This document describes the security content of tvOS 11.
For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.
For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.
Apple security documents reference vulnerabilities by CVE-ID when possible.
Released September 19, 2017
802.1X
Available for: Apple TV (4th generation)
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS 1.1 and TLS 1.2.
CVE-2017-13832: Doug Wussler of Florida State University
Entry added October 31, 2017, updated November 10, 2017
CFNetwork
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13829: Niklas Baumstark and Samuel Gro working with Trend Micro’s Zero Day Initiative
CVE-2017-13833: Niklas Baumstark and Samuel Gro working with Trend Micro’s Zero Day Initiative
Entry added November 10, 2017
CFNetwork Proxies
Available for: Apple TV (4th generation)
Impact: An attacker in a privileged network position may be able to cause a denial of service
Description: Multiple denial of service issues were addressed through improved memory handling.
CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
Entry added September 25, 2017
CoreAudio
Available for: Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed by updating to Opus version 1.1.4.
CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro
Entry added September 25, 2017
CoreText
Available for: Apple TV (4th generation)
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: A memory consumption issue was addressed with improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre – Australian Signals Directorate
Entry added October 31, 2017, updated November 16, 2018
file
Available for: Apple TV (4th generation)
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version 5.31.
CVE-2017-13815: found by OSS-Fuzz
Entry added October 31, 2017, updated October 18, 2018
Fonts
Available for: Apple TV (4th generation)
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2017-13828: Leonard Grey and Robert Sesek of Google Chrome
Entry added October 31, 2017, updated November 10, 2017
HFS
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
Entry added October 31, 2017
ImageIO
Available for: Apple TV (4th generation)
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2017-13814: Australian Cyber Security Centre – Australian Signals Directorate
Entry added October 31, 2017, updated November 16, 2018
ImageIO
Available for: Apple TV (4th generation)
Impact: Processing a maliciously crafted image may lead to a denial of service
Description: A memory corruption issue was addressed with improved input validation.
CVE-2017-13831: Glen Carmichael
Entry added October 31, 2017, updated April 3, 2019
Kernel
Available for: Apple TV (4th generation)
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-13818: The UK’s National Cyber Security Centre (NCSC)
CVE-2017-13836: Vlad Tsyrklevich
CVE-2017-13841: Vlad Tsyrklevich
CVE-2017-13840: Vlad Tsyrklevich
CVE-2017-13842: Vlad Tsyrklevich
CVE-2017-13782: an anonymous researcher
Entry added October 31, 2017, updated June 18, 2018
Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13843: an anonymous researcher, an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Entry added September 25, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13854: shrek_wzw of Qihoo 360 Nirvan Team
Entry added November 2, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: Processing a malformed mach binary may lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
Entry added November 10, 2017
Kernel
Available for: Apple TV (4th generation)
Impact: A malicious application may be able to learn information about the presence and operation of other applications on the device.
Description: An application was able to access network activity information maintained by the operating system unrestricted. This issue was addressed by reducing the information available to third party applications.
CVE-2017-13873: Xiaokuan Zhang and Yinqian Zhang of The Ohio State University, Xueqiang Wang and XiaoFeng Wang of Indiana University Bloomington, and Xiaolong Bai of Tsinghua University
Entry added November 30, 2017
libarchive
Available for: Apple TV (4th generation)
Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution
Description: A buffer overflow issue was addressed through improved memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: Apple TV (4th generation)
Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution
Description: Multiple memory corruption issues existed in libarchive. These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
Entry added October 31, 2017
libc
Available for: Apple TV (4th generation)
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue in glob() was addressed through an improved algorithm.
CVE-2017-7086: Russ Cox of Google
Entry added September 25, 2017
libc
Available for: Apple TV (4th generation)
Impact: An application may be able to cause a denial of service
Description: A memory consumption issue was addressed through improved memory handling.
CVE-2017-1000373
Entry added September 25, 2017
libexpat
Available for: Apple TV (4th generation)
Impact: Multiple issues in expat
Description: Multiple issues were addressed by updating to version 2.2.1
CVE-2016-9063
CVE-2017-9233
Entry added September 25, 2017
libxml2
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
CVE-2017-9049: Wei Lei and Liu Yang - Nanyang Technological University in Singapore
Entry added October 18, 2018
libxml2
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2017-5130: an anonymous researcher
CVE-2017-7376: an anonymous researcher
Entry added October 18, 2018
libxml2
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2017-9050: Mateusz Jurczyk (j00ru) of Google Project Zero
Entry added October 18, 2018
Quick Look
Available for: Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-13822: Australian Cyber Security Centre – Australian Signals Directorate
Entry added October 31, 2017
Security
Available for: Apple TV (4th generation)
Impact: A revoked certificate may be trusted
Description: A certificate validation issue existed in the handling of revocation data. This issue was addressed through improved validation.
CVE-2017-7080: an anonymous researcher, Sven Driemecker of adesso mobile solutions gmbh, Rune Darrud (@theflyingcorpse) of Bærum kommune, an anonymous researcher
Entry added September 25, 2017
SQLite
Available for: Apple TV (4th generation)
Impact: Multiple issues in SQLite
Description: Multiple issues were addressed by updating to version 3.19.3.
CVE-2017-10989: found by OSS-Fuzz
CVE-2017-7128: found by OSS-Fuzz
CVE-2017-7129: found by OSS-Fuzz
CVE-2017-7130: found by OSS-Fuzz
Entry added September 25, 2017
SQLite
Available for: Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-7127: an anonymous researcher
Entry added September 25, 2017
WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved input validation.
CVE-2017-7081: Apple
Entry added September 25, 2017
WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
CVE-2017-7087: Apple
CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend Micro’s Zero Day Initiative
CVE-2017-7092: Qixun Zhao (@S0rryMybad) of Qihoo 360 Vulcan Team, Samuel Gro and Niklas Baumstark working with Trend Micro’s Zero Day Initiative
CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend Micro’s Zero Day Initiative
CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group
CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University working with Trend Micro’s Zero Day Initiative
CVE-2017-7096: Wei Yuan of Baidu Security Lab
CVE-2017-7098: Felipe Freitas of Instituto Tecnológico de Aeronáutica
CVE-2017-7099: Apple
CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53
CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University
CVE-2017-7104: likemeng of Baidu Secutity Lab
CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University
CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com) working with Trend Micro’s Zero Day Initiative
CVE-2017-7117: lokihardt of Google Project Zero
CVE-2017-7120: chenqin (陈钦) of Ant-financial Light-Year Security Lab
Entry added September 25, 2017
WebKit
Available for: Apple TV (4th generation)
Impact: Cookies belonging to one origin may be sent to another origin
Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed by no longer returning cookies for custom URL schemes.
CVE-2017-7090: Apple
Entry added September 25, 2017
WebKit
Available for: Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to a cross site scripting attack
Description: Application Cache policy may be unexpectedly applied.
CVE-2017-7109: avlidienbrunn
Entry added September 25, 2017
Wi-Fi
Available for: Apple TV (4th generation)
Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-11120: Gal Beniamini of Google Project Zero
CVE-2017-11121: Gal Beniamini of Google Project Zero
Entry added September 25, 2017
Wi-Fi
Available for: Apple TV (4th generation)
Impact: Malicious code executing on the Wi-Fi chip may be able to execute arbitrary code with kernel privileges on the application processor
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-7103: Gal Beniamini of Google Project Zero
CVE-2017-7105: Gal Beniamini of Google Project Zero
CVE-2017-7108: Gal Beniamini of Google Project Zero
CVE-2017-7110: Gal Beniamini of Google Project Zero
CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: Apple TV (4th generation)
Impact: Malicious code executing on the Wi-Fi chip may be able to execute arbitrary code with kernel privileges on the application processor
Description: Multiple race conditions were addressed through improved validation.
CVE-2017-7115: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: Apple TV (4th generation)
Impact: Malicious code executing on the Wi-Fi chip may be able to read restricted kernel memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-7116: Gal Beniamini of Google Project Zero
Wi-Fi
Available for: Apple TV (4th generation)
Impact: A attacker within range may be able to read restricted memory from the Wi-Fi chipset
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-11122: Gal Beniamini of Google Project Zero
Entry added October 9, 2017
zlib
Available for: Apple TV (4th generation)
Impact: Multiple issues in zlib
Description: Multiple issues were addressed by updating to version 1.2.11.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Entry added September 25, 2017
Security
We would like to acknowledge Abhinav Bansal of Zscaler, Inc. for their assistance.
WebKit
We would like to acknowledge Rayyan Bijoora (@Bijoora) of The City School, PAF Chapter for their assistance.
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.
Published Date: April 03, 2019