Bistrit Dahal

تتعلق المشكلة بعدم كفاية حماية بيانات الخدمة في مكون «معرض الوجوه» (Face Gallery) في أنظمة التشغيل watchOS وiOS وiPadOS. يمكن استخدام ملف ثنائي للنظام لتحديد حساب Apple الخاص بمستخدم ما بشكل فريد، مما قد يتيح لمهاجم عن بُعد الكشف عن معلومات محمية. تم حل المشكلة عن طريق إزالة العلامات ذات الصلة.

تم إصلاح مشكلة منطقية من خلال تحسين إجراءات التحقق؛ حيث كانت هذه الثغرة تسمح لمهاجم يتمتع بوصول مادي بالوصول إلى جهات الاتصال من شاشة القفل.

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 visionOS versions prior to 2.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: A permissions issue was addressed with additional restrictions. This issue may allow an app to access sensitive user data. Recommendations: For watchOS versions prior to 11.2, update to watchOS 11.2 to resolve the issue. For visionOS versions prior to 2.2, update to visionOS 2.2 to resolve the issue. For tvOS versions prior to 18.2, update to tvOS 18.2 to resolve the issue. For macOS Sequoia versions prior to 15.2, update to macOS Sequoia 15.2 to resolve the issue. For iOS versions prior to 18.2, update to iOS 18.2 to resolve the issue. For iPadOS versions prior to 18.2, update to iPadOS 18.2 to resolve the issue.

A permissions issue was addressed by removing vulnerable code and adding additional checks. Password autofill may fill in passwords after failing authentication.

A logic issue was addressed with improved validation, allowing a user's saved passwords to be read aloud by VoiceOver. This issue is related to the VoiceOver feature in iOS and iPadOS, which could expose passwords. The flaw was reported by a researcher and has been resolved with improved validation. iPhone XS and later, plus iPads from the Pro, Air, and Mini series, are impacted.

The issue allows an attacker with physical access to potentially access contacts from the lock screen due to inadequate checks.

كانت هناك ثغرة تسمح للمهاجم الذي يتمتع بوصول مادي إلى الجهاز بقراءة أرقام جهات الاتصال من شاشة القفل. وقد تم معالجة هذه المشكلة عن طريق تقييد الخيارات المتاحة على الجهاز المقفل.

The issue allows an attacker to view sensitive user information. It was addressed through improved state management.

This issue allows an attacker with physical access to potentially use Siri to access sensitive user data by exploiting options available on a locked device. The issue was addressed by restricting these options.

This issue was addressed through improved state management. An attacker with physical access may be able to use Siri to access sensitive user data.

This issue is related to insufficient access control in the Siri personal assistant for macOS, watchOS, iOS, and iPadOS operating systems. An attacker with physical access may be able to use Siri to access sensitive user data by exploiting the lack of proper restrictions on a locked device.

The issue is related to an authentication problem in the Photos component of iOS, macOS, and iPadOS, which allows an attacker to view photos in the "Hidden Photos" album without authentication. This is due to a lack of authentication for a critical function. The estimated number of potentially affected devices is not specified.

The issue is related to insufficient access control in the Siri personal assistant, which can allow an attacker with physical access to use Siri and gain unauthorized access to sensitive user data. This can be done by exploiting the lack of proper restrictions on options offered on a locked device.

The issue is related to insufficient access control in the Siri personal assistant, which may allow an attacker with physical access to use Siri and access sensitive user data. This is possible due to the lack of proper restrictions on options offered on a locked device.