Snoolie Keffaber

A race condition was addressed with improved locking. Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files. The issue is related to the libAppleArchive library and may enable attackers to achieve arbitrary file writes on macOS and iOS systems, with the added potential of bypassing Apple’s Gatekeeper protections.

A path handling issue was addressed with improved validation, which may allow a remote attacker to gain unauthorized access to confidential data. The issue is related to incorrect restriction of the path name to a directory with limited access. A shortcut may output sensitive user data without consent.