James Duffy

This issue concerns a shortcut that may output sensitive user data without consent. The problem was addressed by adding an additional prompt for user consent.

The issue allows an app to potentially access App Store credentials. It was addressed by enabling hardened runtime.

The issue is related to insufficient access control in the Security component of the macOS, iOS, and iPadOS operating systems. This could allow an attacker to gain unauthorized access to user fingerprints. An app may be able to fingerprint the user.

The issue is related to a lack of protection for service data in the OpenSSH package of the macOS operating system. It may allow an attacker to gain unauthorized access to SSH passphrases. An app may be able to access SSH passphrases due to insufficient restrictions on the observability of app states.

The issue allows a sandboxed app to observe system-wide network connections due to inadequate access controls. This could potentially allow an attacker to disclose protected information. The issue was addressed with additional permissions checks.

The issue allows an app to potentially break out of its sandbox. This was addressed with improved checks.

The issue allows an app to potentially access user-sensitive data due to inadequate entitlements. This was addressed with improved entitlements.

The issue is related to incorrect code generation management in the AppleMobileFileIntegrity component of the macOS operating system. Exploitation of this issue may allow an attacker to execute arbitrary code. An app may be able to inject code into sensitive binaries bundled with Xcode. This issue was addressed by forcing hardened runtime on the affected binaries at the system level.