Minghao Lin

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15.6 **Description** A permissions issue was addressed with additional sandbox restrictions. A sandboxed process may be able to circumvent sandbox restrictions. **Recommendations** Update to macOS version 15.6.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Sonoma 14.7.7 macOS versions prior to Ventura 13.7.7 macOS versions prior to Sequoia 15.6 **Description** The issue was addressed by removing the vulnerable code. Running an `hdiutil` command may unexpectedly execute arbitrary code. **Recommendations** Update to macOS Sonoma 14.7.7 or later. Update to macOS Ventura 13.7.7 or later. Update to macOS Sequoia 15.6 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15.6 macOS versions prior to 14.7.7 macOS versions prior to 13.7.7 **Description** An issue existed in the handling of environment variables. The issue was addressed with improved validation. An app may be able to access sensitive user data. **Recommendations** Update to macOS version 15.6 or later. Update to macOS version 14.7.7 or later. Update to macOS version 13.7.7 or later.

**Name of the Vulnerable Software and Affected Versions** iPadOS versions prior to 17.7.4 macOS Ventura versions prior to 13.7.3 macOS Sonoma versions prior to 14.7.3 visionOS versions prior to 2.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 macOS Sequoia versions prior to 15.3 tvOS versions prior to 18.3 **Description** The issue is related to incorrect clearing or release of resources, which may lead to an unexpected app termination when parsing a file. Exploitation of this issue may allow an attacker to cause a denial of service. **Recommendations** For iPadOS versions prior to 17.7.4, update to iPadOS 17.7.4 or later. For macOS Ventura versions prior to 13.7.3, update to macOS Ventura 13.7.3 or later. For macOS Sonoma versions prior to 14.7.3, update to macOS Sonoma 14.7.3 or later. For visionOS versions prior to 2.3, update to visionOS 2.3 or later. For iOS versions prior to 18.3, update to iOS 18.3 or later. For iPadOS versions prior to 18.3, update to iPadOS 18.3 or later. For macOS Sequoia versions prior to 15.3, update to macOS Sequoia 15.3 or later. For tvOS versions prior to 18.3, update to tvOS 18.3 or later.

**Name of the Vulnerable Software and Affected Versions** WmsRepair Service (affected versions not specified) **Description** The issue is related to insufficient access restrictions in the WmsRepair Service, which can be exploited to elevate privileges. This allows an attacker to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Remote Desktop Client versions prior to 1.2.5709 Description: The issue is related to a use-after-free vulnerability in the Remote Desktop Protocol (RDP) Client of Windows operating systems. This vulnerability can be exploited by a remote attacker to execute arbitrary code. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Recommendations: For versions prior to 1.2.5709, update to version 1.2.5709 or later to resolve the issue. As a temporary workaround, consider restricting access to the Remote Desktop Client until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 16.7.9 iPadOS versions prior to 16.7.9 macOS Ventura versions prior to 13.6.8 macOS Monterey versions prior to 12.7.6 iOS versions prior to 17.6 iPadOS versions prior to 17.6 watchOS versions prior to 10.6 tvOS versions prior to 17.6 visionOS versions prior to 1.3 macOS Sonoma versions prior to 14.6 **Description** A type confusion issue was addressed with improved memory handling. This issue may allow a local attacker to cause unexpected system shutdown. **Recommendations** For iOS versions prior to 16.7.9, update to iOS 16.7.9 or later. For iPadOS versions prior to 16.7.9, update to iPadOS 16.7.9 or later. For macOS Ventura versions prior to 13.6.8, update to macOS Ventura 13.6.8 or later. For macOS Monterey versions prior to 12.7.6, update to macOS Monterey 12.7.6 or later. For iOS versions prior to 17.6, update to iOS 17.6 or later. For iPadOS versions prior to 17.6, update to iPadOS 17.6 or later. For watchOS versions prior to 10.6, update to watchOS 10.6 or later. For tvOS versions prior to 17.6, update to tvOS 17.6 or later. For visionOS versions prior to 1.3, update to visionOS 1.3 or later. For macOS Sonoma versions prior to 14.6, update to macOS Sonoma 14.6 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.6.8 macOS Sonoma versions prior to 14.5 macOS Monterey versions prior to 12.7.6 watchOS versions prior to 10.5 visionOS versions prior to 1.3 tvOS versions prior to 17.5 iOS versions prior to 17.5 iPadOS versions prior to 17.5 **Description** The issue was addressed with improved memory handling. An app may be able to execute arbitrary code with kernel privileges. **Recommendations** For macOS Ventura, update to version 13.6.8. For macOS Sonoma, update to version 14.5. For macOS Monterey, update to version 12.7.6. For watchOS, update to version 10.5. For visionOS, update to version 1.3. For tvOS, update to version 17.5. For iOS, update to version 17.5. For iPadOS, update to version 17.5.

**Name of the Vulnerable Software and Affected Versions** FreeRTOS Kernel versions through 10.6.1 **Description** The issue is related to insufficient protection against local privilege escalation via Return Oriented Programming techniques, should a vulnerability exist that allows code injection and execution. This affects ARMv7-M MPU ports and ARMv8-M ports with Memory Protected Unit (MPU) support enabled, i.e., `configENABLE MPU` set to 1. **Recommendations** For FreeRTOS Kernel versions through 10.6.1, update to version 10.6.2, which includes a new MPU wrapper to fix the issue. As a temporary workaround, consider disabling the `configENABLE MPU` to minimize the risk of exploitation. Restrict access to the affected ARMv7-M MPU ports and ARMv8-M ports with Memory Protected Unit (MPU) support enabled to reduce the attack surface.

**Name of the Vulnerable Software and Affected Versions** Tenda AC18 versions prior to V15.03.05.19(6318) **Description** The issue is related to a heap overflow in the httpd module when handling the `/goform/saveParentControlInfo` API endpoint, specifically due to the `saveParentControlInfo()` function's handling of the `deviceId` parameter. This can allow a remote attacker to cause a denial of service or execute arbitrary code. **Recommendations** For Tenda AC18 versions prior to V15.03.05.19(6318), as a temporary workaround, consider disabling the `saveParentControlInfo()` function until a patch is available. Restrict access to the `/goform/saveParentControlInfo` API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC18 version 15.03.05.19(6318) **Description** The issue is related to a stack-based buffer overflow vulnerability in the `form fast setting wifi set()` function of the Tenda AC18 router's firmware. This vulnerability is caused by an out-of-bounds write operation when processing the `ssid` parameter. Exploitation of this issue could allow a remote attacker to cause a denial of service. **Recommendations** For version 15.03.05.19(6318), as a temporary workaround, consider disabling the `form fast setting wifi set()` function until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. Avoid using the `ssid` parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC18 versions prior to V15.03.05.19(6318) **Description** The issue is related to a stack-based buffer overflow vulnerability in the `fromAddressNat()` function of the Tenda AC18 router's firmware. This vulnerability occurs when handling the `entrys` and `mitInterface` parameters, allowing an attacker to potentially cause a denial of service or execute arbitrary code remotely. **Recommendations** For Tenda AC18 versions prior to V15.03.05.19(6318), as a temporary workaround, consider disabling the `fromAddressNat()` function until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC Series Router version AC18 V15.03.05.19(6318) **Description** The issue is related to a stack-based buffer overflow in the httpd module when handling the "/goform/WifiExtraSet" API endpoint. This can potentially allow an attacker to cause a denial of service. **Recommendations** For Tenda AC Series Router version AC18 V15.03.05.19(6318), consider restricting access to the "/goform/WifiExtraSet" API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC Series Router AC18 version 15.03.05.19(6318) **Description** The issue is related to a stack-based buffer overflow in the httpd module of the Tenda AC Series Router AC18. This occurs when handling the "/goform/SetClientState" request. Exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Tenda AC Series Router AC18 version 15.03.05.19(6318), as a temporary workaround, consider restricting access to the "/goform/SetClientState" request until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AC Series Router version AC18 V15.03.05.19(6318) **Description** The issue is related to a stack-based buffer overflow in the httpd module of the Tenda AC Series Router when handling the /goform/SetFirewallCfg request. This can potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For version AC18 V15.03.05.19(6318), as a temporary workaround, consider restricting access to the /goform/SetFirewallCfg request in the httpd module until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.