Wish Wu

**Nome do software vulnerável e versões afetadas** Versões do iOS anteriores à 15 Versões do iPadOS anteriores à 15 **Descrição** A falha permite que um modelo 3D criado para se parecer com o usuário cadastrado seja autenticado via Face ID. Isso se deve a modelos anti-spoofing inadequados. O número estimado de dispositivos potencialmente afetados em todo o mundo não foi especificado. **Recomendações** Para versões do iOS anteriores à 15, atualize para o iOS 15 ou posterior para resolver o problema. Para versões do iPadOS anteriores à 15, atualize para o iPadOS 15 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas: Versões do iOS anteriores à 14.5 Versões do iPadOS anteriores à 14.5 Versões do macOS Big Sur anteriores à 11.3 Descrição: O problema envolve uma leitura fora dos limites que foi corrigida por meio de uma validação de entrada aprimorada. Um aplicativo malicioso pode ser capaz de executar código arbitrário com privilégios de kernel. Recomendações: Para versões do iOS anteriores à 14.5, atualize para o iOS 14.5 ou posterior. Para versões do iPadOS anteriores à 14.5, atualize para o iPadOS 14.5 ou posterior. Para versões do macOS Big Sur anteriores à 11.3, atualize para o macOS Big Sur 11.3 ou posterior.

**Nome do software vulnerável e versões afetadas** Versões do HUAWEI Mate 30 Pro anteriores à 10.1.0.150(C00E136R5P3) **Descrição** O dispositivo apresenta um problema de autenticação inadequada, no qual não valida suficientemente certas credenciais do rosto do usuário. Um invasor poderia falsificar as credenciais do usuário, e uma exploração bem-sucedida permitiria que o invasor passasse pela autenticação com as credenciais falsificadas. **Recomendações** Para versões anteriores à 10.1.0.150(C00E136R5P3), atualize para a versão 10.1.0.150(C00E136R5P3) ou posterior para resolver o problema. Como solução temporária, considere desativar a autenticação facial até que um patch esteja disponível. Restrinja o acesso a recursos confidenciais que dependem da autenticação facial para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 13 **Description** The issue allowed a 3D model constructed to look like the enrolled user to authenticate via Face ID. This was addressed by improving Face ID machine learning models. **Recommendations** For iOS versions prior to 13, update to iOS 13 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libgdx version 7.1.1 **Description** A remote code execution issue in libgdx could allow an attacker to execute arbitrary code in the context of an unprivileged process by using a specially crafted file. This issue is considered High due to the possibility of remote code execution in an application that uses this library. **Recommendations** For libgdx version 7.1.1, update to a newer version that contains a fix for this issue to prevent remote code execution.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-11-01 Android versions 7.0 before 2016-11-01 **Description** An elevation of privilege issue in Mediaserver could allow a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. **Recommendations** For Android versions 4.x through 4.4.3, update to version 4.4.4 or later. For Android versions 5.0.x through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.x through 5.1.0, update to version 5.1.1 or later. For Android versions 6.x before 2016-11-01, apply the November 2016 security patch or later. For Android versions 7.0 before 2016-11-01, apply the November 2016 security patch or later.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-10-01 Android versions 7.0 before 2016-10-01 **Description** The issue allows attackers to obtain sensitive information via a crafted application due to the lack of validation of EFFECT CMD SET PARAM and EFFECT CMD SET PARAM DEFERRED commands in the mediaserver. **Recommendations** For Android versions 4.x through 4.4.3, update to version 4.4.4 or later. For Android versions 5.0.x through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.x through 5.1.0, update to version 5.1.1 or later. For Android versions 6.x before 2016-10-01, apply the October 2016 security patch or later. For Android versions 7.0 before 2016-10-01, apply the October 2016 security patch or later.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-10-01 Android versions 7.0 before 2016-10-01 **Description** The issue allows attackers to gain privileges via a crafted application. **Recommendations** For Android versions 4.x through 4.4.3, update to version 4.4.4 or later. For Android versions 5.0.x through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.x through 5.1.0, update to version 5.1.1 or later. For Android versions 6.x before 2016-10-01, update to a version released on or after 2016-10-01. For Android versions 7.0 before 2016-10-01, update to a version released on or after 2016-10-01.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-04-01 **Description** The issue is related to insufficient access control in the Qualcomm ARM component of the Android operating system. It can be exploited by a local attacker using a specially crafted application to gain elevated privileges. **Recommendations** For Android versions 4.x through 4.4.3, update to version 4.4.4 or later. For Android versions 5.0.x through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.x through 5.1.0, update to version 5.1.1 or later. For Android versions 6.x before 2016-04-01, update to a version released on or after 2016-04-01.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.3 Android versions 5.x through 5.1.0 Android versions 6.x before 2016-03-01 **Description** The issue is related to a component of the Qualcomm performance in Android, which has inadequate access control. This allows attackers to gain privileges via a crafted application. **Recommendations** For Android versions 4.x through 4.4.3, update to version 4.4.4 or later. For Android versions 5.x through 5.1.0, update to version 5.1.1 LMY49H or later. For Android versions 6.x before 2016-03-01, update to a version released on or after 2016-03-01.