Eli Biham

The issue is related to a flaw in the know-how protection feature of the affected products, which does not properly update the encryption of existing program blocks when a project file is updated. This could allow attackers with access to the project file to recover previous, yet unprotected, versions of the project without the knowledge of the know-how protection password.

Um problema na tela de bloqueio permitia o acesso aos contatos em um dispositivo bloqueado. Esse problema foi resolvido com um gerenciamento de estado aprimorado. Uma pessoa com acesso físico a um dispositivo iOS pode conseguir acessar os contatos a partir da tela de bloqueio.

Foi corrigido um problema de lógica com o aprimoramento do gerenciamento de estado, que poderia permitir que um usuário local visualizasse informações confidenciais do usuário.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.13 iOS versions prior to 11.4 Android versions prior to the 2018-06-05 patch Description: The issue is related to incorrect validation of cryptographic signatures in Bluetooth drivers for Android, macOS, and iOS operating systems. This can allow an attacker to perform a "man-in-the-middle" attack. The vulnerability is due to insufficient validation of elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device. Recommendations: For macOS versions prior to 10.13, update to version 10.13 or later. For iOS versions prior to 11.4, update to version 11.4 or later. For Android versions prior to the 2018-06-05 patch, apply the 2018-06-05 patch or later.