Wojciech Regula

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.8.3 macOS Sequoia versions prior to 15.7.3 **Description** An issue existed where an application could potentially access protected user data due to insufficient private data redaction in log entries. **Recommendations** Update macOS to version 14.8.3. Update macOS to version 15.7.3.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Tahoe 26.2 Safari versions prior to 26.2 **Description** An application could potentially access sensitive user data due to insufficient permissions checks. The issue was resolved by implementing additional permissions checks. **Recommendations** Update macOS to version Tahoe 26.2. Update Safari to version 26.2.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.1 iPadOS versions prior to 26.1 **Description** A flaw exists due to insufficient data redaction in logging mechanisms. This could allow an application to access sensitive user data. **Recommendations** Update to iOS version 26.1. Update to iPadOS version 26.1.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15.6 macOS versions prior to 14.7.7 macOS versions prior to 13.7.7 **Description** A malicious application functioning as an HTTPS proxy could potentially gain access to sensitive user data due to insufficient access restrictions. The issue was resolved by enhancing access controls. **Recommendations** Update macOS to version 15.6. Update macOS to version 14.7.7. Update macOS to version 13.7.7.

**Name of the Vulnerable Software and Affected Versions** iPadOS versions prior to 17.7.7 iOS versions prior to 18.4 iPadOS versions prior to 18.4 **Description** A permissions issue was addressed with additional restrictions. An app may be able to read a persistent device identifier. **Recommendations** For iPadOS versions prior to 17.7.7, update to iPadOS 17.7.7 to resolve the issue. For iOS versions prior to 18.4, update to iOS 18.4 to resolve the issue. For iPadOS versions prior to 18.4, update to iPadOS 18.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15.4 **Description** A permissions issue was addressed with additional restrictions. This issue may allow an app to read sensitive location information. **Recommendations** For versions prior to 15.4, update to macOS Sequoia 15.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 18.1 visionOS versions prior to 2.1 tvOS versions prior to 18.1 iOS versions prior to 18.1 iPadOS versions prior to 18.1 watchOS versions prior to 11.1 **Description** A cookie management issue was addressed with improved state management. Cookies belonging to one origin may be sent to another origin. **Recommendations** For Safari versions prior to 18.1, update to Safari 18.1 to resolve the issue. For visionOS versions prior to 2.1, update to visionOS 2.1 to resolve the issue. For tvOS versions prior to 18.1, update to tvOS 18.1 to resolve the issue. For iOS versions prior to 18.1, update to iOS 18.1 to resolve the issue. For iPadOS versions prior to 18.1, update to iPadOS 18.1 to resolve the issue. For watchOS versions prior to 11.1, update to watchOS 11.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15 iOS versions prior to 18 iPadOS versions prior to 18 **Description** A permissions issue allowed a malicious app with root privileges to potentially access keyboard input and location information without user consent. **Recommendations** For macOS versions prior to 15, update to macOS Sequoia 15. For iOS versions prior to 18, update to iOS 18. For iPadOS versions prior to 18, update to iPadOS 18.

**Name of the Vulnerable Software and Affected Versions** Xcode versions prior to 16 **Description** The issue allows an app to potentially inherit Xcode permissions, enabling access to user data due to inadequate permissions checking. **Recommendations** For versions prior to 16, update to Xcode 16 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15 **Description** A permissions issue was addressed with additional restrictions, which may have allowed an app to access a user's Photos Library. **Recommendations** For versions prior to 15, update to macOS Sequoia 15 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 15 **Description** A permissions issue was addressed with additional restrictions, which may have allowed an app to access protected user data. **Recommendations** For versions prior to 15, update to macOS Sequoia 15 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 10.6 macOS Sonoma versions prior to 14.6 iOS versions prior to 17.6 iPadOS versions prior to 17.6 tvOS versions prior to 17.6 **Description** The issue allows an app to bypass Privacy preferences. This was addressed through improved state management. **Recommendations** For watchOS versions prior to 10.6, update to watchOS 10.6. For macOS Sonoma versions prior to 14.6, update to macOS Sonoma 14.6. For iOS versions prior to 17.6, update to iOS 17.6. For iPadOS versions prior to 17.6, update to iPadOS 17.6. For tvOS versions prior to 17.6, update to tvOS 17.6.

**Name of the Vulnerable Software and Affected Versions** Apple tvOS versions prior to 17.4 Apple iOS versions prior to 17.4 Apple iPadOS versions prior to 17.4 Apple macOS Sonoma versions prior to 14.4 Apple watchOS versions prior to 10.4 **Description** A logic issue was addressed with improved restrictions, which may have allowed an app to access user-sensitive data. **Recommendations** For Apple tvOS versions prior to 17.4, update to tvOS 17.4 to resolve the issue. For Apple iOS versions prior to 17.4, update to iOS 17.4 to resolve the issue. For Apple iPadOS versions prior to 17.4, update to iPadOS 17.4 to resolve the issue. For Apple macOS Sonoma versions prior to 14.4, update to macOS Sonoma 14.4 to resolve the issue. For Apple watchOS versions prior to 10.4, update to watchOS 10.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.4 **Description** This issue was addressed by removing the vulnerable code. Processing malicious input may lead to code execution. **Recommendations** For macOS Sonoma versions prior to 14.4, update to macOS Sonoma 14.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** tvOS versions prior to 17.4 iOS versions prior to 17.4 iPadOS versions prior to 17.4 macOS Sonoma versions prior to 14.4 watchOS versions prior to 10.4 **Description** A privacy issue was addressed with improved private data redaction for log entries. A malicious app may be able to observe user data in log entries related to accessibility notifications. **Recommendations** For tvOS versions prior to 17.4, update to tvOS 17.4 to resolve the issue. For iOS versions prior to 17.4, update to iOS 17.4 to resolve the issue. For iPadOS versions prior to 17.4, update to iPadOS 17.4 to resolve the issue. For macOS Sonoma versions prior to 14.4, update to macOS Sonoma 14.4 to resolve the issue. For watchOS versions prior to 10.4, update to watchOS 10.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 17.4 Apple iPadOS versions prior to 17.4 Apple tvOS versions prior to 17.4 Apple macOS Sonoma versions prior to 14.4 Apple watchOS versions prior to 10.4 **Description** An app may be able to elevate privileges. This issue was addressed by removing the vulnerable code. **Recommendations** For Apple iOS versions prior to 17.4, update to iOS 17.4 to resolve the issue. For Apple iPadOS versions prior to 17.4, update to iPadOS 17.4 to resolve the issue. For Apple tvOS versions prior to 17.4, update to tvOS 17.4 to resolve the issue. For Apple macOS Sonoma versions prior to 14.4, update to macOS Sonoma 14.4 to resolve the issue. For Apple watchOS versions prior to 10.4, update to watchOS 10.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 16.6 iPadOS versions prior to 16.6 **Description** The issue allows an app to potentially access sensitive user data due to inadequate validation of environment variables. This was addressed with improved validation. **Recommendations** For iOS versions prior to 16.6, update to iOS 16.6 to resolve the issue. For iPadOS versions prior to 16.6, update to iPadOS 16.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14.2 macOS versions prior to 13.6.3 macOS versions prior to 12.7.2 iOS versions prior to 17.2 iOS versions prior to 16.7.3 iPadOS versions prior to 17.2 iPadOS versions prior to 16.7.3 tvOS (affected versions not specified) **Description** The issue is related to insufficient protection of service data in the Find My component of macOS, iOS, iPadOS, and tvOS operating systems. Exploitation of this issue may allow an attacker to gain unauthorized access to protected information. An app may be able to read sensitive location information due to this issue. **Recommendations** For macOS versions prior to 14.2, update to macOS Sonoma 14.2. For macOS versions prior to 13.6.3, update to macOS Ventura 13.6.3. For macOS versions prior to 12.7.2, update to macOS Monterey 12.7.2. For iOS versions prior to 17.2, update to iOS 17.2. For iOS versions prior to 16.7.3, update to iOS 16.7.3. For iPadOS versions prior to 17.2, update to iPadOS 17.2. For iPadOS versions prior to 16.7.3, update to iPadOS 16.7.3. As a temporary workaround for tvOS, consider restricting access to sensitive location information until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GarageBand versions prior to 10.4.9 **Description** This issue was addressed with improved validation of the process entitlement and Team ID. An app may be able to gain root privileges. The problem was solved by better checking the process entitlement and Team ID. **Recommendations** For GarageBand versions prior to 10.4.9, update to version 10.4.9 to resolve the issue. As a temporary workaround, consider restricting access to sensitive features that may allow an app to gain root privileges until the update is applied.

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions prior to 14.1 iOS versions prior to 17.1 iPadOS versions prior to 17.1 **Description** A privacy issue was addressed with improved private data redaction for log entries. This issue may allow an app to access sensitive user data. The vulnerability is related to the disclosure of information through registration files in the Contacts component of iOS, macOS, and iPadOS operating systems. **Recommendations** For macOS Sonoma versions prior to 14.1, update to version 14.1 to resolve the issue. For iOS versions prior to 17.1, update to version 17.1 to resolve the issue. For iPadOS versions prior to 17.1, update to version 17.1 to resolve the issue.