Koh M. Nakagawa

توجد مشكلة منطقية تسمح لتطبيق بتجاوز فحوصات Gatekeeper، وهي ميزات أمنية تُستخدم لضمان تشغيل البرامج الموثوقة فقط على النظام.

تم إصلاح مشكلة تتعلق بالأذونات من خلال فرض قيود إضافية. يمكن لأحد التطبيقات التحايل على بعض إعدادات الخصوصية.

لا تعالج SXF Common Library بيانات الإدخال بشكل صحيح. إذا قام أحد المنتجات التي تستخدم هذه المكتبة بقراءة ملف تم التلاعب به، فقد يتسبب ذلك في تعطل المنتج.

The issue allows an app to modify protected parts of the file system. It was addressed with improved checks.

A permissions issue was addressed with additional restrictions. This issue may allow an app to cause a denial-of-service.

The issue is related to an out-of-bounds read in the CoreServices component of the macOS operating system. This can be exploited by an attacker using a specially crafted file, potentially allowing arbitrary code execution. A user may also be able to cause unexpected app termination.

A permissions issue was addressed with additional restrictions, which may have allowed an app to modify protected parts of the file system.

A race condition was addressed with improved locking, which may have allowed an app to modify protected parts of the file system.

The issue is related to a component of the macOS operating system and involves reading beyond memory boundaries. Processing a file may lead to a denial-of-service or potentially disclose memory contents. Exploitation of this issue may allow an attacker to disclose protected information or cause a denial-of-service.

The issue allows a local attacker to bypass access restrictions and use the camera, microphone, etc. of the device where the product is installed without the user's consent. This is due to an improper access control vulnerability.

A logic issue was addressed with improved state management, which may allow a user to elevate privileges.

A code injection issue exists, allowing a non-administrative user of the Mac where the product is installed to store and obtain audio and image data from the product without the user's consent.

The issue allows for arbitrary code execution with root privilege when a user is tricked into executing a malicious script before running the affected installer version. This is due to an improper link resolution before file access.

An authorization issue was addressed with improved state management. This issue may allow an app to retain access to system configuration files even after its permission is revoked, potentially allowing an attacker to access confidential information and preserve user data.

The issue is related to incorrect code generation management, allowing an attacker to inject arbitrary code while processing the product execution. This can enable the attacker to read and/or write to arbitrary files without access privileges, given that a full disk access privilege is required to execute LINE WORKS Drive Explorer.

A logic issue was addressed with improved checks, which may have allowed an app to modify protected parts of the file system.

The issue is related to synchronization errors, specifically a "race condition" scenario, which can be exploited to elevate privileges.

The issue is related to insufficient access restrictions in the file hosting service, which can be exploited by an attacker to elevate their privileges using a specially crafted application.

The issue is related to incorrect handling of the com.apple.quarantine attribute by the Thunderbird user interface. This can be exploited by a remote attacker to execute arbitrary code by loading a malicious email attachment. On macOS, when saving or opening an email attachment, Thunderbird failed to set the com.apple.quarantine attribute on the received file. If the file was an application and the user tried to open it, the application would start immediately without prompting the user for confirmation.

The issue concerns a problem in code signature validation that has been addressed with improved checks. This could allow an app to access user-sensitive data.