Qidan He

**Name of the Vulnerable Software and Affected Versions** TvSettings (affected versions not specified) **Description** A TOCTOU race condition exists in `AppRestrictionsFragment.java` that allows an attacker to start a malicious activity within the Settings application's system-uid context, leading to the potential for launching any application. This occurs because of a time window between the verification of an `Intent` and its subsequent use, enabling manipulation of the target component's state and bypassing the original security checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung mobile devices with N(7.x) software Samsung mobile devices with O(8.x) software Samsung mobile devices with P(9.0) software **Description** The issue allows a malicious application to create privileged files through the FotaAgent component. This could potentially lead to unauthorized access or modifications to sensitive data. **Recommendations** For Samsung mobile devices with N(7.x) software, update to a version that includes the fix for this issue. For Samsung mobile devices with O(8.x) software, update to a version that includes the fix for this issue. For Samsung mobile devices with P(9.0) software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the privileges of the FotaAgent component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.3 macOS versions prior to 10.12.4 tvOS versions prior to 10.2 watchOS versions prior to 3.2 **Description** The issue involves the `ImageIO` component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted image file. This is caused by a buffer overflow in memory. **Recommendations** For iOS versions prior to 10.3, update to version 10.3 or later. For macOS versions prior to 10.12.4, update to version 10.12.4 or later. For tvOS versions prior to 10.2, update to version 10.2 or later. For watchOS versions prior to 3.2, update to version 3.2 or later. As a temporary workaround, consider restricting the use of the `ImageIO` component until a patch is available. Avoid using crafted image files that could exploit this issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.2 macOS versions prior to 10.12.2 watchOS versions prior to 3.1.3 **Description** The issue involves the `IOKit` component and allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. It is related to the lack of protection for service data, which can be exploited by a local attacker to access protected information about the kernel memory structure. **Recommendations** For iOS versions prior to 10.2, update to version 10.2 or later. For macOS versions prior to 10.12.2, update to version 10.12.2 or later. For watchOS versions prior to 3.1.3, update to version 3.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.12.2 **Description** The issue involves the `IOSurface` component and allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. This is related to a lack of protection for service data, which can be exploited by a local attacker to access protected information about the kernel memory scheme. **Recommendations** For macOS versions prior to 10.12.2, update to version 10.12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `IOSurface` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.12.2 **Description** The issue involves the `IOAcceleratorFamily` component and allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. This is related to a lack of protection for service data, which can be exploited by a local attacker to access protected kernel memory scheme information. **Recommendations** For macOS versions prior to 10.12.2, update to version 10.12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `IOAcceleratorFamily` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.12.2 **Description** The issue involves the `IOKit` component and allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. This is related to a lack of protection for service data, which can be exploited by a local attacker to access protected kernel memory scheme information. **Recommendations** For macOS versions prior to 10.12.2, update to version 10.12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `IOKit` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 **Description** A remote code execution issue in the Framesequence library could allow an attacker to execute arbitrary code using a specially crafted file. This issue is related to inadequate access control in the library. The problem can be exploited by a remote attacker to execute code in the context of an unprivileged process. **Recommendations** For Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.12 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service due to memory corruption via a crafted app. It is related to a buffer overflow privilege escalation vulnerability in the AppleHSSPIHIDDriver. **Recommendations** For versions prior to 10.12, update to version 10.12 or later to resolve the issue. As a temporary workaround, consider restricting access to privileged contexts to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Android versions 5.x **Description** The issue is related to insufficient access control in the PowerNotificationWarnings.java file, allowing attackers to bypass the DEVICE POWER permission requirement. This can be achieved by sending a broadcast intent with the `PNW.stopSaver` action. There is no information about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For Android version 5.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-08-01 **Description** The issue is related to the Android operating system's API framework, which lacks guarantees that package data originated from the Package Manager. This allows a remote attacker to bypass protection mechanisms using a specially crafted application. **Recommendations** For Android versions 4.x through 4.4.3, update to version 4.4.4 or later. For Android versions 5.0.x through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.x through 5.1.0, update to version 5.1.1 or later. For Android versions 6.x before 2016-08-01, update to a version released on or after 2016-08-01.

**Name of the Vulnerable Software and Affected Versions** Intel Graphics Driver in Apple OS X versions prior to 10.11.5 **Description** The issue is related to errors in security settings of the Intel Graphics Driver component in Mac OS X, allowing a remote attacker to obtain sensitive kernel memory-layout information using a specially crafted app. **Recommendations** For versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.5 **Description** The issue is related to a buffer overflow in the IOAcceleratorFamily component, which can be exploited by attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. This can be achieved by a remote attacker using a specially crafted application. **Recommendations** For Apple OS X versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the IOAcceleratorFamily component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 2016-02-01 **Description** The issue is caused by an integer overflow in the BnCrypto::onTransact function, allowing attackers to obtain sensitive information and bypass an unspecified protection mechanism by triggering an improper size calculation. This can be exploited to obtain Signature or SignatureOrSystem access. **Recommendations** For Android versions prior to 2016-02-01, update to a version released after 2016-02-01 to resolve the issue. As a temporary workaround, consider restricting access to the BnCrypto::onTransact function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 5.1.1 LMY48Z Android versions prior to 6.0 before 2015-12-01 **Description** The issue is related to the libstagefright library in the Android operating system and is caused by a lack of protection for service data. It allows a remote attacker to obtain sensitive information and bypass an unspecified protection mechanism. The attacker can gain Signature or SignatureOrSystem access via unknown vectors. **Recommendations** For Android versions prior to 5.1.1 LMY48Z, update to version 5.1.1 LMY48Z or later. For Android versions prior to 6.0 before 2015-12-01, update to version 6.0 from 2015-12-01 or later.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 5.1.1 LMY48Z Android versions prior to 6.0 2015-12-01 **Description** The issue allows attackers to obtain sensitive information and bypass an unspecified protection mechanism via unknown vectors. This can be demonstrated by obtaining Signature or SignatureOrSystem access. The vulnerability is related to the lack of protection for service data, which can allow a remote attacker to obtain confidential information or bypass protection mechanisms. **Recommendations** For Android versions prior to 5.1.1 LMY48Z, update to version 5.1.1 LMY48Z or later. For Android versions prior to 6.0 2015-12-01, update to version 6.0 2015-12-01 or later.