Koh M. Nakagawa

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.7.7 macOS Ventura versions prior to 13.7.7 macOS Sequoia versions prior to 15.6 **Description** A permissions issue was addressed with additional restrictions. An app may be able to bypass certain Privacy preferences. **Recommendations** Update macOS to version 14.7.7 or later. Update macOS to version 13.7.7 or later. Update macOS to version 15.6 or later.

**Name of the Vulnerable Software and Affected Versions** SXF Common Library (affected versions not specified) **Description** The SXF Common Library improperly handles input data. If a product using the library reads a crafted file, it may cause the product to crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15 **Description** The issue allows an app to modify protected parts of the file system. It was addressed with improved checks. **Recommendations** For versions prior to 15, update to macOS Sequoia 15 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS Monterey versions prior to 12.7.4 watchOS versions prior to 10.3 tvOS versions prior to 17.3 macOS Ventura versions prior to 13.6.5 iOS versions prior to 17.3 iPadOS versions prior to 17.3 macOS Sonoma versions prior to 14.3 **Description** A permissions issue was addressed with additional restrictions. This issue may allow an app to cause a denial-of-service. **Recommendations** For macOS Monterey, update to version 12.7.4 or later. For watchOS, update to version 10.3 or later. For tvOS, update to version 17.3 or later. For macOS Ventura, update to version 13.6.5 or later. For iOS, update to version 17.3 or later. For iPadOS, update to version 17.3 or later. For macOS Sonoma, update to version 14.3 or later.

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.2 macOS Ventura versions prior to 13.6.3 macOS Monterey versions prior to 12.7.2 **Description** The issue is related to an out-of-bounds read in the CoreServices component of the macOS operating system. This can be exploited by an attacker using a specially crafted file, potentially allowing arbitrary code execution. A user may also be able to cause unexpected app termination. **Recommendations** For macOS Sonoma versions prior to 14.2, update to version 14.2 or later. For macOS Ventura versions prior to 13.6.3, update to version 13.6.3 or later. For macOS Monterey versions prior to 12.7.2, update to version 12.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.7.1 macOS versions prior to 13.6.1 macOS versions prior to 14.1 **Description** A permissions issue was addressed with additional restrictions, which may have allowed an app to modify protected parts of the file system. **Recommendations** For macOS versions prior to 12.7.1, update to macOS Monterey 12.7.1. For macOS versions prior to 13.6.1, update to macOS Ventura 13.6.1. For macOS versions prior to 14.1, update to macOS Sonoma 14.1.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14 **Description** A race condition was addressed with improved locking, which may have allowed an app to modify protected parts of the file system. **Recommendations** For versions prior to 14, update to macOS Sonoma 14 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14 **Description** The issue is related to a component of the macOS operating system and involves reading beyond memory boundaries. Processing a file may lead to a denial-of-service or potentially disclose memory contents. Exploitation of this issue may allow an attacker to disclose protected information or cause a denial-of-service. **Recommendations** For versions prior to 14, update to macOS Sonoma 14 to resolve the issue. At the moment, there is no information about other versions that contain a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** direct Desktop App for macOS versions 2.6.0 and earlier **Description** The issue allows a local attacker to bypass access restrictions and use the camera, microphone, etc. of the device where the product is installed without the user's consent. This is due to an improper access control vulnerability. **Recommendations** For versions 2.6.0 and earlier, update to a version later than 2.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the device's camera and microphone to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Pro Video Formats versions prior to 2.2.5 **Description** A logic issue was addressed with improved state management, which may allow a user to elevate privileges. **Recommendations** For versions prior to 2.2.5, update to Pro Video Formats 2.2.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Chatwork Desktop Application (Mac) versions 2.6.43 and earlier **Description** A code injection issue exists, allowing a non-administrative user of the Mac where the product is installed to store and obtain audio and image data from the product without the user's consent. **Recommendations** For versions 2.6.43 and earlier, update to a version later than 2.6.43 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Wacom Tablet Driver installer versions prior to 6.4.2-1 **Description** The issue allows for arbitrary code execution with root privilege when a user is tricked into executing a malicious script before running the affected installer version. This is due to an improper link resolution before file access. **Recommendations** For versions prior to 6.4.2-1, update to version 6.4.2-1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 9.5 tvOS versions prior to 16.5 macOS Ventura versions prior to 13.4 macOS Big Sur versions prior to 11.7.7 macOS Monterey versions prior to 12.6.6 iOS versions prior to 16.5 iPadOS versions prior to 16.5 **Description** An authorization issue was addressed with improved state management. This issue may allow an app to retain access to system configuration files even after its permission is revoked, potentially allowing an attacker to access confidential information and preserve user data. **Recommendations** For watchOS versions prior to 9.5, update to watchOS 9.5 to resolve the issue. For tvOS versions prior to 16.5, update to tvOS 16.5 to resolve the issue. For macOS Ventura versions prior to 13.4, update to macOS Ventura 13.4 to resolve the issue. For macOS Big Sur versions prior to 11.7.7, update to macOS Big Sur 11.7.7 to resolve the issue. For macOS Monterey versions prior to 12.6.6, update to macOS Monterey 12.6.6 to resolve the issue. For iOS versions prior to 16.5, update to iOS 16.5 to resolve the issue. For iPadOS versions prior to 16.5, update to iPadOS 16.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drive Explorer for macOS versions 3.5.4 and earlier **Description** The issue is related to incorrect code generation management, allowing an attacker to inject arbitrary code while processing the product execution. This can enable the attacker to read and/or write to arbitrary files without access privileges, given that a full disk access privilege is required to execute LINE WORKS Drive Explorer. **Recommendations** For versions 3.5.4 and earlier, update to a version later than 3.5.4 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 macOS versions prior to 12.6.4 **Description** A logic issue was addressed with improved checks, which may have allowed an app to modify protected parts of the file system. **Recommendations** For macOS versions prior to 13.3, update to macOS Ventura 13.3. For macOS versions prior to 12.6.4, update to macOS Monterey 12.6.4.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (Chromium-based) (affected versions not specified) **Description** The issue is related to synchronization errors, specifically a "race condition" scenario, which can be exploited to elevate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OneDrive for Windows (affected versions not specified) OneDrive for MacOS (affected versions not specified) **Description** The issue is related to insufficient access restrictions in the file hosting service, which can be exploited by an attacker to elevate their privileges using a specially crafted application. **Recommendations** For OneDrive for Windows, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For OneDrive for MacOS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 102.3 **Description** The issue is related to incorrect handling of the com.apple.quarantine attribute by the Thunderbird user interface. This can be exploited by a remote attacker to execute arbitrary code by loading a malicious email attachment. On macOS, when saving or opening an email attachment, Thunderbird failed to set the com.apple.quarantine attribute on the received file. If the file was an application and the user tried to open it, the application would start immediately without prompting the user for confirmation. **Recommendations** For versions prior to 102.3, update to version 102.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of email attachments from untrusted sources until the update is applied. Restrict access to potentially malicious files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.7 macOS Monterey versions prior to 12.6 macOS Ventura version 13 is not affected, but versions prior to 13 are vulnerable, however since 13 is the starting version, it is already included in 'prior to' statement, hence the correct statement is: macOS versions prior to 11.7 macOS Monterey versions prior to 12.6 **Description** The issue concerns a problem in code signature validation that has been addressed with improved checks. This could allow an app to access user-sensitive data. **Recommendations** For macOS versions prior to 11.7, update to macOS Big Sur 11.7 or later. For macOS Monterey versions prior to 12.6, update to macOS Monterey 12.6 or later.