Yingqi Shi

A path handling issue exists in the `revisiond` component that allows an application already installed on the system to gain root privileges through local privilege escalation. The issue was caused by insufficient validation during path processing.

A path handling issue exists where improved validation is required. This flaw may allow an application to bypass Gatekeeper checks, which is the system's security feature used to ensure only trusted software runs on the Mac.

A race condition, which occurs when the timing or sequence of events is unplanned, was addressed with improved state handling. This issue could allow an application to gain root privileges.

A race condition exists due to improper handling of symbolic links, which are shortcuts that point to another file or directory. This flaw may allow an application to access Contacts without obtaining user consent.

A logic issue was identified and addressed through improved checks within the FrontBoard component. This issue allows an application to potentially enumerate a user's installed applications. Reports indicate that this issue has been exploited by some App Store applications to detect the presence of TrollStore on a device.

Name of the Vulnerable Software and Affected Versions: Remote Desktop Client versions prior to 1.2.5709 Description: The issue is related to a use-after-free vulnerability in the Remote Desktop Protocol (RDP) Client of Windows operating systems. This vulnerability can be exploited by a remote attacker to execute arbitrary code. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Recommendations: For versions prior to 1.2.5709, update to version 1.2.5709 or later to resolve the issue. As a temporary workaround, consider restricting access to the Remote Desktop Client until a patch is applied.

The issue is related to errors in synchronization when using a shared resource in the Remote Desktop Protocol (RDP) of the Windows operating system. This can allow a remote attacker to execute arbitrary code.