Released December 6, 2017

APFS

Available for: macOS High Sierra 10.13.1

Impact: APFS encryption keys may not be securely deleted after hibernating

Description: A logic issue existed in APFS when deleting keys during hibernation. This was addressed with improved state management.

CVE-2017-13887: David Ryskalczyk

Entry added June 21, 2018

apache

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: Processing a maliciously crafted Apache configuration directive may result in the disclosure of process memory

Description: Multiple issues were addressed by updating to version 2.4.28.

CVE-2017-9798: Hanno Böck

Entry updated December 18, 2018

Auto Unlock

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to gain elevated privileges

Description: A race condition was addressed with additional validation.

CVE-2017-13905: Samuel Groß (@5aelo)

Entry added October 18, 2018

CFNetwork Session

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-7172: Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative

Entry added January 22, 2018

Contacts

Available for: macOS High Sierra 10.13.1

Impact: Sharing contact information may lead to unexpected data sharing

Description: An issue existed in the handling of Contact sharing. This issue was addressed with improved handling of user information.

CVE-2017-13892: Ryan Manly of Glenbrook High School District 225

Entry added October 18, 2018

CoreAnimation

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with elevated privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-7171: 360 Security working with Trend Micro's Zero Day Initiative, and Tencent Keen Security Lab (@keen_lab) working with Trend Micro's Zero Day Initiative

Entry added January 22, 2018

CoreFoundation

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to gain elevated privileges

Description: A race condition was addressed with additional validation.

CVE-2017-7151: Samuel Groß (@5aelo)

Entry added October 18, 2018

curl

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: Malicious FTP servers may be able to cause the client to read out-of-bounds memory

Description: An out-of-bounds read issue existed in the FTP PWD response parsing. This issue was addressed with improved bounds checking.

CVE-2017-1000254: Max Dymond

Directory Utility

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Not impacted: macOS Sierra 10.12.6 and earlier

Impact: An attacker may be able to bypass administrator authentication without supplying the administrator’s password

Description: A logic error existed in the validation of credentials. This was addressed with improved credential validation.

CVE-2017-13872

ICU

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to read restricted memory

Description: An integer overflow was addressed through improved input validation.

CVE-2017-15422: Yuan Deng of Ant-financial Light-Year Security Lab

Entry added March 14, 2018

Intel Graphics Driver

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-13883: Yu Wang of Didi Research America

CVE-2017-7163: Yu Wang of Didi Research America

CVE-2017-7155: Yu Wang of Didi Research America

Entry updated December 21, 2017

Intel Graphics Driver

Available for: macOS High Sierra 10.13.1

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation.

CVE-2017-13878: Ian Beer of Google Project Zero

Intel Graphics Driver

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with system privileges

Description: An out-of-bounds read was addressed through improved bounds checking.

CVE-2017-13875: Ian Beer of Google Project Zero

IOAcceleratorFamily

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with system privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-7159: found by IMF developed by HyungSeok Han (daramg.gift) of SoftSec, KAIST (softsec.kaist.ac.kr)

Entry updated December 21, 2017

IOKit

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with system privileges

Description: An input validation issue existed in the kernel. This issue was addressed through improved input validation.

CVE-2017-13848: Alex Plaskett of MWR InfoSecurity

CVE-2017-13858: an anonymous researcher

IOKit

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with system privileges

Description: Multiple memory corruption issues were addressed through improved state management.

CVE-2017-13847: Ian Beer of Google Project Zero

IOKit

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-7162: Tencent Keen Security Lab (@keen_lab) working with Trend Micro's Zero Day Initiative

Entry updated January 10, 2018

Kernel

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-13904: Kevin Backhouse of Semmle Ltd.

Entry added February 14, 2018

Kernel

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to read kernel memory (Meltdown)

Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of Graz University of Technology; Michael Schwarz of Graz University of Technology; Daniel Gruss of Graz University of Technology; Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus Technology GmbH; Stefan Mangard of Graz University of Technology; Paul Kocher; Daniel Genkin of University of Pennsylvania and University of Maryland; Yuval Yarom of University of Adelaide and Data61; and Mike Hamburg of Rambus (Cryptography Research Division)

Entry updated January 5, 2018

Kernel

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-13862: Apple

CVE-2017-13867: Ian Beer of Google Project Zero

Entry updated December 21, 2017

Kernel

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to read restricted memory

Description: An out-of-bounds read was addressed with improved bounds checking.

CVE-2017-7173: Brandon Azad

Entry updated January 11, 2018

Kernel

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved memory handling.

CVE-2017-13876: Ian Beer of Google Project Zero

Kernel

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to read restricted memory

Description: A type confusion issue was addressed with improved memory handling.

CVE-2017-13855: Jann Horn of Google Project Zero

Kernel

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2017-13865: Ian Beer of Google Project Zero

Kernel

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to read restricted memory

Description: A validation issue was addressed with improved input sanitization.

CVE-2017-13868: Brandon Azad

CVE-2017-13869: Jann Horn of Google Project Zero

Kernel

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: A local user may be able to cause unexpected system termination or read kernel memory

Description: An input validation issue existed in the kernel. This issue was addressed through improved input validation.

CVE-2017-7154: Jann Horn of Google Project Zero

Entry added December 21, 2017

Mail

Available for: macOS High Sierra 10.13.1

Impact: A S/MIME encrypted email may be inadvertently sent unencrypted if the receiver's S/MIME certificate is not installed

Description: An inconsistent user interface issue was addressed with improved state management.

CVE-2017-13871: Lukas Pitschl of GPGTools

Entry updated December 21, 2017

Mail Drafts

Available for: macOS High Sierra 10.13.1

Impact: An attacker with a privileged network position may be able to intercept mail

Description: An encryption issue existed with S/MIME credentials. The issue was addressed with additional checks and user control.

CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH

Entry updated January 10, 2018

OpenSSL

Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: An application may be able to read restricted memory

Description: An out-of-bounds read issue existed in X.509 IPAddressFamily parsing. This issue was addressed with improved bounds checking.

CVE-2017-3735: found by OSS-Fuzz

Perl

Available for: macOS Sierra 10.12.6

Impact: This bugs can allow remote attackers to cause a denial of service

Description: Public CVE-2017-12837 was addressed by updating the function in Perl 5.18

CVE-2017-12837: Jakub Wilk

Entry added October 18, 2018

Screen Sharing Server

Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.1

Impact: A user with screen sharing access may be able to access any file readable by root

Description: A permissions issue existed in the handling of screen sharing sessions. This issue was addressed with improved permissions handling.

CVE-2017-7158: Trevor Jacques of Toronto

Entry updated December 21, 2017

SIP

Available for: macOS High Sierra 10.13.1

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A configuration issue was addressed with additional restrictions.

CVE-2017-13911: Timothy Perfitt of Twocanoes Software

Entry updated August 8, 2018, updated September 25, 2018

Wi-Fi

Available for: macOS High Sierra 10.13.1

Impact: An unprivileged user may change Wi-Fi system parameters leading to denial of service

Description: An access issue existed with privileged Wi-Fi system configuration. This issue was addressed with additional restrictions.

CVE-2017-13886: David Kreitschmann and Matthias Schulz of Secure Mobile Networking Lab at TU Darmstadt

Entry added May 2, 2018