Bkth

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 89.0.4389.128 **Description** The issue is related to insufficient validation of untrusted input in the V8 engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential information or cause a denial of service. The vulnerability has been reportedly exploited by actors such as Water Labbu in Electron-based applications, particularly targeting the financial industry. **Recommendations** For Google Chrome versions prior to 89.0.4389.128, update to version 89.0.4389.128 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable API endpoints or disabling the use of untrusted input in the V8 engine until a patch is applied. Avoid using crafted HTML pages that could exploit the heap corruption vulnerability.

**Name of the Vulnerable Software and Affected Versions** Chakra Scripting Engine (affected versions not specified) **Description** The issue is related to a memory corruption vulnerability in the Chakra Scripting Engine, which can be exploited by an attacker to gain access to protected information. This vulnerability is associated with a buffer overflow. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.14.5 **Description** A validation issue was addressed with improved input sanitization, allowing an application to potentially read restricted memory. **Recommendations** For versions prior to 10.14.5, update to macOS Mojave 10.14.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The issue is related to insufficient handling of objects in memory by the JavaScript ChakraCore engine in Microsoft Edge. This could allow a remote attacker to corrupt memory and execute arbitrary code using a specially crafted web page. Successful exploitation could grant the attacker the same user rights as the current user, potentially leading to control of the affected system if the user has administrative rights. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12 Apple macOS versions prior to 10.14 Apple tvOS versions prior to 12 Apple watchOS versions prior to 5 Apple iTunes for Windows versions prior to 12.9 Apple iCloud for Windows versions prior to 7.7 **Description** A memory corruption issue was addressed with improved memory handling. **Recommendations** For Apple iOS versions prior to 12, update to iOS 12 or later. For Apple macOS versions prior to 10.14, update to macOS 10.14 or later. For Apple tvOS versions prior to 12, update to tvOS 12 or later. For Apple watchOS versions prior to 5, update to watchOS 5 or later. For Apple iTunes for Windows versions prior to 12.9, update to iTunes 12.9 or later. For Apple iCloud for Windows versions prior to 7.7, update to iCloud for Windows 7.7 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12 Apple macOS versions prior to 10.14 Apple tvOS versions prior to 12 Apple watchOS versions prior to 5 **Description** An out-of-bounds read issue was addressed with improved bounds checking. **Recommendations** For Apple iOS versions prior to 12, update to iOS 12 or later. For Apple macOS versions prior to 10.14, update to macOS Mojave 10.14 or later. For Apple tvOS versions prior to 12, update to tvOS 12 or later. For Apple watchOS versions prior to 5, update to watchOS 5 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12 tvOS versions prior to 12 watchOS versions prior to 5 Safari versions prior to 12 iTunes for Windows versions prior to 12.9 iCloud for Windows versions prior to 7.7 **Description** The issue is related to multiple memory corruption problems that were addressed with improved memory handling. **Recommendations** For iOS versions prior to 12, update to version 12 or later. For tvOS versions prior to 12, update to version 12 or later. For watchOS versions prior to 5, update to version 5 or later. For Safari versions prior to 12, update to version 12 or later. For iTunes for Windows versions prior to 12.9, update to version 12.9 or later. For iCloud for Windows versions prior to 7.7, update to version 7.7 or later.