Abhay Kailasia

توجد مشكلة في الخصوصية حيث قد يتمكن المستخدم من عرض محتوى مقيد مباشرة من شاشة القفل بسبب عدم كفاية عمليات التحقق.

تسمح هذه المشكلة للمهاجمين باستخدام Siri لتمكين ميزة «الرد التلقائي على المكالمات». ويمكن استغلال هذه الثغرة على جهاز مغلق. لم يتم تحديد العدد التقديري للأجهزة التي قد تكون متأثرة.

تم إصلاح مشكلة في المصادقة من خلال تحسين إدارة الحالة. قد يتمكن المهاجم الذي لديه وصول مادي إلى جهاز غير مقفل من الوصول إلى تطبيق «الصور» أثناء قفل الجهاز. ترتبط المشكلة بمكون «إمكانية الوصول» وآلية التفويض الخاصة به، مما قد يسمح للمهاجم بالحصول على وصول غير مصرح به إلى المعلومات المحمية.

تم إصلاح هذه المشكلة من خلال تحسين إدارة الحالة. قد يتمكن المهاجم الذي لديه وصول مادي إلى جهاز iOS من عرض محتوى الإشعارات على شاشة القفل.

Name of the Vulnerable Software and Affected Versions: iPadOS versions prior to 17.7.3 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: The issue allows an attacker with physical access to an iOS device to view notification content from the lock screen. This is possible due to insufficient logic in handling lock screen notifications. The estimated number of potentially affected devices worldwide is not specified. Recommendations: For iPadOS versions prior to 17.7.3, update to iPadOS 17.7.3 or later. For iOS versions prior to 18.2, update to iOS 18.2 or later. For iPadOS versions prior to 18.2, update to iPadOS 18.2 or later.

تتعلق المشكلة بمكون «ملء كلمات المرور تلقائيًا» في أنظمة التشغيل المذكورة، وتنتج عن خلل في التفويض. وقد يتيح ذلك للمهاجم قراءة وتسجيل ملفات عشوائية. وقد تؤدي المشكلة إلى قيام ميزة «ملء كلمات المرور تلقائيًا» بملء كلمات المرور حتى بعد فشل عملية المصادقة.

The issue allows an attacker with physical access to potentially access contact photos from the lock screen. This is possible due to insufficient restrictions on options offered on a locked device.

The issue allows an attacker to view restricted content from the lock screen due to inadequate state management. This has been addressed through improved state management.

This issue allows an attacker to see recent photos without authentication in Assistive Access. The issue was addressed by restricting options offered on a locked device.

This issue was addressed through improved state management. An attacker with physical access may be able to use Siri to access sensitive user data.

The issue was addressed with improved checks. An attacker may be able to view restricted content from the lock screen.

A privacy issue was addressed by moving sensitive data to a more secure location. A malicious application may be able to determine a user's current location.

A logic issue was addressed with improved checks. This issue may cause a user's private browsing activity to be unexpectedly saved in the App Privacy Report.

This issue allows a person with physical access to a device to potentially access private calendar information using VoiceOver. The issue was addressed with improved redaction of sensitive information.

The issue allows an app to potentially access sensitive user data due to improper handling of caches. This has been addressed with improved cache handling.

A person with physical access to an iOS device may be able to view the last image used in Magnifier from the lock screen. This issue was addressed by restricting options offered on a locked device.

The issue was addressed with improved checks. Processing a large input may lead to a denial of service.

A lock screen issue allowed unauthorized access to contacts on a locked device. This was possible due to inadequate state management. A local attacker could potentially view contacts from the lock screen.