Ma.La

**Name of the Vulnerable Software and Affected Versions** Softbank +Message App for Android versions prior to 10.1.7 Softbank +Message App for iOS versions prior to 1.1.23 NTT DOCOMO +Message App for Android versions prior to 42.40.2800 NTT DOCOMO +Message App for iOS versions prior to 1.1.23 KDDI +Message App for Android versions prior to 1.0.6 KDDI +Message App for iOS versions prior to 1.1.23 **Description** The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the apps do not verify X.509 certificates from SSL servers. **Recommendations** For Softbank +Message App for Android versions prior to 10.1.7, update to version 10.1.7 or later. For Softbank +Message App for iOS versions prior to 1.1.23, update to version 1.1.23 or later. For NTT DOCOMO +Message App for Android versions prior to 42.40.2800, update to version 42.40.2800 or later. For NTT DOCOMO +Message App for iOS versions prior to 1.1.23, update to version 1.1.23 or later. For KDDI +Message App for Android versions prior to 1.0.6, update to version 1.0.6 or later. For KDDI +Message App for iOS versions prior to 1.1.23, update to version 1.1.23 or later.

**Name of the Vulnerable Software and Affected Versions** Shoplat App for iOS versions 1.10.00 through 1.18.00 **Description** The issue is related to the improper verification of SSL certificates. This could potentially allow for man-in-the-middle attacks. **Recommendations** For versions 1.10.00 through 1.18.00, update to a version that properly verifies SSL certificates to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Java SE versions 6u131, 7u121, and 8u112 Java SE Embedded version 8u111 JRockit version R28.3.12 **Description** The issue is related to the Networking component of Oracle Java SE and can be exploited by an unauthenticated attacker with network access via multiple protocols. This can result in unauthorized update, insert, or delete access to some of the accessible data. The vulnerability can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the specified component. It is also related to errors in security settings and can allow a remote attacker to obtain sensitive information. **Recommendations** For Java SE versions 6u131, 7u121, and 8u112, update to a version that contains a fix for this issue. For Java SE Embedded version 8u111, update to a version that contains a fix for this issue. For JRockit version R28.3.12, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Networking component until a patch is available. Avoid using sandboxed Java Web Start applications and sandboxed Java applets until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9.3.3 Safari versions prior to 9.1.2 tvOS versions prior to 9.2.2 **Description** The issue concerns the mishandling of the `location` variable, allowing remote attackers to access the local filesystem. **Recommendations** For Apple iOS versions prior to 9.3.3, update to version 9.3.3 or later. For Safari versions prior to 9.1.2, update to version 9.1.2 or later. For tvOS versions prior to 9.2.2, update to version 9.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9.3 Safari versions prior to 9.1 **Description** The issue is related to the Page Loading implementation in WebKit, which mishandles character encoding during access to cached data. This allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. The vulnerability is associated with a lack of protection for service data, enabling a remote attacker to bypass existing access restriction policies or obtain confidential information using a specially formed website. **Recommendations** For Apple iOS versions prior to 9.3, update to version 9.3 or later. For Safari versions prior to 9.1, update to version 9.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9.3 Safari versions prior to 9.1 **Description** The issue is related to the Page Loading implementation in WebKit, which mishandles HTTP responses with a 3xx status code. This allows remote attackers to spoof the displayed URL, bypass the Same Origin Policy, and obtain sensitive cached information via a crafted web site. The vulnerability is associated with a lack of protection for service data. **Recommendations** For Apple iOS versions prior to 9.3, update to version 9.3 or later to resolve the issue. For Safari versions prior to 9.1, update to version 9.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adways Party Track SDK version prior to 1.6.6 for iOS **Description** The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the SDK does not verify X.509 certificates from SSL servers. **Recommendations** For versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue.