Koh M. Nakagawa

Existe um problema de lógica que permite que um aplicativo ignore as verificações do Gatekeeper, que são recursos de segurança usados para garantir que apenas softwares confiáveis sejam executados no sistema.

Um problema de permissões foi corrigido com restrições adicionais. Um aplicativo pode contornar determinadas preferências de Privacidade.

A SXF Common Library não manipula corretamente os dados de entrada. Se um produto que utiliza a biblioteca ler um arquivo manipulado, isso pode causar a falha do produto.

A vulnerabilidade permite que um aplicativo modifique partes protegidas do sistema de arquivos. O problema foi corrigido com verificações aprimoradas.

Um problema de permissões foi resolvido com restrições adicionais. Esse problema pode permitir que um aplicativo cause uma negação de serviço.

The issue is related to an out-of-bounds read in the CoreServices component of the macOS operating system. This can be exploited by an attacker using a specially crafted file, potentially allowing arbitrary code execution. A user may also be able to cause unexpected app termination.

A permissions issue was addressed with additional restrictions, which may have allowed an app to modify protected parts of the file system.

A race condition was addressed with improved locking, which may have allowed an app to modify protected parts of the file system.

The issue is related to a component of the macOS operating system and involves reading beyond memory boundaries. Processing a file may lead to a denial-of-service or potentially disclose memory contents. Exploitation of this issue may allow an attacker to disclose protected information or cause a denial-of-service.

The issue allows a local attacker to bypass access restrictions and use the camera, microphone, etc. of the device where the product is installed without the user's consent. This is due to an improper access control vulnerability.

A logic issue was addressed with improved state management, which may allow a user to elevate privileges.

A code injection issue exists, allowing a non-administrative user of the Mac where the product is installed to store and obtain audio and image data from the product without the user's consent.

The issue allows for arbitrary code execution with root privilege when a user is tricked into executing a malicious script before running the affected installer version. This is due to an improper link resolution before file access.

An authorization issue was addressed with improved state management. This issue may allow an app to retain access to system configuration files even after its permission is revoked, potentially allowing an attacker to access confidential information and preserve user data.

The issue is related to incorrect code generation management, allowing an attacker to inject arbitrary code while processing the product execution. This can enable the attacker to read and/or write to arbitrary files without access privileges, given that a full disk access privilege is required to execute LINE WORKS Drive Explorer.

A logic issue was addressed with improved checks, which may have allowed an app to modify protected parts of the file system.

The issue is related to synchronization errors, specifically a "race condition" scenario, which can be exploited to elevate privileges.

The issue is related to insufficient access restrictions in the file hosting service, which can be exploited by an attacker to elevate their privileges using a specially crafted application.

O problema está relacionado ao tratamento incorreto do atributo com.apple.quarantine pela interface do usuário do Thunderbird. Isso pode ser explorado por um invasor remoto para executar código arbitrário ao carregar um anexo de e-mail malicioso. No macOS, ao salvar ou abrir um anexo de e-mail, o Thunderbird não conseguia definir o atributo com.apple.quarantine no arquivo recebido. Se o arquivo fosse um aplicativo e o usuário tentasse abri-lo, o aplicativo seria iniciado imediatamente sem solicitar confirmação ao usuário.

A questão diz respeito a um problema na validação da assinatura de código que foi resolvido com verificações aprimoradas. Isso poderia permitir que um aplicativo acessasse dados confidenciais do usuário.