Gertjan Franken

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 WebKitGTK (affected versions not specified) WPE WebKit (affected versions not specified) **Description** The issue is related to insufficient input validation, which may allow a remote attacker to impact data integrity. A logic issue was addressed with improved validation. The Content Security Policy to block domains with wildcards may fail. **Recommendations** For macOS versions prior to 13.3, update to macOS Ventura 13.3 to resolve the issue. For WebKitGTK, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For WPE WebKit, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 13.1 iPadOS versions prior to 13.1 macOS versions prior to 10.15 **Description** A resource exhaustion issue was addressed with improved input validation. Parsing a maliciously crafted iBooks file may lead to a persistent denial-of-service. **Recommendations** For iOS versions prior to 13.1, update to iOS 13.1 or later. For iPadOS versions prior to 13.1, update to iPadOS 13.1 or later. For macOS versions prior to 10.15, update to macOS Catalina 10.15 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 13.2 iPadOS versions prior to 13.2 macOS Catalina versions prior to 10.15.1 **Description** A validation issue existed in the handling of symlinks, which has been addressed with improved validation. Parsing a maliciously crafted iBooks file may lead to disclosure of user information. **Recommendations** For iOS versions prior to 13.2, update to iOS 13.2 or later. For iPadOS versions prior to 13.2, update to iPadOS 13.2 or later. For macOS Catalina versions prior to 10.15.1, update to macOS Catalina 10.15.1 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 77.0.3865.75 **Description** The issue is related to insufficient policy enforcement in the Blink module of Google Chrome, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This could enable the attacker to access confidential data. **Recommendations** For versions prior to 77.0.3865.75, update to version 77.0.3865.75 or later to resolve the issue.