Xiaofeng Wang

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions prior to 11.0.1 macOS Big Sur versions prior to 11.1 tvOS versions prior to 14.0 macOS Catalina versions prior to Security Update 2020-001 macOS Mojave versions prior to Security Update 2020-007 watchOS versions prior to 7.0 iOS versions prior to 14.0 iPadOS versions prior to 14.0 **Description** This issue was addressed with improved setting propagation. An attacker in a privileged network position may be able to unexpectedly alter application state. **Recommendations** For macOS Big Sur versions prior to 11.0.1, update to macOS Big Sur 11.0.1 or later. For macOS Big Sur versions prior to 11.1, update to macOS Big Sur 11.1 or later. For tvOS versions prior to 14.0, update to tvOS 14.0 or later. For macOS Catalina versions prior to Security Update 2020-001, apply Security Update 2020-001 or later. For macOS Mojave versions prior to Security Update 2020-007, apply Security Update 2020-007 or later. For watchOS versions prior to 7.0, update to watchOS 7.0 or later. For iOS versions prior to 14.0, update to iOS 14.0 or later. For iPadOS versions prior to 14.0, update to iPadOS 14.0 or later.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 11 Description: An issue in certain Apple products involves the `Sandbox Profiles` component, allowing attackers to determine whether arbitrary files exist via a crafted app. Recommendations: For iOS versions prior to 11, update to a version 11 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 11 macOS versions prior to 10.13 tvOS versions prior to 11 watchOS versions prior to 4 Description: The issue involves the Kernel component and allows attackers to obtain sensitive network-activity information about arbitrary apps via a crafted app. Recommendations: For iOS versions prior to 11, update to version 11 or later. For macOS versions prior to 10.13, update to version 10.13 or later. For tvOS versions prior to 11, update to version 11 or later. For watchOS versions prior to 4, update to version 4 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.1 macOS versions prior to 10.13.1 tvOS versions prior to 11.1 watchOS versions prior to 4.1 **Description** The issue involves the Kernel component and allows attackers to monitor arbitrary apps via a crafted app that accesses process information at a high rate. **Recommendations** For iOS versions prior to 11.1, update to version 11.1 or later. For macOS versions prior to 10.13.1, update to version 10.13.1 or later. For tvOS versions prior to 11.1, update to version 11.1 or later. For watchOS versions prior to 4.1, update to version 4.1 or later.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.4 Android versions 5.0.x through 5.0.2 Android versions 5.1.x through 5.1.1 Android versions 6.x before 2016-04-01 **Description** The issue allows attackers to bypass private-storage file-access restrictions via a crafted application that changes a symlink target. This can be demonstrated by obtaining Signature or SignatureOrSystem access. The vulnerability exists due to insufficient checking of the state of a shared resource, which can be exploited by a local attacker to bypass existing restrictions on access to private files using a specially crafted application that changes a link. **Recommendations** For Android versions 4.x through 4.4.4, update to version 4.4.4 or later. For Android versions 5.0.x through 5.0.2, update to version 5.0.2 or later. For Android versions 5.1.x through 5.1.1, update to version 5.1.1 or later. For Android versions 6.x before 2016-04-01, update to a version released after 2016-04-01.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.2 tvOS versions prior to 9.1 **Description** The issue is related to improper interaction between Keychain Access and Keychain Agent. This allows attackers to spoof the Keychain Server, potentially enabling remote attackers to substitute the Keychain Server. **Recommendations** For Apple OS X versions prior to 10.11.2, update to version 10.11.2 or later. For tvOS versions prior to 9.1, update to version 9.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11 **Description** The issue is related to improper validation of iCloud keychain item ACLs in the Apple Online Store Kit. This allows attackers to obtain access to keychain items via a crafted app. The vulnerability can be exploited by a remote attacker using a specially formed application to gain access to keychain item management. **Recommendations** For versions prior to 10.11, update to version 10.11 or later to resolve the issue. As a temporary workaround, consider restricting access to keychain items to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9 **Description** The issue is related to a lack of protection for service data in the iOS operating system. It allows a remote attacker to obtain sensitive information about inter-app communication via a crafted app that conducts an interception attack. The attack involves an unspecified URL scheme and can provide access to protected information. **Recommendations** For Apple iOS versions prior to 9, update to version 9 or later to resolve the issue. As a temporary workaround, consider restricting the installation of third-party apps to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OS X versions prior to 10.10.5 **Description** The issue is related to the Bluetooth subsystem, which does not properly restrict access to certain data. This allows attackers to read Notification Center notifications of paired devices using a crafted app. The estimated number of potentially affected devices and details about real-world incidents are not provided. **Recommendations** For OS X versions prior to 10.10.5, update to version 10.10.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Notification Center Service to minimize the risk of exploitation.