Saelo

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.4 macOS High Sierra versions prior to 10.13.5 **Description** A memory corruption issue exists due to improper memory handling, which was addressed with improved memory handling. The issue also involves an improper access check privilege escalation. **Recommendations** For iOS versions prior to 11.4, update to iOS 11.4 or later to resolve the issue. For macOS High Sierra versions prior to 10.13.5, update to macOS High Sierra 10.13.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to iOS 12 Apple Safari versions prior to tvOS 12 Apple Safari version prior to 12 Apple iTunes version prior to 12.9 for Windows Apple iCloud for Windows version prior to 7.7 **Description** A cross-site scripting issue existed in Safari, which was addressed with improved URL validation. **Recommendations** For versions prior to iOS 12, update to iOS 12 or later. For versions prior to tvOS 12, update to tvOS 12 or later. For version prior to 12 of Safari, update to Safari 12 or later. For version prior to 12.9 of iTunes for Windows, update to iTunes 12.9 or later for Windows. For version prior to 7.7 of iCloud for Windows, update to iCloud for Windows 7.7 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12 Apple tvOS versions prior to 12 Apple watchOS versions prior to 5 Apple Safari versions prior to 12 Apple iTunes for Windows versions prior to 12.9 Apple iCloud for Windows versions prior to 7.7 **Description** The issue is related to multiple memory corruption problems that have been addressed through improved memory handling. **Recommendations** For Apple iOS versions prior to 12, update to iOS 12 or later. For Apple tvOS versions prior to 12, update to tvOS 12 or later. For Apple watchOS versions prior to 5, update to watchOS 5 or later. For Apple Safari versions prior to 12, update to Safari 12 or later. For Apple iTunes for Windows versions prior to 12.9, update to iTunes 12.9 or later. For Apple iCloud for Windows versions prior to 7.7, update to iCloud for Windows 7.7 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.4 macOS versions prior to 10.13.5 tvOS versions prior to 11.4 watchOS versions prior to 4.3.1 **Description** The issue involves the `libxpc` component and allows attackers to gain privileges via a crafted app that leverages a logic error. **Recommendations** For iOS versions prior to 11.4, update to version 11.4 or later. For macOS versions prior to 10.13.5, update to version 10.13.5 or later. For tvOS versions prior to 11.4, update to version 11.4 or later. For watchOS versions prior to 4.3.1, update to version 4.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader version 9.0.0.29935 **Description** This issue allows remote attackers to disclose sensitive information on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of typed arrays due to the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this, in conjunction with other issues, to execute code in the context of the current process. **Recommendations** For Foxit Reader version 9.0.0.29935, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.3.2 Safari versions prior to 10.1.1 tvOS versions prior to 10.2.1 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 10.3.2, update to version 10.3.2 or later. For Safari versions prior to 10.1.1, update to version 10.1.1 or later. For tvOS versions prior to 10.2.1, update to version 10.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 10.3 **Description** The issue is related to a use after free vulnerability in the String.replace method in JavaScriptCore. This allows remote attackers to execute arbitrary code via a crafted web page or a crafted file. The vulnerability was demonstrated at Pwn2Own, indicating its potential for real-world exploitation. **Recommendations** For versions prior to 10.3, update to iOS 10.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** nginx versions 1.3.9 through 1.4.0 **Description** The issue allows remote attackers to cause a denial of service and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size. This triggers an integer signedness error and a stack-based buffer overflow. **Recommendations** For nginx versions 1.3.9 through 1.4.0, update to a version that fixes the integer signedness error and stack-based buffer overflow in the ngx http parse chunked function.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.4 Safari versions prior to 11.1.1 iCloud versions prior to 7.5 on Windows iTunes versions prior to 12.7.5 on Windows tvOS versions prior to 11.4 watchOS versions prior to 4.3.1 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 11.4, update to version 11.4 or later. For Safari versions prior to 11.1.1, update to version 11.1.1 or later. For iCloud versions prior to 7.5 on Windows, update to version 7.5 or later. For iTunes versions prior to 12.7.5 on Windows, update to version 12.7.5 or later. For tvOS versions prior to 11.4, update to version 11.4 or later. For watchOS versions prior to 4.3.1, update to version 4.3.1 or later.