Calif.Io

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An issue exists where an un-negotiated Raw Public Key (RPK), as defined in RFC 7250, is accepted instead of an X.509 certificate, allowing the bypass of chain validation. Because a raw public key lacks a chain, the `ParseCertRelative()` function accepts it without performing trust verification. This should only occur when RPK is explicitly negotiated for the peer. The system now defaults the expected type to X.509 when no type is negotiated and rejects mismatches, including un-negotiated raw public keys, with an UNSUPPORTED CERTIFICATE error. This issue only affects builds where Raw Public Key support (`HAVE RPK`) is enabled, which occurs when using the `--enable-all` configuration rather than a standalone build. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18.7.9 iPadOS versions prior to 18.7.9 macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 **Description** An integer overflow—a condition where an arithmetic operation attempts to create a numeric value that is too large to be represented—exists in the kernel of M5 Macs. This issue, caused by insufficient input validation, could allow an application to cause unexpected system termination or lead to kernel privilege escalation. **Recommendations** Update iOS to version 18.7.9. Update iPadOS to version 18.7.9. Update macOS Sequoia to version 15.7.7. Update macOS Sonoma to version 14.8.7. Update macOS Tahoe to version 26.5.