Juwei Lin

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.14.4 **Description** The issue involves an out-of-bounds read that can be addressed with improved bounds checking. This allows an application to potentially read restricted memory, which could lead to information disclosure. **Recommendations** For versions prior to 10.14.4, update to macOS Mojave 10.14.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.14.4 iOS versions prior to 12.2 **Description** A memory corruption issue was addressed with improved input validation, allowing an application to potentially execute arbitrary code with kernel privileges. **Recommendations** For macOS versions prior to 10.14.4, update to macOS Mojave 10.14.4 or later. For iOS versions prior to 12.2, update to iOS 12.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.1.1 Apple macOS versions prior to 10.14.2 Apple tvOS versions prior to 12.1.1 Apple watchOS versions prior to 5.1.2 **Description** A memory corruption issue was addressed with improved state management. The issue is related to a Use-After-Free Privilege Escalation Vulnerability in Apple macOS. **Recommendations** For Apple iOS versions prior to 12.1.1, update to iOS 12.1.1 or later. For Apple macOS versions prior to 10.14.2, update to macOS 10.14.2 or later. For Apple tvOS versions prior to 12.1.1, update to tvOS 12.1.1 or later. For Apple watchOS versions prior to 5.1.2, update to watchOS 5.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.1.1 Apple macOS versions prior to 10.14.2 Apple tvOS versions prior to 12.1.1 Apple watchOS versions prior to 5.1.2 **Description** A logic issue was addressed with improved restrictions. **Recommendations** For Apple iOS versions prior to 12.1.1, update to iOS 12.1.1 or later. For Apple macOS versions prior to 10.14.2, update to macOS 10.14.2 or later. For Apple tvOS versions prior to 12.1.1, update to tvOS 12.1.1 or later. For Apple watchOS versions prior to 5.1.2, update to watchOS 5.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.1 Apple macOS versions prior to 10.14.1 Apple tvOS versions prior to 12.1 Apple watchOS versions prior to 5.1 **Description** A memory initialization issue was addressed with improved memory handling. **Recommendations** For Apple iOS versions prior to 12.1, update to iOS 12.1 or later. For Apple macOS versions prior to 10.14.1, update to macOS Mojave 10.14.1 or later. For Apple tvOS versions prior to 12.1, update to tvOS 12.1 or later. For Apple watchOS versions prior to 5.1, update to watchOS 5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12 Apple macOS versions prior to 10.14 Apple tvOS versions prior to 12 Apple watchOS versions prior to 5 **Description** A memory corruption issue was addressed with improved memory handling. **Recommendations** For Apple iOS versions prior to 12, update to iOS 12 or later. For Apple macOS versions prior to 10.14, update to macOS 10.14 or later. For Apple tvOS versions prior to 12, update to tvOS 12 or later. For Apple watchOS versions prior to 5, update to watchOS 5 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.12.1 **Description** The issue involves the `ImageIO` component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted PDF file. This is due to an out-of-bounds write and application crash. The exploitation of this issue can lead to the execution of arbitrary code or a denial of service. **Recommendations** For macOS versions prior to 10.12.1, update to version 10.12.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the `ImageIO` component when handling PDF files from untrusted sources until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.12 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service due to memory corruption via a crafted app. **Recommendations** For versions prior to 10.12, update to version 10.12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.6 **Description** The issue is related to a denial of service caused by a NULL pointer dereference in the Audio component of Apple OS X. Additionally, there are reports of vulnerabilities in the login window and other components, including buffer overflows, insufficient input validation, and errors in memory initialization, which could allow an attacker to elevate privileges, execute arbitrary code, or cause a denial of service. The vulnerabilities can be exploited locally or remotely using specially crafted applications or files. **Recommendations** For Apple OS X versions prior to 10.11.6, update to version 10.11.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Audio component and other vulnerable features to minimize the risk of exploitation. Avoid using the vulnerable components until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.6 **Description** The issue allows local users to obtain sensitive kernel memory-layout information or cause a denial of service via unspecified vectors, potentially related to a use-after-free privilege escalation vulnerability in the DspFuncLib component. **Recommendations** For versions prior to 10.11.6, update to version 10.11.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.6 **Description** The issue allows local users to gain privileges or cause a denial of service due to memory corruption via a crafted file. It is related to a use-after-free privilege escalation vulnerability in the DspFuncLib component. **Recommendations** For versions prior to 10.11.6, update to version 10.11.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the DspFuncLib component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Audio in Apple OS X versions prior to 10.11.5 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. It is caused by a buffer overflow in the Audio component of the Mac OS X operating system. Exploitation of the issue may allow a remote attacker to execute arbitrary code in a privileged context or cause a denial of service. **Recommendations** For versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Audio component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apple iOS and Mac OS X (affected versions not specified) **Description** The issue is caused by a buffer overflow in the IOAcceleratorFamily component of iOS and Mac OS X operating systems. This can be exploited by a remote attacker to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) using a specially crafted application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IOAcceleratorFamily in Apple iOS versions prior to 9.3.2 IOAcceleratorFamily in Apple OS X versions prior to 10.11.5 IOAcceleratorFamily in Apple tvOS versions prior to 9.2.1 **Description** The issue is related to errors in pointer dereferencing, which can be exploited by an attacker to cause a denial of service (NULL pointer dereference) via a crafted app. This can be achieved by a remote attacker using a specially created application. **Recommendations** For iOS versions prior to 9.3.2, update to version 9.3.2 or later to resolve the issue. For OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. For tvOS versions prior to 9.2.1, update to version 9.2.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.5 **Description** The issue is caused by a buffer overflow in the Intel Graphics Driver component, allowing attackers to execute arbitrary code in a privileged context via a crafted app. This can be exploited by a remote attacker using a specially created application. **Recommendations** For Apple OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Intel Graphics Driver component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mac OS X versions prior to 10.11.5 Apple OS X versions prior to 10.11.5 **Description** The issue is related to a component in the Audio system of the operating system, which is affected by pointer dereference errors. This can be exploited by a remote attacker using a specially crafted application to cause a denial of service, specifically a NULL pointer dereference. **Recommendations** For Mac OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. For Apple OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9.3 Apple OS X versions prior to 10.11.4 Apple tvOS versions prior to 9.2 Apple watchOS versions prior to 2.2 **Description** The issue is related to a use-after-free vulnerability in the kernel, allowing attackers to execute arbitrary code in a privileged context via a crafted app. This can be exploited by a remote attacker using a specially created application, potentially leading to the execution of arbitrary code. **Recommendations** For Apple iOS versions prior to 9.3, update to version 9.3 or later. For Apple OS X versions prior to 10.11.4, update to version 10.11.4 or later. For Apple tvOS versions prior to 9.2, update to version 9.2 or later. For Apple watchOS versions prior to 2.2, update to version 2.2 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 9.3 OS X versions prior to 10.11.4 **Description** The issue allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app. It is related to the lack of protection for service data in the kernel of the operating systems. Exploitation of the issue may allow a remote attacker to access protected information or cause a denial of service. **Recommendations** For iOS versions prior to 9.3, update to version 9.3 or later. For OS X versions prior to 10.11.4, update to version 10.11.4 or later.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.4 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. It is caused by a buffer overflow in the IOGraphics component of the Mac OS X operating system. Exploitation of the issue may permit a remote attacker to execute arbitrary code in a privileged context or cause a denial of service. **Recommendations** For Apple OS X versions prior to 10.11.4, update to version 10.11.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted apps to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.4 **Description** The issue is caused by a buffer overflow in the IOUSBFamily component, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. This can be exploited by a remote attacker using a specially crafted application. **Recommendations** For Apple OS X versions prior to 10.11.4, update to version 10.11.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the IOUSBFamily component to minimize the risk of exploitation.