For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see " Apple Security Updates.

Apple TV Software Update 4.4

• Apple TV

  Available for: Apple TV 4.0 through 4.3

  Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information

  Description: Fraudulent certificates were issued by multiple certificate authorities operated by DigiNotar. This issue is addressed by removing DigiNotar from the list of trusted root certificates, from the list of Extended Validation (EV) certificate authorities, and by configuring default system trust settings so that DigiNotar's certificates, including those issued by other authorities, are not trusted.

• Apple TV

  Available for: Apple TV 4.0 through 4.3

  Impact: Support for X.509 certificates with MD5 hashes may expose users to spoofing and information disclosure as attacks improve

  Description: Certificates signed using the MD5 hash algorithm were accepted by iOS. This algorithm has known cryptographic weaknesses. Further research or a misconfigured certificate authority could have allowed the creation of X.509 certificates with attacker controlled values that would have been trusted by the system. This would have exposed X.509 based protocols to spoofing, man in the middle attacks, and information disclosure. This update disables support for an X.509 certificate with an MD5 hash for any use other than as a trusted root certificate.

  CVE-ID

  CVE-2011-3427

• Apple TV

  Available for: Apple TV 4.0 through 4.3

  Impact: An attacker could decrypt part of a SSL connection

  Description: Only the SSLv3 and TLS 1.0 versions of SSL were supported. These versions are subject to a protocol weakness when using block ciphers. A man-in-the-middle attacker could have injected invalid data, causing the connection to close but revealing some information about the previous data. If the same connection was attempted repeatedly the attacker may eventually have been able to decrypt the data being sent, such as a password. This issue is addressed by adding support for TLS 1.2.

  CVE-ID

  CVE-2011-3389

• Apple TV

  Available for: Apple TV 4.0 through 4.3

  Impact: Viewing a maliciously crafted TIFF image may result in an unexpected application termination or arbitrary code execution

  Description: A buffer overflow existed in libTIFF's handling of CCITT Group 4 encoded TIFF images.

  CVE-ID

  CVE-2011-0192 : Apple

• Apple TV

  Available for: Apple TV 4.0 through 4.3

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A heap buffer overflow existed in ImageIO's handling of CCITT Group 4 encoded TIFF images.

  CVE-ID

  CVE-2011-0241 : Cyril CATTIAUX of Tessi Technologies

• Apple TV

  Available for: Apple TV 4.0 through 4.3

  Impact: A remote attacker may cause a device reset

  Description: The kernel failed to promptly reclaim memory from incomplete TCP connections. An attacker with the ability to connect to a listening service on an iOS device could exhaust system resources.

  CVE-ID

  CVE-2011-3259 : Wouter van der Veer of Topicus I&I, and Josh Enders

• Apple TV

  Available for: Apple TV 4.0 through 4.3

  Impact: An attacker with a privileged network position may cause an unexpected application termination or arbitrary code execution

  Description: A one-byte heap buffer overflow existed in libxml's handling of XML data.

  CVE-ID

  CVE-2011-0216 : Billy Rios of the Google Security Team

• Apple TV

  Available for: Apple TV 4.0 through 4.3

  Impact: An attacker with a privileged network position may cause an unexpected application termination or arbitrary code execution

  Description: A memory corruption issue existed in JavaScriptCore.

  CVE-ID

  CVE-2011-3232 : Aki Helin of OUSPG