David Schütz

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.5 iPadOS versions prior to 14.5 watchOS versions prior to 7.4 Description: A validation issue was addressed with improved input sanitization, allowing a local user to potentially write arbitrary files. Recommendations: For iOS versions prior to 14.5, update to iOS 14.5 or later. For iPadOS versions prior to 14.5, update to iPadOS 14.5 or later. For watchOS versions prior to 7.4, update to watchOS 7.4 or later.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 14.1.1 tvOS versions prior to 14.6 iOS versions prior to 14.6 iPadOS versions prior to 14.6 macOS Big Sur versions prior to 11.4 watchOS versions prior to 7.5 **Description** The issue is related to a logic problem with inadequate restrictions, which may allow a malicious website to access restricted ports on arbitrary servers. This could potentially lead to unauthorized access to confidential data and disruption of its integrity. **Recommendations** For Safari version prior to 14.1.1, update to Safari 14.1.1 or later. For tvOS version prior to 14.6, update to tvOS 14.6 or later. For iOS version prior to 14.6, update to iOS 14.6 or later. For iPadOS version prior to 14.6, update to iPadOS 14.6 or later. For macOS Big Sur version prior to 11.4, update to macOS Big Sur 11.4 or later. For watchOS version prior to 7.5, update to watchOS 7.5 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 84 **Description** A issue exists where a website could capture the event of a user typing a URL in the address bar or search bar and quickly hitting the enter key, allowing the website to redirect the user before navigation occurred to the desired address. To construct a convincing spoof, the attacker would have had to guess what the user was typing, perhaps by suggesting it. **Recommendations** For versions prior to 84, update to version 84 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Closure Library versions up to and including v20200224 **Description** A URL parsing issue in goog.uri of the Google Closure Library allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. **Recommendations** For Google Closure Library versions up to and including v20200224, update your library to version v20200315.