Dave G

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18.7.9 iPadOS versions prior to 18.7.9 iOS versions prior to 26.5 iPadOS versions prior to 26.5 macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** A buffer overflow, which occurs when data exceeds the allocated memory boundary, was identified. This issue may allow an app to cause unexpected system termination. **Recommendations** Update iOS to version 18.7.9 or 26.5 Update iPadOS to version 18.7.9 or 26.5 Update macOS Sequoia to version 15.7.7 Update macOS Sonoma to version 14.8.7 Update macOS Tahoe to version 26.5 Update tvOS to version 26.5 Update visionOS to version 26.5 Update watchOS to version 26.5

**Name of the Vulnerable Software and Affected Versions** macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 **Description** A buffer overflow, which occurs when a program writes more data to a memory buffer than it can hold, was addressed with improved bounds checking. An app may be able to cause unexpected system termination or write kernel memory. **Recommendations** Update macOS Sequoia to version 15.7.7. Update macOS Sonoma to version 14.8.7. Update macOS Tahoe to version 26.5.

**Name of the Vulnerable Software and Affected Versions** macOS Sequoia versions prior to 15.7.7 macOS Tahoe versions prior to 26.5 **Description** A buffer overflow, which occurs when data exceeds the allocated memory boundary, was addressed with improved bounds checking. A remote attacker may be able to cause unexpected system termination. **Recommendations** Update macOS Sequoia to version 15.7.7. Update macOS Tahoe to version 26.5.

**Name of the Vulnerable Software and Affected Versions** macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 **Description** A buffer overflow occurs due to insufficient bounds checking. This flaw allows an application to write to kernel memory or cause unexpected system termination. A buffer overflow is a condition where a program writes more data to a block of memory than it can hold, potentially overwriting adjacent memory locations. **Recommendations** Update macOS Sequoia to version 15.7.7. Update macOS Sonoma to version 14.8.7.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 **Description** A use after free issue existed due to improper memory management. This could allow an application to cause unexpected system termination. **Recommendations** Update to macOS Sonoma version 14.8.2 or later. Update to macOS Sequoia version 15.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** visionOS versions prior to 26.1 macOS Sonoma versions prior to 14.8.2 macOS Sequoia versions prior to 15.7.2 watchOS versions prior to 26.1 iOS versions prior to 26.1 iPadOS versions prior to 26.1 tvOS versions prior to 26.1 **Description** A sandboxed application may be able to observe system-wide network connections due to insufficient restrictions. **Recommendations** Update visionOS to version 26.1. Update macOS Sonoma to version 14.8.2. Update macOS Sequoia to version 15.7.2. Update watchOS to version 26.1. Update iOS to version 26.1. Update iPadOS to version 26.1. Update tvOS to version 26.1.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.7.6 macOS Sequoia versions prior to 15.5 macOS Sonoma versions prior to 14.7.6 **Description** The issue is related to mounting a maliciously crafted AFP network share, which may lead to system termination. **Recommendations** For macOS versions prior to 13.7.6, update to macOS Ventura 13.7.6. For macOS Sequoia versions prior to 15.5, update to macOS Sequoia 15.5. For macOS Sonoma versions prior to 14.7.6, update to macOS Sonoma 14.7.6.

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 11.5 macOS Sonoma versions prior to 14.7.6 tvOS versions prior to 18.5 iPadOS versions prior to 17.7.7 iOS versions prior to 18.5 iPadOS versions prior to 18.5 macOS Sequoia versions prior to 15.5 visionOS versions prior to 2.5 macOS Ventura versions prior to 13.7.6 **Description** An integer overflow was addressed with improved input validation. This issue allows a remote attacker to potentially leak memory. **Recommendations** For watchOS versions prior to 11.5, update to watchOS 11.5. For macOS Sonoma versions prior to 14.7.6, update to macOS Sonoma 14.7.6. For tvOS versions prior to 18.5, update to tvOS 18.5. For iPadOS versions prior to 17.7.7, update to iPadOS 17.7.7. For iOS versions prior to 18.5, update to iOS 18.5. For iPadOS versions prior to 18.5, update to iPadOS 18.5. For macOS Sequoia versions prior to 15.5, update to macOS Sequoia 15.5. For visionOS versions prior to 2.5, update to visionOS 2.5. For macOS Ventura versions prior to 13.7.6, update to macOS Ventura 13.7.6.

**Name of the Vulnerable Software and Affected Versions** macOS Ventura versions prior to 13.7.6 macOS Sequoia versions prior to 15.5 macOS Sonoma versions prior to 14.7.6 **Description** Mounting a maliciously crafted AFP network share may lead to system termination. The issue was addressed with improved checks. **Recommendations** For macOS Ventura versions prior to 13.7.6, update to macOS Ventura 13.7.6 to resolve the issue. For macOS Sequoia versions prior to 15.5, update to macOS Sequoia 15.5 to resolve the issue. For macOS Sonoma versions prior to 14.7.6, update to macOS Sonoma 14.7.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** vixie cron versions prior to 9cc8ab1 OpenBSD versions 7.4 and 7.5 **Description** The issue allows a heap-based buffer underflow and memory corruption in cron/entry.c. This was introduced during a May 2023 refactoring. **Recommendations** For vixie cron versions prior to 9cc8ab1, update to a version that includes the fix for the heap-based buffer underflow. For OpenBSD versions 7.4 and 7.5, update the vixie cron package to a version that includes the fix for the heap-based buffer underflow. As a temporary workaround, consider restricting access to the `set range()` function in crontab until a patch is available.

**Name of the Vulnerable Software and Affected Versions** AppleFileServer for Mac OS X versions 10.3.3 and earlier **Description** The issue is related to a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by sending a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument containing an AFPName type string that exceeds the length specified in the associated length field. **Recommendations** For AppleFileServer for Mac OS X versions 10.3.3 and earlier, consider disabling the Cleartext Password User Authentication Method (UAM) until a patch is available to prevent exploitation of the buffer overflow vulnerability. Restrict access to the LoginExt packet handling functionality to minimize the risk of remote code execution.

**Name of the Vulnerable Software and Affected Versions** Mac OS X versions 10.2.x through 10.3.x **Description** A buffer overflow issue in TruBlueEnvironment allows local users to gain privileges via a long environment variable. **Recommendations** For Mac OS X versions 10.2.x through 10.3.x, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Mac OS version 10.2.8 **Description** The System Configuration subsystem in Mac OS allows local users to modify network settings. **Recommendations** For Mac OS version 10.2.8, consider restricting access to the System Configuration subsystem to prevent unauthorized modification of network settings.

**Name of the Vulnerable Software and Affected Versions** Darwin Streaming Administration Server version 4.1.2 QuickTime Streaming Server version 4.1.1 **Description** The issue allows remote attackers to execute arbitrary code via shell metacharacters in the parse xml.cgi component. **Recommendations** For Darwin Streaming Administration Server version 4.1.2, update to a version that fixes the issue with parse xml.cgi. For QuickTime Streaming Server version 4.1.1, update to a version that fixes the issue with parse xml.cgi.