unsigned code
to be executed. This issue was addressed through improved validation
of executable files.
CVE-ID
CVE-2015-3803 : TaiG Jailbreak Team

Code Signing
Available for:  Apple TV (3rd Generation)
Impact:  A local user may be able to execute unsigned code
Description:  A validation issue existed in the handling of Mach-O
files. This was addressed by adding additional checks.
CVE-ID
CVE-2015-3802 : TaiG Jailbreak Team
CVE-2015-3805 : TaiG Jailbreak Team

CoreMedia Playback
Available for:  Apple TV (3rd Generation)
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  A memory corruption issue existed in CoreMedia
Playback. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5777 : Apple
CVE-2015-5778 : Apple

CoreText
Available for:  Apple TV (3rd Generation)
Impact:  Processing a maliciously crafted font file may lead to an
unexpected application termination or arbitrary code execution
Description:  A memory corruption issue existed in the processing of
font files. This issue was addressed through improved input
validation.
CVE-ID
CVE-2015-5755 : John Villamil (@day6reak), Yahoo Pentest Team
CVE-2015-5761 : John Villamil (@day6reak), Yahoo Pentest Team

DiskImages
Available for:  Apple TV (3rd Generation)
Impact:  Processing a maliciously crafted DMG file may lead to an
unexpected application termination or arbitrary code execution with
system privileges
Description:  A memory corruption issue existed in parsing of
malformed DMG images. This issue was addressed through improved
memory handling.
CVE-ID
CVE-2015-3800 : Frank Graziano of the Yahoo Pentest Team

FontParser
Available for:  Apple TV (3rd Generation)
Impact:  Processing a maliciously crafted font file may lead to an
unexpected application termination or arbitrary code execution
Description:  A memory corruption issue existed in the processing of
font files. This issue was addressed through improved input
validation.
CVE-ID
CVE-2015-3804 : Apple
CVE-2015-5756 : John Villamil (@day6reak), Yahoo Pentest Team
CVE-2015-5775 : Apple

ImageIO
Available for:  Apple TV (3rd Generation)
Impact:  Processing a maliciously crafted .tiff file may lead to an
unexpected application termination or arbitrary code execution
Description:  A memory corruption issue existed in the processing of
.tiff files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2015-5758 : Apple

ImageIO
Available for:  Apple TV (3rd Generation)
Impact:  Parsing maliciously crafted web content may result in the
disclosure of process memory
Description:  An uninitialized memory access issue existed in
ImageIO's handling of PNG images. This issue was addressed through
improved memory initialization and additional validation of PNG
images.
CVE-ID
CVE-2015-5781 : Michal Zalewski

ImageIO
Available for:  Apple TV (3rd Generation)
Impact:  Parsing maliciously crafted web content may result in the
disclosure of process memory
Description:  An uninitialized memory access issue existed in
ImageIO's handling of TIFF images. This issue is addressed through
improved memory initialization and additional validation of TIFF
images.
CVE-ID
CVE-2015-5782 : Michal Zalewski

IOKit
Available for:  Apple TV (3rd Generation)
Impact:  Parsing a maliciously crafted plist may lead to an
unexpected application termination or arbitrary code execution with
system privileges
Description:  A memory corruption existed in processing of malformed
plists. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-3776 : Teddy Reed of Facebook Security, Patrick Stein
(@jollyjinx) of Jinx Germany

IOHIDFamily
Available for:  Apple TV (3rd Generation)
Impact:  A local user may be able to execute arbitrary code with
system privileges
Description:  A buffer overflow issue existed in IOHIDFamily. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5774 : TaiG Jailbreak Team

Kernel
Available for:  Apple TV (3rd Generation)
Impact:  A malicious application may be able to determine kernel
memory layout
Description:  An issue existed in the mach_port_space_info interface,
which could have led to the disclosure of kernel memory layout. This
was addressed by disabling the mach_port_space_info interface.
CVE-ID
CVE-2015-3766 : Cererdlong of Alibaba Mobile Security Team,
@PanguTeam

Kernel
Available for:  Apple TV (3rd Generation)
Impact:  A malicious application may be able to execute arbitrary
code with system privileges
Description:  An integer overflow existed in the handling of IOKit
functions. This issue was addressed through improved validation of
IOKit API arguments.
CVE-ID
CVE-2015-3768 : Ilja van Sprundel

Libc
Available for:  Apple TV (3rd Generation)
Impact:  Processing a maliciously crafted regular expression may lead
to an unexpected application termination or arbitrary code execution
Description:  A memory corruption issue existed in the TRE library.
This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-3796 : Ian Beer of Google Project Zero
CVE-2015-3797 : Ian Beer of Google Project Zero
CVE-2015-3798 : Ian Beer of Google Project Zero

Libinfo
Available for:  Apple TV (3rd Generation)
Impact:  A remote attacker may be able to cause unexpected
application termination or arbitrary code execution
Description:  A memory corruption issue existed in handling AF_INET6
sockets. This issue was addressed by improved memory handling.
CVE-ID
CVE-2015-5776 : Apple

libpthread
Available for:  Apple TV (3rd Generation)
Impact:  A malicious application may be able to execute arbitrary
code with system privileges
Description:  A memory corruption issue existed in handling syscalls.
This issue was addressed through improved lock state checking.
CVE-ID
CVE-2015-5757 : Lufeng Li of Qihoo 360

libxml2
Available for:  Apple TV (3rd Generation)
Impact:  Parsing a maliciously crafted XML document may lead to
disclosure of user information
Description:  A memory corruption issue existed in parsing of XML
files. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-3807 : Michal Zalewski

libxml2
Available for:  Apple TV (3rd Generation)
Impact:  Multiple vulnerabilities existed in libxml2 versions prior
to 2.9.2, the most serious of which may allow a remote attacker to
cause a denial of service
Description:  Multiple vulnerabilities existed in libxml2 versions
prior to 2.9.2. These were addressed by updating libxml2 to version
2.9.2.
CVE-ID
CVE-2012-6685 : Felix Groebert of Google
CVE-2014-0191 : Felix Groebert of Google
CVE-2014-3660 : Felix Groebert of Google

libxpc
Available for:  Apple TV (3rd Generation)
Impact:  A malicious application may be able to execute arbitrary
code with system privileges
Description:  A memory corruption issue existed in handling of
malformed XPC messages. This issue was improved through improved
bounds checking.
CVE-ID
CVE-2015-3795 : Mathew Rowley

libxslt
Available for:  Apple TV (4th generation)
Impact:  Processing maliciously crafted XML may lead to arbitrary
code execution
Description:  A type confusion issue existed in libxslt. This issue
was addressed through improved memory handling.
CVE-ID
CVE-2015-7995 : puzzor

Location Framework
Available for:  Apple TV (3rd Generation)
Impact:  A local user may be able to modify protected parts of the
filesystem
Description:  A symbolic link issue was addressed through improved
path validation.
CVE-ID
CVE-2015-3759 : Cererdlong of Alibaba Mobile Security Team

Office Viewer
Available for:  Apple TV (3rd Generation)
Impact:  Parsing maliciously crafted XML may lead to disclosure of
user information
Description:  An external entity reference issue existed in XML
parsing. This issue was addressed through improved parsing.
CVE-ID
CVE-2015-3784 : Bruno Morisson of INTEGRITY S.A.

QL Office
Available for:  Apple TV (3rd Generation)
Impact:  Parsing a maliciously crafted office document may lead to an
unexpected application termination or arbitrary code execution
Description:  A memory corruption issue existed in parsing of office
documents. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5773 : Apple

Sandbox_profiles
Available for:  Apple TV (3rd Generation)
Impact:  An malicious app may be able to read other apps' managed
preferences
Description:  An issue existed in the third-party app sandbox. This
issue was addressed by improving the third-party sandbox profile.
CVE-ID
CVE-2015-5749 : Andreas Weinlein of the Appthority Mobility Threat
Team

WebKit
Available for:  Apple TV (3rd Generation)
Impact:  Processing maliciously crafted web content may lead to an
unexpected application termination or arbitrary code execution
Description:  Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2015-3730 : Apple
CVE-2015-3731 : Apple
CVE-2015-3732 : Apple
CVE-2015-3733 : Apple
CVE-2015-3734 : Apple
CVE-2015-3735 : Apple
CVE-2015-3736 : Apple
CVE-2015-3737 : Apple
CVE-2015-3738 : Apple
CVE-2015-3739 : Apple
CVE-2015-3740 : Apple
CVE-2015-3741 : Apple
CVE-2015-3742 : Apple
CVE-2015-3743 : Apple
CVE-2015-3744 : Apple
CVE-2015-3745 : Apple
CVE-2015-3746 : Apple
CVE-2015-3747 : Apple
CVE-2015-3748 : Apple
CVE-2015-3749 : Apple

WebKit
Available for:  Apple TV (3rd Generation)
Impact:  Maliciously crafted web content may exfiltrate image data
cross-origin
Description:  Images fetched through URLs that redirected to a
data:image resource could have been exfiltrated cross-origin. This
issue was addressed through improved canvas taint tracking.
CVE-ID
CVE-2015-3753 : Antonio Sanso and Damien Antipa of Adobe

WebKit
Available for:  Apple TV (3rd Generation)
Impact:  Maliciously crafted web content may trigger plaintext
requests to an origin under HTTP Strict Transport Security
Description:  An issue existed where Content Security Policy report
requests would not honor HTTP Strict Transport Security (HSTS). The
issue was addressed by applying HSTS to CSP.
CVE-ID
CVE-2015-3750 : Muneaki Nishimura (nishimunea)

WebKit
Available for:  Apple TV (3rd Generation)
Impact:  Content Security Policy report requests may leak cookies
Description:  Two issues existed in how cookies were added to Content
Security Policy report requests. Cookies were sent in cross-origin
report requests in violation of the standard. Cookies set during
regular browsing were sent in private browsing. These issues were
addressed through improved cookie handling.
CVE-ID
CVE-2015-3752 : Muneaki Nishimura (nishimunea)

WebKit
Available for:  Apple TV (3rd Generation)
Impact:  Image loading may violate a website's Content Security
Policy directive
Description:  An issue existed where processing web content with
video controls would load images nested in object elements in
violation of the website's Content Security Policy directive. This
issue was addressed through improved Content Security Policy
enforcement.
CVE-ID
CVE-2015-3751 : Muneaki Nishimura (nishimunea)
iQIcBAEBCgAGBQJWz04oAAoJEBcWfLTuOo7t9vAP/1kvJ6WDPUBruJcsWQfTHL1e
I/bZ0v+Xqc4Cg9pZZgeXaRKZODzZ6p01qVoIlGTT4Y3rF5F3nu04CI1L9zALie6e
VdeVeCL4kSqB4J6Rac9WfmcksxY6vp0rXMmW1PEsZxllZSOkpzjBSXQSn5qWQ0Nu
Zaku2q/Gy39Y26y/bceQmE5Gb73UEMvoOrtpdLfLenX4DJDk+eSpqcmb9fu+z8Ek
M5/V7Aj4nxdktfsxL1V/MrM/ZtfTKidWGahUHu0FNVj+KDOIE7WBQNgWkF277Bpn
D36BrxcLML+OUbiRfLY5csk4wgqVRPUihhnu6MGFOpX3U+k93KSp81ZoFN0EG3aZ
PnopV2vczq8vaCx6/F7sBF2w5xlxi9H2k/Z7sNtzOE6wgOUXQVBR8Yu0iA4TwnmQ
sjddG0mqO6eB9HNWc3w1BGXrJjMyWP8kccSu8U6XinR9XxfvnBhP3QjuMHM59LCW
wzM8SDM1WXK4uVYzyTJxi2X4vDXD+8OPicfDvtdf9lPvgxNY019esXdlalMnoVDp
UE2JJidtp+1JZZBMRQL1VgJ/MMMQ9W6/SVEoaJiQnmi0r92k5uYxUB3hxMD5HXBX
n9jVlUYAFGwwtXGT/zV6hNt/BRbzjWZ8qKRYyrD/Ey7Jbpqc2JMugpJGIapudHYj
ruyz2x2bG3gnL1LLoxoM
=EI+J