Wojciech Reguła

Name of the Vulnerable Software and Affected Versions: Logitech Options Plus version 1.60.496306 Description: The issue is related to improper control of generation of code, also known as 'code injection', in Electron Fuses within Logitech Options Plus on macOS. This allows attackers to execute arbitrary code via an insecure Electron Fuses configuration. Recommendations: For Logitech Options Plus version 1.60.496306, consider disabling the Electron Fuses configuration until a patch is available to prevent the execution of arbitrary code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Notion versions prior to 3.1.0 **Description** The issue might allow code execution because of RunAsNode and enableNodeClilnspectArguments. The vendor states that the attacker must launch the Notion Desktop application with nonstandard flags that turn the Electron-based application into a Node.js execution environment. **Recommendations** For Notion versions prior to 3.1.0, consider disabling the RunAsNode and enableNodeClilnspectArguments components as a temporary workaround until a patch is available. Restrict access to the Notion Desktop application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Asana Desktop version 2.1.0 **Description** The issue allows code injection due to specific Electron Fuses, with inadequate protection against code injection through settings such as `RunAsNode` and `EnableNodeCliInspectArguments`. This can be exploited using r3ggi/electroniz3r to perform an attack. **Recommendations** For Asana Desktop version 2.1.0, consider disabling the `RunAsNode` and `EnableNodeCliInspectArguments` settings as a temporary workaround until a patch is available. Restrict access to the Electron Fuses to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 17 iPadOS versions prior to 17 macOS versions prior to Sonoma 14 **Description** The issue allows an app to potentially access Notes attachments due to insufficient restriction of data container access. This was addressed with improved access restrictions. **Recommendations** For iOS versions prior to 17, update to iOS 17 to resolve the issue. For iPadOS versions prior to 17, update to iPadOS 17 to resolve the issue. For macOS versions prior to Sonoma 14, update to macOS Sonoma 14 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 9.5 macOS Ventura versions prior to 13.4 macOS Big Sur versions prior to 11.7.7 macOS Monterey versions prior to 12.6.6 iOS versions prior to 16.5 iPadOS versions prior to 16.5 **Description** A logic issue was addressed with improved checks, which may allow an app to bypass Gatekeeper checks. The issue is related to errors in security settings of the LaunchServices service in MacOS, iOS, iPadOS, and watchOS operating systems. This could potentially impact the confidentiality, integrity, and availability of protected information. **Recommendations** For watchOS versions prior to 9.5, update to watchOS 9.5. For macOS Ventura versions prior to 13.4, update to macOS Ventura 13.4. For macOS Big Sur versions prior to 11.7.7, update to macOS Big Sur 11.7.7. For macOS Monterey versions prior to 12.6.6, update to macOS Monterey 12.6.6. For iOS versions prior to 16.5, update to iOS 16.5. For iPadOS versions prior to 16.5, update to iPadOS 16.5.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.6.3 macOS Big Sur versions prior to 11.7.3 macOS Monterey versions prior to 12.6.3 macOS Ventura versions prior to 13.2 watchOS versions prior to 9.3 iOS versions prior to 15.7.3 iOS versions prior to 16.3 iPadOS versions prior to 15.7.3 iPadOS versions prior to 16.3 **Description** A privacy issue was addressed with improved private data redaction for log entries. This issue may allow an app to access information about a user’s contacts. **Recommendations** For macOS Big Sur version prior to 11.7.3, update to version 11.7.3 or later. For macOS Monterey version prior to 12.6.3, update to version 12.6.3 or later. For macOS Ventura version prior to 13.2, update to version 13.2 or later. For watchOS version prior to 9.3, update to version 9.3 or later. For iOS version prior to 15.7.3, update to version 15.7.3 or later. For iOS version prior to 16.3, update to version 16.3 or later. For iPadOS version prior to 15.7.3, update to version 15.7.3 or later. For iPadOS version prior to 16.3, update to version 16.3 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 15.7.2 iPadOS versions prior to 15.7.2 macOS Ventura versions prior to 13.1 iOS versions prior to 16.2 iPadOS versions prior to 16.2 **Description** A logic issue was addressed with improved restrictions, which may allow an app to read sensitive location information. **Recommendations** For iOS versions prior to 15.7.2, update to iOS 15.7.2 or later. For iPadOS versions prior to 15.7.2, update to iPadOS 15.7.2 or later. For macOS Ventura versions prior to 13.1, update to macOS Ventura 13.1 or later. For iOS versions prior to 16.2, update to iOS 16.2 or later. For iPadOS versions prior to 16.2, update to iPadOS 16.2 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 16.2 iPadOS versions prior to 16.2 macOS Ventura versions prior to 13.1 tvOS versions prior to 16.2 watchOS versions prior to 9.2 **Description** The issue allows an app to bypass Privacy preferences. It was addressed by enabling hardened runtime. **Recommendations** For iOS versions prior to 16.2, update to iOS 16.2 or later. For iPadOS versions prior to 16.2, update to iPadOS 16.2 or later. For macOS Ventura versions prior to 13.1, update to macOS Ventura 13.1 or later. For tvOS versions prior to 16.2, update to tvOS 16.2 or later. For watchOS versions prior to 9.2, update to watchOS 9.2 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13 **Description** A permissions issue existed, allowing a malicious application to potentially read sensitive location information. This issue was addressed with improved permission validation. **Recommendations** For versions prior to 13, update to macOS Ventura 13 to resolve the issue. As a temporary workaround, consider restricting access to sensitive location information until the update is applied.

**Name of the Vulnerable Software and Affected Versions** macOS Monterey versions prior to 12.6.3 macOS Big Sur versions prior to 11.7.3 macOS Ventura version 13 is not affected as it already includes the fix, but versions prior to 13 are affected. However, since the exact affected range for Ventura is not specified, we consider all versions prior to the mentioned fixed versions as vulnerable. **Description** An access issue was addressed with improved access restrictions. An app may be able to access mail folder attachments through a temporary directory used during compression. **Recommendations** For macOS Monterey versions prior to 12.6.3, update to macOS Monterey 12.6.3 to resolve the issue. For macOS Big Sur versions prior to 11.7.3, update to macOS Big Sur 11.7.3 to resolve the issue. For macOS Ventura, if you are using a version prior to 13, update to macOS Ventura 13 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13 **Description** An access issue was addressed with additional sandbox restrictions. This issue allows an app to potentially break out of its sandbox. **Recommendations** For versions prior to 13, update to macOS Ventura 13 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.6 macOS Big Sur versions prior to 11.7 **Description** A user may be able to view sensitive user information due to this issue. The estimated number of potentially affected devices worldwide is not specified. This issue was addressed by enabling hardened runtime. **Recommendations** For macOS versions prior to 12.6, update to macOS Monterey 12.6 to resolve the issue. For macOS Big Sur versions prior to 11.7, update to macOS Big Sur 11.7 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.7 macOS versions prior to 12.6 **Description** A configuration issue was addressed with additional restrictions, which may have allowed an app to access user-sensitive data. **Recommendations** For macOS versions prior to 11.7, update to macOS Big Sur 11.7 to resolve the issue. For macOS versions prior to 12.6, update to macOS Monterey 12.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.5 **Description** The issue allows an app to potentially access user-sensitive data. It was addressed by enabling hardened runtime. **Recommendations** For versions prior to 12.5, update to macOS Monterey 12.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.4 macOS Big Sur versions prior to 11.6.6 **Description** The issue allows a malicious application to bypass Privacy preferences. This was addressed with additional permissions checks. **Recommendations** For macOS versions prior to 12.4, update to macOS Monterey 12.4 to resolve the issue. For macOS Big Sur versions prior to 11.6.6, update to macOS Big Sur 11.6.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.4 iOS versions prior to 15.5 iPadOS versions prior to 15.5 macOS Big Sur versions prior to 11.6.8 macOS Catalina versions prior to Security Update 2022-005 **Description** The issue allows an app with root privileges to potentially access private information. This was addressed by enabling hardened runtime. **Recommendations** For macOS versions prior to 12.4, update to macOS Monterey 12.4 or later. For iOS versions prior to 15.5, update to iOS 15.5 or later. For iPadOS versions prior to 15.5, update to iPadOS 15.5 or later. For macOS Big Sur versions prior to 11.6.8, update to macOS Big Sur 11.6.8 or later. For macOS Catalina versions prior to Security Update 2022-005, apply Security Update 2022-005 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.4 **Description** This issue was addressed with improved checks. A plug-in may be able to inherit the application's permissions and access user data. **Recommendations** For versions prior to 12.4, update to macOS Monterey 12.4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive user data until the update is applied.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.4 **Description** This issue was addressed with improved checks. A plug-in may be able to inherit the application's permissions and access user data. **Recommendations** For versions prior to 12.4, update to macOS Monterey 12.4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive user data until the update is applied.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.4 **Description** The issue allows an app with root privileges to potentially access private information. This was addressed by enabling hardened runtime. **Recommendations** For versions prior to 12.4, update to macOS Monterey 12.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.4 **Description** The issue concerns the handling of environment variables, which has been addressed with improved validation. A user may be able to view sensitive user information due to this issue. **Recommendations** For versions prior to 12.4, update to macOS Monterey 12.4 to resolve the issue.