APPLE-SA-12-11-2023-8 watchOS 10.2

watchOS 10.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214041.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accounts
Available for: Apple Watch Series 4 and later
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved private data
redaction for log entries.
CVE-2023-42919: Kirin (@Pwnrin)

ExtensionKit
Available for: Apple Watch Series 4 and later
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved private data
redaction for log entries.
CVE-2023-42927: Noah Roskin-Frazee and Prof. J. (ZeroClicks.ai Lab)

ImageIO
Available for: Apple Watch Series 4 and later
Impact: Processing an image may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
CVE-2023-42898: Junsung Lee
CVE-2023-42899: Meysam Firouzi @R00tkitSMM and Junsung Lee

Kernel
Available for: Apple Watch Series 4 and later
Impact: An app may be able to break out of its sandbox
Description: The issue was addressed with improved memory handling.
CVE-2023-42914: Eloi Benoist-Vanderbeken (@elvanderb) of Synacktiv
(@Synacktiv)

WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 259830
CVE-2023-42890: Pwn2car

WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing an image may lead to a denial-of-service
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 263349
CVE-2023-42883: Zoom Offensive Security Team

WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing web content may disclose sensitive information. Apple
is aware of a report that this issue may have been exploited against
versions of iOS before iOS 16.7.1.
Description: An out-of-bounds read was addressed with improved input
validation.
WebKit Bugzilla: 265041
CVE-2023-42916: Clément Lecigne of Google’s Threat Analysis Group

WebKit
Available for: Apple Watch Series 4 and later
Impact: Processing web content may lead to arbitrary code execution.
Apple is aware of a report that this issue may have been exploited
against versions of iOS before iOS 16.7.1.
Description: A memory corruption vulnerability was addressed with
improved locking.
WebKit Bugzilla: 265067
CVE-2023-42917: Clément Lecigne of Google’s Threat Analysis Group

Additional recognition

Wi-Fi
We would like to acknowledge Noah Roskin-Frazee and Prof. J.
(ZeroClicks.ai Lab) for their assistance.

Instructions on how to update your Apple Watch software are available
at https://support.apple.com/kb/HT204641  To check the version on
your Apple Watch, open the Apple Watch app on your iPhone and select
“My Watch > General > About”.  Alternatively, on your watch, select
“My Watch > General > About”.
All information is also posted on the Apple Security Updates
web site: https://support.apple.com/en-us/HT201222.