Hello and welcome to the Tuesday, March 26, 2004 edition of the Santonet Storm Center's

Stormcast. My name is Johannes Ulrich, and then I'm recording from Jacksonville, Florida.

Always great to see the different tools that our handlers create to make life easier.

And of course, by sharing them, they're making life easier for all of us.

Jim just provided a couple updates for two tools that he's maintaining.

One is his low Indian hex-to-IP tool.

Python script that converts hexadecimal to IP addresses in various formats, does support IPB6.

We'll need tool, and of course often you find like in memory dumps or such these IP addresses in the hexadecimal format that they then want to convert to something more readable.

There's also 6.Pi that Jim updated. It just creates a number of hashes for particular files and now also

supports taking input directly from standard in. And Apple today released their expected updates for Mac OS. And part they were

expected because last week we did receive updates for iOS, iPadOS, and Vision OS. But we didn't

receive any security details because, well, they were held back to today when Apple released the

related Mac OS updates. And indeed, there are, first of all, there are only two vulnerabilities

that are being addressed here. At least Apple describes them as two vulnerabilities, but

they actually have the same CVE number. What's probably going on here is, well,

both of these are out-of-bound right vulnerabilities that occur when an image is being processed.

One of the vulnerabilities is in core media. The other one is in WebRTC. So it's probably the same mistake that was just made in two different places, which is why we get one CVE, but two vulnerabilities in Apple's updates.

These two vulnerabilities do apply across all the patched operating systems.

That includes a macOS Sonoma 14.4, which is now 14.41, MacOS Ventura 13, iOS, iOS, iPadOS 17, and

iOS iPadOS 16, and then of course Apple Vision OS 1.1.1.

These vulnerabilities were found by Google's Project Zero.

Nick Galloway is credited with these vulnerabilities.

...