Xisigr

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 79.0.3945.79 **Description** The issue is related to insufficient policy enforcement in Omnibox, allowing a remote attacker to perform domain spoofing via IDN homographs using a crafted domain name. This can potentially compromise data integrity due to inadequate input validation. **Recommendations** For versions prior to 79.0.3945.79, update to version 79.0.3945.79 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.1.1 Safari versions prior to 12.0.2 iTunes versions prior to 12.9.2 for Windows iCloud for Windows versions prior to 7.9 Description: A logic issue was addressed with improved validation. Recommendations: For iOS versions prior to 12.1.1, update to iOS 12.1.1 or later. For Safari versions prior to 12.0.2, update to Safari 12.0.2 or later. For iTunes versions prior to 12.9.2 for Windows, update to iTunes 12.9.2 or later for Windows. For iCloud for Windows versions prior to 7.9, update to iCloud for Windows 7.9 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.4.1 Safari versions prior to 11.1.2 **Description** An inconsistent user interface issue was addressed with improved state management. **Recommendations** For iOS versions prior to 11.4.1, update to iOS 11.4.1 or later. For Safari versions prior to 11.1.2, update to Safari 11.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 12 **Description** An inconsistent user interface issue was addressed with improved state management. **Recommendations** For versions prior to Safari 12, update to Safari 12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 70.0.3538.67 **Description** The issue is related to incorrect handling of history on iOS in Navigation, which can be exploited by a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This can allow an attacker to substitute the displayed address URI. **Recommendations** For versions prior to 70.0.3538.67, update to version 70.0.3538.67 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted HTML pages that could exploit this issue until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 66.0.3359.117 **Description** The issue concerns incorrect handling of asynchronous methods in Fullscreen mode, allowing a remote attacker to enter full screen without displaying a warning via a crafted HTML page. This can lead to spoofing the fullscreen UI, potentially deceiving users. **Recommendations** For Google Chrome versions prior to 66.0.3359.117, update to version 66.0.3359.117 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 11.1 **Description** An issue in Safari allows remote attackers to spoof the address bar via a crafted web site, involving the Safari component. **Recommendations** For versions prior to 11.1, update to version 11.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 11.3 **Description** The issue involves the Safari component and allows remote attackers to spoof the user interface via a crafted web site. **Recommendations** For versions prior to 11.3, update to version 11.3 or later to resolve the issue. As a temporary workaround, consider restricting access to suspicious web sites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.4.1 watchOS versions prior to 4.3.2 tvOS versions prior to 11.4.1 Safari versions prior to 11.1.1 macOS High Sierra versions prior to 10.13.6 **Description** A spoofing issue existed in the handling of URLs, which was addressed with improved input validation. The issue is also related to the incorrect handling of Unicode symbols in Safari, allowing a remote attacker to perform a homographic attack and substitute the content of a resource. **Recommendations** For iOS versions prior to 11.4.1, update to version 11.4.1 or later. For watchOS versions prior to 4.3.2, update to version 4.3.2 or later. For tvOS versions prior to 11.4.1, update to version 11.4.1 or later. For Safari versions prior to 11.1.1, update to version 11.1.1 or later. For macOS High Sierra versions prior to 10.13.6, update to version 10.13.6 or later.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 52.6 Firefox ESR versions prior to 52.6 Firefox versions prior to 58 **Description** The issue is related to the display of URLs in the address bar when using right-to-left text with left-to-right alignment. In certain circumstances, it is possible to scroll this text to spoof the displayed URL, potentially misleading users into believing they are on a different site than the one loaded. This could result in the wrong URL being displayed as a location. **Recommendations** For Thunderbird versions prior to 52.6, update to version 52.6 or later. For Firefox ESR versions prior to 52.6, update to version 52.6 or later. For Firefox versions prior to 58, update to version 58 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 63.0.3239.84 Opera (affected versions not specified) **Description** The issue is related to insufficient policy enforcement in the Omnibox feature, allowing a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. This enables attackers to deceive users into accessing malicious websites that appear as legitimate due to the visual similarity of characters in the domain name. **Recommendations** For Google Chrome versions prior to 63.0.3239.84, update to version 63.0.3239.84 or later to resolve the issue. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 11.0.1 **Description** The issue involves the Safari component and allows remote attackers to spoof the address bar via a crafted web site. **Recommendations** For versions prior to 11.0.1, update to version 11.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.13.1 **Description** The issue involves the `Dictionary Widget` component, allowing attackers to read local files if pasted text is used in a search. **Recommendations** For macOS versions prior to 10.13.1, update to version 10.13.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of pasted text in searches within the Dictionary Widget until the update is applied.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.1 Safari versions prior to 11.0.1 iCloud versions prior to 7.1 on Windows iTunes versions prior to 12.7.1 on Windows tvOS versions prior to 11.1 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 11.1, update to version 11.1 or later. For Safari versions prior to 11.0.1, update to version 11.0.1 or later. For iCloud versions prior to 7.1 on Windows, update to version 7.1 or later. For iTunes versions prior to 12.7.1 on Windows, update to version 12.7.1 or later. For tvOS versions prior to 11.1, update to version 11.1 or later. As a temporary workaround, consider restricting access to the WebKit component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 11 Safari versions prior to 11 **Description** The issue involves the Safari component and allows remote attackers to spoof the address bar. **Recommendations** For iOS versions prior to 11, update to version 11 or later. For Safari versions prior to 11, update to version 11 or later.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 62.0.3202.62 Description: The issue is related to an insufficient watchdog timer in navigation, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could be achieved by manipulating an HTML page. Recommendations: For versions prior to 62.0.3202.62, update to version 62.0.3202.62 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.3.3 **Description** An issue in certain Apple products allows remote attackers to spoof the address bar via a crafted web site, involving the Safari component. **Recommendations** For iOS versions prior to 10.3.3, update to version 10.3.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 10.3.3 Safari versions prior to 10.1.2 **Description** The issue involves the WebKit component and allows remote attackers to spoof the address bar via a crafted web site that uses FRAME elements. **Recommendations** For iOS versions prior to 10.3.3, update to version 10.3.3 or later. For Safari versions prior to 10.1.2, update to version 10.1.2 or later. As a temporary workaround, consider restricting the use of the WebKit component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.3 Safari versions prior to 10.1 **Description** The issue involves mishandling of links during drag-and-drop actions in the WebKit component, allowing remote attackers to execute arbitrary code or spoof a bookmark. This is due to insufficient input validation. **Recommendations** For iOS versions prior to 10.3, update to version 10.3 or later to resolve the issue. For Safari versions prior to 10.1, update to version 10.1 or later to resolve the issue. As a temporary workaround, consider disabling the drag-and-drop functionality in the WebKit component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.3 Safari versions prior to 10.1 **Description** The issue involves the Safari component and allows remote attackers to spoof FaceTime prompts in the user interface via a crafted web site. It is related to errors in security settings, which can be exploited by a remote attacker to substitute the user interface of the FaceTime application using a specially formed website. **Recommendations** For iOS versions prior to 10.3, update to version 10.3 or later to resolve the issue. For Safari versions prior to 10.1, update to version 10.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Safari component until a patch is available.