Guluisacat

**Name of the Vulnerable Software and Affected Versions** macOS Tahoe versions prior to 26.4 **Description** A flaw in the macOS Archive Utility allows a malicious application to access arbitrary files due to insufficient permissions checking. The issue can be exploited if a user executes an attacker-controlled shell script and is tricked into performing a drag-and-drop action. This process allows an attacker to swap a signed application's executable on disk, bypassing code signing protections that typically guard applications downloaded from the App Store or directly from the web. **Recommendations** Update macOS Tahoe to version 26.4.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Sonoma 14.8 macOS versions prior to Sequoia 15.7 macOS Tahoe versions prior to 26 **Description** A permissions issue existed where an application could potentially access protected user data. This was addressed by implementing additional restrictions. **Recommendations** Update to macOS Sonoma version 14.8 or later. Update to macOS Sequoia version 15.7 or later. Update to macOS Tahoe version 26 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Sequoia 15.6 macOS versions prior to Sonoma 14.7.7 **Description** An application may be able to hijack entitlements granted to other privileged applications due to improved data protection. **Recommendations** Update to macOS Sequoia 15.6. Update to macOS Sonoma 14.7.7.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14.7.7 macOS versions prior to 13.7.7 macOS versions prior to 15.6 **Description** A parsing issue in the handling of directory paths existed due to insufficient path validation. This could allow an application to access protected user data. **Recommendations** Update to macOS version 14.7.7 or later. Update to macOS version 13.7.7 or later. Update to macOS version 15.6 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.7.3 macOS versions prior to 14.7.3 macOS versions prior to 15.3 **Description** The issue is related to insecure storage of confidential information in the MacOs operating system's Security component. It may allow an attacker to gain unauthorized access to protected information. This issue was addressed with improved validation of symlinks. An app may be able to access protected user data. **Recommendations** For macOS versions prior to 13.7.3, update to macOS Ventura 13.7.3 to resolve the issue. For macOS versions prior to 14.7.3, update to macOS Sonoma 14.7.3 to resolve the issue. For macOS versions prior to 15.3, update to macOS Sequoia 15.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.7 macOS Sequoia versions prior to 15 **Description** A permissions issue was addressed with additional restrictions. This issue may allow an app to access protected user data. The issue is related to a sandboxed app bypassing TCC protections. **Recommendations** For macOS Sonoma versions prior to 14.7, update to macOS Sonoma 14.7 to resolve the issue. For macOS Sequoia versions prior to 15, update to macOS Sequoia 15 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14.7 macOS Sequoia versions prior to 15 **Description** A malicious application may be able to leak sensitive user information due to inadequate checks. The issue was addressed with improved checks. **Recommendations** For macOS versions prior to 14.7, update to macOS Sonoma 14.7 to resolve the issue. For macOS Sequoia versions prior to 15, update to macOS Sequoia 15 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.7 macOS versions prior to 14.7 macOS versions prior to 15 **Description** The issue allows a malicious application to access private information. It was addressed with improved checks. **Recommendations** For versions prior to 13.7, update to macOS Ventura 13.7. For versions prior to 14.7, update to macOS Sonoma 14.7. For versions prior to 15, update to macOS Sequoia 15.

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 10.6 macOS Sonoma versions prior to 14.6 iOS versions prior to 17.6 iPadOS versions prior to 17.6 tvOS versions prior to 17.6 **Description** The issue allows an app to bypass Privacy preferences. This was addressed through improved state management. **Recommendations** For watchOS versions prior to 10.6, update to watchOS 10.6. For macOS Sonoma versions prior to 14.6, update to macOS Sonoma 14.6. For iOS versions prior to 17.6, update to iOS 17.6. For iPadOS versions prior to 17.6, update to iPadOS 17.6. For tvOS versions prior to 17.6, update to tvOS 17.6.

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.6 iOS versions prior to 17.6 iPadOS versions prior to 17.6 **Description** A path handling issue was addressed with improved validation, which may allow an app to access protected user data. **Recommendations** For macOS Sonoma versions prior to 14.6, update to macOS Sonoma 14.6 to resolve the issue. For iOS versions prior to 17.6, update to iOS 17.6 to resolve the issue. For iPadOS versions prior to 17.6, update to iPadOS 17.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.6 **Description** The issue was addressed with improved validation of symlinks. An app may be able to access protected user data. **Recommendations** For versions prior to 14.6, update to macOS Sonoma 14.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.7.6 macOS versions prior to 13.6.8 macOS versions prior to 14.6 **Description** The issue allows an app to potentially access user-sensitive data. This was addressed with improved checks. **Recommendations** For macOS versions prior to 12.7.6, update to macOS Monterey 12.7.6. For macOS versions prior to 13.6.8, update to macOS Ventura 13.6.8. For macOS versions prior to 14.6, update to macOS Sonoma 14.6.

**Name of the Vulnerable Software and Affected Versions** macOS Monterey versions prior to 12.7.2 macOS Ventura versions prior to 13.6.3 iOS versions prior to 17.2 iPadOS versions prior to 17.2 tvOS versions prior to 17.2 watchOS versions prior to 10.2 macOS Sonoma versions prior to 14.2 **Description** A path handling issue was addressed with improved validation, which may allow an app to break out of its sandbox. **Recommendations** For macOS Monterey, update to version 12.7.2 or later. For macOS Ventura, update to version 13.6.3 or later. For iOS, update to version 17.2 or later. For iPadOS, update to version 17.2 or later. For tvOS, update to version 17.2 or later. For watchOS, update to version 10.2 or later. For macOS Sonoma, update to version 14.2 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14.2 macOS Ventura versions prior to 13.6.3 macOS Monterey versions prior to 12.7.2 **Description** A logic issue was addressed with improved checks, which may allow an app to access protected user data. The issue is related to insufficient protection of service data in the macOS operating system, potentially allowing an attacker to access protected information. **Recommendations** For macOS versions prior to 14.2, update to macOS Sonoma 14.2 to resolve the issue. For macOS Ventura versions prior to 13.6.3, update to macOS Ventura 13.6.3 to resolve the issue. For macOS Monterey versions prior to 12.7.2, update to macOS Monterey 12.7.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14.1 **Description** The issue is related to insufficient access control in the LaunchServices component of the macOS operating system, which may allow an app to access sensitive user data. The issue was addressed with improved permissions logic. **Recommendations** For versions prior to 14.1, update to macOS Sonoma 14.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive user data until the update is applied.