Dion Blazakis

**Name of the Vulnerable Software and Affected Versions** Garmin Forerunner 235 versions prior to 8.20 **Description** The issue is related to an array index error in the ConnectIQ TVM component. To exploit this, an attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the offset provided for the stack value duplication instruction, DUP, which is unchecked, allowing memory prior to the start of the execution stack to be read and treated as a TVM object. This could lead to the leak of runtime information, such as heap handles or pointers for TVM context variables, and potentially allow for remote code execution by forging a TVM object on the stack. **Recommendations** For Garmin Forerunner 235 versions prior to 8.20, update to version 8.20 or later to resolve the issue. As a temporary workaround, consider restricting the installation of ConnectIQ applications from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Garmin Forerunner 235 versions prior to 8.20 **Description** The issue is related to an Integer Overflow in the ConnectIQ TVM component. To exploit this, an attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check for overflow when allocating the array for the NEWA instruction, resulting in a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment. **Recommendations** For Garmin Forerunner 235 versions prior to 8.20, update to version 8.20 or later to resolve the issue. As a temporary workaround, consider restricting the installation of ConnectIQ applications from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Garmin Forerunner 235 versions prior to 8.20 **Description** The issue is related to an array index error in the ConnectIQ TVM component. To exploit this, an attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check the index provided when accessing the local variable in the LGETV and LPUTV instructions, allowing read and write access to memory outside the bounds of the TVM context allocation. This can be used to construct a use-after-free scenario, leading to a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment. **Recommendations** For Garmin Forerunner 235 versions prior to 8.20, update to version 8.20 or later to resolve the issue. As a temporary workaround, consider restricting the installation of ConnectIQ applications from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Garmin Forerunner 235 versions prior to 8.20 **Description** The issue is related to a buffer overflow in the ConnectIQ TVM component. To exploit this, an attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the string length provided in the data section of the PRG file, allocates memory for the string, and then copies the string into the TVM object using a function similar to `strcpy()`. This can lead to overwriting heap data if the copy exceeds the allocated string length. A successful exploit allows a ConnectIQ app store application to escape its restricted environment and perform unauthorized activities. **Recommendations** For Garmin Forerunner 235 versions prior to 8.20, update to version 8.20 or later to resolve the issue. As a temporary workaround, consider restricting the installation of ConnectIQ applications from untrusted sources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple Mac OS X versions prior to 10.6.7 Apple iOS versions prior to 4.2.7 and 4.3.x prior to 4.3.2 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption and application crash. This is achieved via a Microsoft Office document with a crafted size field in the OfficeArtMetafileHeader, related to OfficeArtBlip. The vulnerability was demonstrated on the iPhone by Charlie Miller and Dion Blazakis during a Pwn2Own competition at CanSecWest 2011. **Recommendations** For Apple Mac OS X versions prior to 10.6.7, update to version 10.6.7 or later to resolve the issue. For Apple iOS versions prior to 4.2.7, update to version 4.2.7 or later to resolve the issue. For Apple iOS versions 4.3.x prior to 4.3.2, update to version 4.3.2 or later to resolve the issue.