Chris Palmer

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 10.0.1 iCloud versions prior to 6.0.1 iTunes versions prior to 12.5.2 tvOS versions prior to 10.0.1 **Description** The issue involves the WebKit component and allows remote attackers to obtain sensitive information via a crafted web site. This is due to a lack of protection for service data. **Recommendations** For Safari versions prior to 10.0.1, update to version 10.0.1 or later. For iCloud versions prior to 6.0.1, update to version 6.0.1 or later. For iTunes versions prior to 12.5.2, update to version 12.5.2 or later. For tvOS versions prior to 10.0.1, update to version 10.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Komodia Redirector with SSL Digestor (affected versions not specified) Lavasoft Ad-Aware Web Companion version 1.1.885.1766 Lavasoft Ad-Aware AdBlocker (alpha) version 1.3.69.1 Qustodio for Windows (affected versions not specified) Atom Security, Inc. StaffCop version 5.8 **Description** The issue concerns the SDK for Komodia Redirector with SSL Digestor, which is used in various products. It does not properly verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers. **Recommendations** For Lavasoft Ad-Aware Web Companion version 1.1.885.1766, update the SSL verification mechanism to properly validate X.509 certificates. For Lavasoft Ad-Aware AdBlocker (alpha) version 1.3.69.1, consider disabling SSL connections until a proper certificate verification mechanism is implemented. For Qustodio for Windows, restrict access to sensitive information until the SSL verification issue is resolved. For Atom Security, Inc. StaffCop version 5.8, disable the use of SSL Digestor until a patch is available that properly verifies X.509 certificates. At the moment, there is no information about a newer version that contains a fix for this vulnerability in Komodia Redirector with SSL Digestor.

**Name of the Vulnerable Software and Affected Versions** Android version 1.5 **Description** The issue allows local users to bypass certain configuration settings, specifically Manifest.permission.CAMERA and Manifest.permission.AUDIO RECORD, by installing and executing an application that does not request permission before using the camera or microphone. **Recommendations** For Android version 1.5, consider restricting access to the camera and microphone until a fix is available, or avoid installing applications that do not properly request permissions for these features.