Xisigr

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.

The issue is related to insufficient policy enforcement in Omnibox, allowing a remote attacker to perform domain spoofing via IDN homographs using a crafted domain name. This can potentially compromise data integrity due to inadequate input validation.

An inconsistent user interface issue was addressed with improved state management.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.1.1 Safari versions prior to 12.0.2 iTunes versions prior to 12.9.2 for Windows iCloud for Windows versions prior to 7.9 Description: A logic issue was addressed with improved validation. Recommendations: For iOS versions prior to 12.1.1, update to iOS 12.1.1 or later. For Safari versions prior to 12.0.2, update to Safari 12.0.2 or later. For iTunes versions prior to 12.9.2 for Windows, update to iTunes 12.9.2 or later for Windows. For iCloud for Windows versions prior to 7.9, update to iCloud for Windows 7.9 or later.

An inconsistent user interface issue was addressed with improved state management.

The issue is related to incorrect handling of history on iOS in Navigation, which can be exploited by a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This can allow an attacker to substitute the displayed address URI.

The issue concerns incorrect handling of asynchronous methods in Fullscreen mode, allowing a remote attacker to enter full screen without displaying a warning via a crafted HTML page. This can lead to spoofing the fullscreen UI, potentially deceiving users.

An issue in Safari allows remote attackers to spoof the address bar via a crafted web site, involving the Safari component.

The issue involves the Safari component and allows remote attackers to spoof the user interface via a crafted web site.

A spoofing issue existed in the handling of URLs, which was addressed with improved input validation. The issue is also related to the incorrect handling of Unicode symbols in Safari, allowing a remote attacker to perform a homographic attack and substitute the content of a resource.

The issue is related to the display of URLs in the address bar when using right-to-left text with left-to-right alignment. In certain circumstances, it is possible to scroll this text to spoof the displayed URL, potentially misleading users into believing they are on a different site than the one loaded. This could result in the wrong URL being displayed as a location.

The issue is related to insufficient policy enforcement in the Omnibox feature, allowing a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. This enables attackers to deceive users into accessing malicious websites that appear as legitimate due to the visual similarity of characters in the domain name.

The issue involves the Safari component and allows remote attackers to spoof the address bar via a crafted web site.

The issue involves the `Dictionary Widget` component, allowing attackers to read local files if pasted text is used in a search.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

The issue involves the Safari component and allows remote attackers to spoof the address bar.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 62.0.3202.62 Description: The issue is related to an insufficient watchdog timer in navigation, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could be achieved by manipulating an HTML page. Recommendations: For versions prior to 62.0.3202.62, update to version 62.0.3202.62 or later to resolve the issue.

An issue in certain Apple products allows remote attackers to spoof the address bar via a crafted web site, involving the Safari component.

The issue involves the WebKit component and allows remote attackers to spoof the address bar via a crafted web site that uses FRAME elements.

The issue involves the Safari component and allows remote attackers to spoof FaceTime prompts in the user interface via a crafted web site. It is related to errors in security settings, which can be exploited by a remote attacker to substitute the user interface of the FaceTime application using a specially formed website.