Wish Wu

The issue allows a 3D model constructed to look like the enrolled user to authenticate via Face ID. This is due to inadequate anti-spoofing models. The estimated number of potentially affected devices worldwide is not specified.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.5 iPadOS versions prior to 14.5 macOS Big Sur versions prior to 11.3 Description: The issue involves an out-of-bounds read that has been addressed through improved input validation. A malicious application may be able to execute arbitrary code with kernel privileges. Recommendations: For iOS versions prior to 14.5, update to iOS 14.5 or later. For iPadOS versions prior to 14.5, update to iPadOS 14.5 or later. For macOS Big Sur versions prior to 11.3, update to macOS Big Sur 11.3 or later.

The device has an improper authentication issue where it does not sufficiently validate certain credentials of a user's face. An attacker could craft the credential of the user, and a successful exploit could allow the attacker to pass the authentication with the crafted credential.

The issue allowed a 3D model constructed to look like the enrolled user to authenticate via Face ID. This was addressed by improving Face ID machine learning models.

A remote code execution issue in libgdx could allow an attacker to execute arbitrary code in the context of an unprivileged process by using a specially crafted file. This issue is considered High due to the possibility of remote code execution in an application that uses this library.

An elevation of privilege issue in Mediaserver could allow a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application.

The issue allows attackers to obtain sensitive information via a crafted application due to the lack of validation of EFFECT CMD SET PARAM and EFFECT CMD SET PARAM DEFERRED commands in the mediaserver.

The issue allows attackers to gain privileges via a crafted application.

The issue is related to insufficient access control in the Qualcomm ARM component of the Android operating system. It can be exploited by a local attacker using a specially crafted application to gain elevated privileges.

The issue is related to a component of the Qualcomm performance in Android, which has inadequate access control. This allows attackers to gain privileges via a crafted application.