Dillon Franke

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.7.6 macOS Sequoia versions prior to 15.5 macOS Sonoma versions prior to 14.7.6 iPadOS versions prior to 17.7.7 **Description** The issue involves a double free condition addressed through improved memory management. This could allow an application to cause unexpected system termination. The issue resides within the `coreaudiod` component of the CoreAudio framework. A proof-of-concept (PoC) has been released demonstrating how the issue can be exploited. The vulnerability could potentially allow an attacker to execute arbitrary code with elevated privileges, leading to a full system compromise. **Recommendations** Update macOS to version 13.7.6 or later. Update macOS Sequoia to version 15.5 or later. Update macOS Sonoma to version 14.7.6 or later. Update iPadOS to version 17.7.7 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Sequoia 15.2 macOS versions prior to Ventura 13.7.2 macOS versions prior to Sonoma 14.7.2 **Description** A logic issue was addressed with improved checks. This issue allows an application to potentially execute arbitrary code with kernel privileges. **Recommendations** Update to macOS Sequoia version 15.2 or later. Update to macOS Ventura version 13.7.2 or later. Update to macOS Sonoma version 14.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** ThroughTek Kalay Platform version 2.0 ThroughTek Kalay P2P SDK (affected versions not specified) **Description** The issue is related to the bypass of authentication via spoofing, allowing a remote attacker to compromise IoT devices and gain unauthorized access to protected information. An attacker can impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID), potentially resulting in the hijacking of a victim's connection and forcing them to supply credentials needed to access the victim TUTK device. It is estimated that 83 million devices connected to the Kalay network are at risk. The vulnerability can be exploited to gain access to streaming video and audio, compromise home networks and credentials, and create botnets from compromised devices. **Recommendations** For ThroughTek Kalay Platform version 2.0, update to the latest version Kalay 3.1.10 to resolve the issue. For ThroughTek Kalay P2P SDK, at the moment, there is no information about a newer version that contains a fix for this vulnerability.