Yuebin Sun

A path handling issue was addressed with improved validation. An application may be able to break out of its sandbox.

An access issue was addressed with improvements to the sandbox, allowing an app to potentially access sensitive user information.

The issue allows an app to bypass Privacy preferences. It was addressed with improved checks.

The issue allows a malicious application to read other applications' settings. This was addressed with additional permissions checks.

A logic issue was addressed with improved validation. A malicious application may be able to gain root privileges.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 14.5 iPadOS versions prior to 14.5 Description: An issue was found that could potentially expose a user's password on screen due to inadequate password obscuring in screenshots. This issue has been addressed with improved logic. Recommendations: For iOS versions prior to 14.5, update to iOS 14.5 or later to resolve the issue. For iPadOS versions prior to 14.5, update to iPadOS 14.5 or later to resolve the issue.

A malicious application may be able to bypass certain Privacy preferences due to this issue. The issue was addressed with improved checks.

A local attacker may be able to elevate their privileges due to this issue. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

A logic issue was addressed with improved state management, which may allow a sandboxed process to circumvent sandbox restrictions.

A path handling issue was addressed with improved validation. This issue may cause unexpected JavaScript execution from a file on disk when processing a maliciously crafted URL. The vulnerability is related to insufficient input validation in the Help Viewer component of macOS Big Sur, which may allow an attacker to execute arbitrary JavaScript code.

A validation issue existed in the handling of symlinks, which has been addressed with improved validation of symlinks. This issue may allow an application to access restricted files.

The issue is related to a parsing problem in the handling of directory paths, which can be exploited to gain unauthorized access to protected information. A local user may be able to modify protected parts of the file system due to insufficient path validation.

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue allows a local user to modify protected parts of the file system, potentially leading to privilege escalation. The vulnerability is related to insufficient validation of directory path names with restricted access.

The issue is related to incorrect restriction of directory path names with limited access. Exploitation of this issue may allow an attacker to impact the integrity of protected information. A local user may be able to modify protected parts of the file system due to a parsing issue in the handling of directory paths.

The issue is related to insufficient access control in the libeffects library of the Android Media Framework, which can be exploited by a remote attacker to elevate their privileges.