Yulong Zhang

The issue is related to the MobileInstallation component in iOS, which has inadequate access control to certain functions. This allows an attacker to replace arbitrary extensions using a crafted enterprise app. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard, specifically exploiting the QuickType feature in the Keyboards subsystem.

The issue allows attackers to cause a denial of service, resulting in memory corruption and application crash, via a crafted configuration profile.

The issue is related to a type confusion problem in LaunchServices, allowing local users to gain privileges via a crafted localized string.