{"id":75775,"date":"2018-02-22T08:14:41","date_gmt":"2018-02-22T16:14:41","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=75775"},"modified":"2018-02-22T08:14:41","modified_gmt":"2018-02-22T16:14:41","slug":"apple-releases-security-updates-to-patch-the-telugu-character-bug","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/apple-releases-security-updates-to-patch-the-telugu-character-bug\/","title":{"rendered":"Apple Releases Security Updates to Patch the Telugu Character Bug"},"content":{"rendered":"

The Telugu character that could crash your Mac and iPhone.<\/p><\/div>\n

Apple has released security updates for macOS, iOS, tvOS and watchOS,\u00a0patching a vulnerability\u00a0that allowed a specific character in the Telugu language to crash apps.<\/p>\n

Also known as CVE-2018-4124<\/a>, the bug would cause apps to lock up or crash after the Telugu character was encountered\u00a0on your Mac or iPhone. This could be Messages, Mail, WhatsApp, Skype, or any other app that can receive text, and this includes iOS itself as it parses the character through notifications.<\/p>\n

Computers have no problems handling most languages, but some can present a challenge and Telugu is one of them. Paul Ducklin at NakedSecurity<\/a> described the issue perfectly, saying:<\/p>\n

“[M]any languages use a written form in which each character is made up of a combination of components that denote how to pronounce it, typically starting with a basic sound and indicating the various modifications that should be applied to it. […] That’s great when you are reading aloud, but not so great when you’re a computer trying to combine a string of Unicode code points into a visual representation of a character for display.”<\/p><\/blockquote>\n

With characters not only\u00a0showing a letter but also how to pronounce them, some characters can cause issues for computers as the underlying code is more complex. This happened in 2013<\/a>\u00a0and 2015<\/a>, and again with the recent CVE-2018-4124, and this probably won\u2019t be the last time we see this issue.<\/p>\n

Friends pranking each other or folks with malicious intent purposely sticking these characters into emails, text messages or tweets<\/a> can cause a lot of problems for people. Thankfully Apple jumped on this issue and quickly pushed out a fix.<\/p>\n

Here\u00a0is\u00a0a breakdown of the updates and where you can install them.<\/p>\n

macOS High Sierra 10.13.3 Supplemental Update<\/h3>\n

The macOS High Sierra 10.13.3 Supplemental Update fixes the issue in which using the Telugu\u00a0character could cause apps to crash.\u00a0Available for macOS High Sierra, this update\u00a0can be downloaded on your Mac from the App Store<\/strong> > Updates<\/strong> tab, or you can download the update directly from Apple’s official website by going\u00a0here<\/a>. iMac Pro users can download the update from Apple\u00a0by going here<\/a>.<\/p>\n

While 10.12.6 Sierra and 10.11.6 El Capitan are still supported by Apple in terms of security updates, for whatever reason they did not receive any this week. Fixes for these older operating systems will likely be rolled into the next security update,\u00a0if in fact these older systems require a fix for this bug.<\/p>\n

iOS 11.2.6<\/h3>\n

iOS 11.2.6 addresses the same Telugu character bug\u00a0mentioned above. It is available for iPhone 5s and later, iPad Air and later, and iPod touch 6th generation, and can be downloaded over the air by going to Settings<\/strong> > General<\/strong> > Software Update<\/strong>. You can also connect your iOS device to your Mac and let iTunes do the update for you.<\/p>\n

watchOS 4.2.3<\/h3>\n

Apple’s watchOS 4.2.3 update also addresses the Telugu combination character that provokes the Apple-crashing bug CVE-2018-4124.\u00a0watchOS 4.2.3 can be installed by connecting your\u00a0watch to its charger, and then on your iPhone go to\u00a0Apple Watch app<\/strong> > My Watch tab<\/strong> > General<\/strong> > Software Update<\/strong>.<\/p>\n

tvOS 11.2.6<\/h3>\n

This leaves us with tvOS 11.2.6, which, you guessed it, also received fixes for the Telugu character bug! This update is\u00a0only available for Apple TV 4K and Apple TV (4th generation) users.\u00a0The tvOS update can be downloaded directly from your\u00a0Apple TV by going to Settings<\/strong> > System<\/strong> > Update Software<\/strong>.<\/p>\n

Make sure you sync and backup your Macs and devices before applying these updates, and be sure to install them as soon as possible to mitigate the issues discussed here. Undoubtedly more bugs and vulnerabilities will be discovered in the future, but at least you’ll be safe from this one going forward. \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

Apple has released security updates for macOS, iOS, tvOS and watchOS,\u00a0patching a vulnerability\u00a0that allowed a specific character in the Telugu language to crash apps. Also known as CVE-2018-4124, the bug would cause apps to lock up or crash after the Telugu character was encountered\u00a0on your Mac or iPhone. This could be Messages, Mail, WhatsApp, Skype, […]<\/p>\n","protected":false},"author":79,"featured_media":55957,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[3931,3937,3880,3934,3943,3940],"class_list":["post-75775","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security-news","tag-cve-2018-4124","tag-ios-11-2-6","tag-macos-high-sierra-10-13-3","tag-telugu","tag-tvos-11-2-6","tag-watchos-4-2-3"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t