Bistrit Dahal

The issue is related to insufficient protection of service data in the Face Gallery component of watchOS, iOS, and iPadOS operating systems. A system binary could be used to fingerprint a user's Apple Account, potentially allowing a remote attacker to disclose protected information. The problem was solved by removing the relevant flags.

A logic issue was addressed with improved checks, allowing an attacker with physical access to potentially access contacts from the lock screen.

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 visionOS versions prior to 2.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: A permissions issue was addressed with additional restrictions. This issue may allow an app to access sensitive user data. Recommendations: For watchOS versions prior to 11.2, update to watchOS 11.2 to resolve the issue. For visionOS versions prior to 2.2, update to visionOS 2.2 to resolve the issue. For tvOS versions prior to 18.2, update to tvOS 18.2 to resolve the issue. For macOS Sequoia versions prior to 15.2, update to macOS Sequoia 15.2 to resolve the issue. For iOS versions prior to 18.2, update to iOS 18.2 to resolve the issue. For iPadOS versions prior to 18.2, update to iPadOS 18.2 to resolve the issue.

A permissions issue was addressed by removing vulnerable code and adding additional checks. Password autofill may fill in passwords after failing authentication.

A logic issue was addressed with improved validation, allowing a user's saved passwords to be read aloud by VoiceOver. This issue is related to the VoiceOver feature in iOS and iPadOS, which could expose passwords. The flaw was reported by a researcher and has been resolved with improved validation. iPhone XS and later, plus iPads from the Pro, Air, and Mini series, are impacted.

The issue allows an attacker with physical access to potentially access contacts from the lock screen due to inadequate checks.

An issue allowed an attacker with physical access to a device to potentially read contact numbers from the lock screen. This was addressed by restricting options offered on a locked device.

The issue allows an attacker to view sensitive user information. It was addressed through improved state management.

This issue allows an attacker with physical access to potentially use Siri to access sensitive user data by exploiting options available on a locked device. The issue was addressed by restricting these options.

This issue was addressed through improved state management. An attacker with physical access may be able to use Siri to access sensitive user data.

This issue is related to insufficient access control in the Siri personal assistant for macOS, watchOS, iOS, and iPadOS operating systems. An attacker with physical access may be able to use Siri to access sensitive user data by exploiting the lack of proper restrictions on a locked device.

The issue is related to an authentication problem in the Photos component of iOS, macOS, and iPadOS, which allows an attacker to view photos in the "Hidden Photos" album without authentication. This is due to a lack of authentication for a critical function. The estimated number of potentially affected devices is not specified.

The issue is related to insufficient access control in the Siri personal assistant, which can allow an attacker with physical access to use Siri and gain unauthorized access to sensitive user data. This can be done by exploiting the lack of proper restrictions on options offered on a locked device.

The issue is related to insufficient access control in the Siri personal assistant, which may allow an attacker with physical access to use Siri and access sensitive user data. This is possible due to the lack of proper restrictions on options offered on a locked device.