Wmliang

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 11.5 macOS Sonoma versions prior to 14.7.6 tvOS versions prior to 18.5 iPadOS versions prior to 17.7.7 iOS versions prior to 18.5 iPadOS versions prior to 18.5 macOS Sequoia versions prior to 15.5 visionOS versions prior to 2.5 macOS Ventura versions prior to 13.7.6 **Description** The issue was addressed with improved memory handling. An attacker may be able to cause unexpected system termination or corrupt kernel memory. This flaw allows local attackers to escalate privileges and potentially execute arbitrary code with kernel-level access. **Recommendations** Update to watchOS 11.5 or later Update to macOS Sonoma 14.7.6 or later Update to tvOS 18.5 or later Update to iPadOS 17.7.7 or later Update to iOS 18.5 or later Update to iPadOS 18.5 or later Update to macOS Sequoia 15.5 or later Update to visionOS 2.5 or later Update to macOS Ventura 13.7.6 or later

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 11.5 macOS Sonoma versions prior to 14.7.6 tvOS versions prior to 18.5 iPadOS versions prior to 17.7.7 iOS versions prior to 18.5 iPadOS versions prior to 18.5 macOS Sequoia versions prior to 15.5 visionOS versions prior to 2.5 macOS Ventura versions prior to 13.7.6 **Description** A double free issue was addressed with improved memory management. This issue may allow a remote attacker to cause an unexpected app termination. **Recommendations** For watchOS versions prior to 11.5, update to watchOS 11.5. For macOS Sonoma versions prior to 14.7.6, update to macOS Sonoma 14.7.6. For tvOS versions prior to 18.5, update to tvOS 18.5. For iPadOS versions prior to 17.7.7, update to iPadOS 17.7.7. For iOS versions prior to 18.5, update to iOS 18.5. For iPadOS versions prior to 18.5, update to iPadOS 18.5. For macOS Sequoia versions prior to 15.5, update to macOS Sequoia 15.5. For visionOS versions prior to 2.5, update to visionOS 2.5. For macOS Ventura versions prior to 13.7.6, update to macOS Ventura 13.7.6.

**Name of the Vulnerable Software and Affected Versions** oFono (affected versions not specified) **Description** This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** oFono (affected versions not specified) **Description** This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** oFono (affected versions not specified) **Description** This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** oFono (affected versions not specified) **Description** This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** oFono (affected versions not specified) **Description** This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** BlueZ (affected versions not specified) **Description** This issue allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this issue, as the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** BlueZ (affected versions not specified) **Description** This issue allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this issue, as the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other issues to execute arbitrary code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** BlueZ (affected versions not specified) **Description** This issue allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this issue, as the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** BlueZ (affected versions not specified) **Description** This issue allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this issue, as the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A flaw was found in the Netfilter subsystem in the Linux kernel. The `sctp mt check` did not validate the `flag count` field. This flaw allows a local privileged (CAP NET ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Bluetooth A2DP driver (affected versions not specified) **Description** The issue is related to insufficient access restrictions in the Windows Bluetooth A2DP driver, allowing a remote attacker to exploit the vulnerability and elevate their privileges. This can affect the system, potentially leading to unauthorized access or control. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A flaw was found in the XFRM subsystem in the Linux kernel, specifically within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP NET ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BlueZ (affected versions not specified) **Description** The issue is related to a heap-based buffer overflow in the Phone Book Access profile of BlueZ, which can be exploited by network-adjacent attackers to execute arbitrary code on affected installations. User interaction is required, as the target must connect to a malicious Bluetooth device. The flaw exists due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This allows an attacker to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BlueZ (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this issue, where the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this issue to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** BlueZ (affected versions not specified) **Description** The issue is related to a heap-based buffer overflow in the Phone Book Access profile of BlueZ, allowing network-adjacent attackers to execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, where the target must connect to a malicious Bluetooth device. The flaw exists due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer, enabling an attacker to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** The issue is related to an out-of-bounds read vulnerability in the SR-IPv6 implementation in the Linux kernel, specifically within the processing of seg6 attributes. This flaw results from the improper validation of user-supplied data, allowing a read past the end of an allocated buffer. A privileged local user can exploit this to disclose sensitive information on affected installations of the Linux kernel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MySQL Cluster versions 7.4.35 and prior MySQL Cluster versions 7.5.25 and prior MySQL Cluster versions 7.6.21 and prior MySQL Cluster versions 8.0.28 and prior **Description** The issue allows a high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service of MySQL Cluster. **Recommendations** For MySQL Cluster versions 7.4.35 and prior, update to a version later than 7.4.35. For MySQL Cluster versions 7.5.25 and prior, update to a version later than 7.5.25. For MySQL Cluster versions 7.6.21 and prior, update to a version later than 7.6.21. For MySQL Cluster versions 8.0.28 and prior, update to a version later than 8.0.28. At the moment, there is no information about a newer version that contains a fix for this vulnerability.