Yulong Zhang

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 8.4.1 **Description** The issue is related to the MobileInstallation component in iOS, which has inadequate access control to certain functions. This allows an attacker to replace arbitrary extensions using a crafted enterprise app. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 8.4.1, update to version 8.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the installation of enterprise apps to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 8.3 **Description** The issue allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard, specifically exploiting the QuickType feature in the Keyboards subsystem. **Recommendations** For versions prior to 8.3, update to version 8.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** libnetcore in Apple iOS versions prior to 8.3 libnetcore in Apple OS X versions prior to 10.10.3 libnetcore in Apple TV versions prior to 7.2 **Description** The issue allows attackers to cause a denial of service, resulting in memory corruption and application crash, via a crafted configuration profile. **Recommendations** For Apple iOS versions prior to 8.3, update to version 8.3 or later. For Apple OS X versions prior to 10.10.3, update to version 10.10.3 or later. For Apple TV versions prior to 7.2, update to version 7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.10.3 **Description** The issue is related to a type confusion problem in LaunchServices, allowing local users to gain privileges via a crafted localized string. **Recommendations** For Apple OS X versions prior to 10.10.3, update to version 10.10.3 or later to resolve the issue.