G. Geshev

**Name of the Vulnerable Software and Affected Versions** Apple tvOS versions prior to 13 Apple iTunes for Windows version prior to 12.10.1 Apple iCloud for Windows versions prior to 10.7 and 7.14 **Description** The issue arises from multiple memory corruption problems that have been addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption vulnerability allows attackers to execute arbitrary code via specially crafted web content. **Recommendations** For Apple tvOS versions prior to 13, update to tvOS 13 to resolve the issue. For Apple iTunes for Windows version prior to 12.10.1, update to iTunes for Windows 12.10.1 to resolve the issue. For Apple iCloud for Windows versions prior to 10.7 and 7.14, update to iCloud for Windows 10.7 or 7.14 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 12.1.2 iOS versions prior to 12.4 macOS versions prior to 10.14.6 tvOS versions prior to 12.4 iTunes for Windows versions prior to 12.9.6 iCloud for Windows versions prior to 7.13 and 10.6 **Description** The issue is related to a use-after-free vulnerability in the WebKit display module, which can be exploited by a remote attacker using a specially crafted web page, potentially leading to arbitrary code execution. The vulnerability is associated with memory corruption issues that have been addressed with improved memory handling. **Recommendations** For Safari versions prior to 12.1.2, update to version 12.1.2 or later. For iOS versions prior to 12.4, update to version 12.4 or later. For macOS versions prior to 10.14.6, update to version 10.14.6 or later. For tvOS versions prior to 12.4, update to version 12.4 or later. For iTunes for Windows versions prior to 12.9.6, update to version 12.9.6 or later. For iCloud for Windows versions prior to 7.13 and 10.6, update to version 7.13 or 10.6 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.4 macOS Mojave versions prior to 10.14.6 tvOS versions prior to 12.4 Safari versions prior to 12.1.2 iTunes for Windows versions prior to 12.9.6 iCloud for Windows versions prior to 7.13 and 10.6 **Description** The issue is related to memory corruption and use-after-free errors, potentially allowing remote attackers to execute arbitrary code by processing maliciously crafted web content. This may lead to memory damage and arbitrary code execution. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For iOS versions prior to 12.4, update to iOS 12.4 or later. For macOS Mojave versions prior to 10.14.6, update to macOS Mojave 10.14.6 or later. For tvOS versions prior to 12.4, update to tvOS 12.4 or later. For Safari versions prior to 12.1.2, update to Safari 12.1.2 or later. For iTunes for Windows versions prior to 12.9.6, update to iTunes for Windows 12.9.6 or later. For iCloud for Windows versions prior to 7.13 and 10.6, update to iCloud for Windows 7.13 or 10.6 or later.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 12.1.2 iOS versions prior to 12.4 macOS versions prior to 10.14.6 tvOS versions prior to 12.4 iTunes for Windows versions prior to 12.9.6 iCloud for Windows versions prior to 7.13 and 10.6 **Description** The issue is related to a use-after-free problem in the WebKit display module, which can be exploited by a remote attacker using a specially crafted web page, potentially leading to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. **Recommendations** For Safari versions prior to 12.1.2, update to version 12.1.2 or later. For iOS versions prior to 12.4, update to version 12.4 or later. For macOS versions prior to 10.14.6, update to version 10.14.6 or later. For tvOS versions prior to 12.4, update to version 12.4 or later. For iTunes for Windows versions prior to 12.9.6, update to version 12.9.6 or later. For iCloud for Windows versions prior to 7.13 and 10.6, update to version 7.13 or 10.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.3 Apple macOS Mojave versions prior to 10.14.5 Apple tvOS versions prior to 12.3 Apple Safari versions prior to 12.1.1 Apple iTunes for Windows versions prior to 12.9.5 Apple iCloud for Windows versions prior to 7.12 **Description** The issue arises from multiple memory corruption problems that have been addressed through improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. This can potentially allow attackers to execute arbitrary code using specially formed web content. **Recommendations** For iOS versions prior to 12.3, update to iOS 12.3 or later. For macOS Mojave versions prior to 10.14.5, update to macOS Mojave 10.14.5 or later. For tvOS versions prior to 12.3, update to tvOS 12.3 or later. For Safari versions prior to 12.1.1, update to Safari 12.1.1 or later. For iTunes for Windows versions prior to 12.9.5, update to iTunes for Windows 12.9.5 or later. For iCloud for Windows versions prior to 7.12, update to iCloud for Windows 7.12 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.3 macOS Mojave versions prior to 10.14.5 tvOS versions prior to 12.3 Safari versions prior to 12.1.1 iTunes for Windows versions prior to 12.9.5 iCloud for Windows versions prior to 7.12 **Description** The issue is caused by errors in array indexing and memory handling, allowing a remote attacker to execute arbitrary code by processing maliciously crafted web content. This may lead to arbitrary code execution. **Recommendations** For iOS versions prior to 12.3, update to iOS 12.3 or later. For macOS Mojave versions prior to 10.14.5, update to macOS Mojave 10.14.5 or later. For tvOS versions prior to 12.3, update to tvOS 12.3 or later. For Safari versions prior to 12.1.1, update to Safari 12.1.1 or later. For iTunes for Windows versions prior to 12.9.5, update to iTunes for Windows 12.9.5 or later. For iCloud for Windows versions prior to 7.12, update to iCloud for Windows 7.12 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.3 Apple macOS Mojave versions prior to 10.14.5 Apple tvOS versions prior to 12.3 Apple Safari versions prior to 12.1.1 Apple iTunes for Windows versions prior to 12.9.5 Apple iCloud for Windows versions prior to 7.12 **Description** The issue arises from multiple memory corruption problems that have been addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. **Recommendations** For iOS versions prior to 12.3, update to iOS 12.3 or later. For macOS Mojave versions prior to 10.14.5, update to macOS Mojave 10.14.5 or later. For tvOS versions prior to 12.3, update to tvOS 12.3 or later. For Safari versions prior to 12.1.1, update to Safari 12.1.1 or later. For iTunes for Windows versions prior to 12.9.5, update to iTunes for Windows 12.9.5 or later. For iCloud for Windows versions prior to 7.12, update to iCloud for Windows 7.12 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.3 Apple macOS versions prior to 10.14.5 Apple tvOS versions prior to 12.3 Apple Safari versions prior to 12.1.1 Apple iTunes for Windows versions prior to 12.9.5 Apple iCloud for Windows versions prior to 7.12 **Description** The issue is related to memory corruption and can be triggered by processing maliciously crafted web content, potentially leading to arbitrary code execution. It is also associated with a buffer overflow in WebKitGTK and WPE WebKit modules, which can allow a remote attacker to execute arbitrary code using a specially crafted web page or file. **Recommendations** For iOS versions prior to 12.3, update to iOS 12.3 or later. For macOS versions prior to 10.14.5, update to macOS Mojave 10.14.5 or later. For tvOS versions prior to 12.3, update to tvOS 12.3 or later. For Safari versions prior to 12.1.1, update to Safari 12.1.1 or later. For iTunes for Windows versions prior to 12.9.5, update to iTunes for Windows 12.9.5 or later. For iCloud for Windows versions prior to 7.12, update to iCloud for Windows 7.12 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.3 Apple macOS versions prior to 10.14.5 Apple tvOS versions prior to 12.3 Apple Safari versions prior to 12.1.1 Apple iTunes for Windows versions prior to 12.9.5 Apple iCloud for Windows versions prior to 7.12 **Description** The issue is related to memory corruption and can be triggered by processing maliciously crafted web content, potentially leading to arbitrary code execution. It is also associated with a buffer overflow in WebKitGTK and WPE WebKit modules, which can be exploited by a remote attacker using a specially crafted web page or file to execute arbitrary code. **Recommendations** For iOS versions prior to 12.3, update to iOS 12.3 or later. For macOS versions prior to 10.14.5, update to macOS Mojave 10.14.5 or later. For tvOS versions prior to 12.3, update to tvOS 12.3 or later. For Safari versions prior to 12.1.1, update to Safari 12.1.1 or later. For iTunes for Windows versions prior to 12.9.5, update to iTunes for Windows 12.9.5 or later. For iCloud for Windows versions prior to 7.12, update to iCloud for Windows 7.12 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.3 macOS Mojave versions prior to 10.14.5 tvOS versions prior to 12.3 Safari versions prior to 12.1.1 iTunes for Windows versions prior to 12.9.5 iCloud for Windows versions prior to 7.12 **Description** The issue is related to multiple memory corruption problems, which can be exploited by processing maliciously crafted web content, potentially leading to arbitrary code execution. This can be achieved by a remote attacker using a specially crafted website. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For iOS versions prior to 12.3, update to iOS 12.3 or later. For macOS Mojave versions prior to 10.14.5, update to macOS Mojave 10.14.5 or later. For tvOS versions prior to 12.3, update to tvOS 12.3 or later. For Safari versions prior to 12.1.1, update to Safari 12.1.1 or later. For iTunes for Windows versions prior to 12.9.5, update to iTunes for Windows 12.9.5 or later. For iCloud for Windows versions prior to 7.12, update to iCloud for Windows 7.12 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.2 tvOS versions prior to 12.2 Safari versions prior to 12.1 iTunes versions prior to 12.9.4 for Windows iCloud for Windows versions prior to 7.11 **Description** The issue is related to memory corruption and can be triggered by processing maliciously crafted web content, potentially leading to arbitrary code execution. It involves the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For iOS versions prior to 12.2, update to iOS 12.2 or later. For tvOS versions prior to 12.2, update to tvOS 12.2 or later. For Safari versions prior to 12.1, update to Safari 12.1 or later. For iTunes versions prior to 12.9.4 for Windows, update to iTunes 12.9.4 or later for Windows. For iCloud for Windows versions prior to 7.11, update to iCloud for Windows 7.11 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.1.3 Apple tvOS versions prior to 12.1.2 Apple Safari versions prior to 12.0.3 Apple iTunes for Windows versions prior to 12.9.3 Apple iCloud for Windows versions prior to 7.10 **Description** A memory corruption issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. The issue is caused by a buffer overflow in the WebKit display module, which can be exploited by a remote attacker using a specially crafted web page. **Recommendations** For iOS versions prior to 12.1.3, update to iOS 12.1.3 or later. For tvOS versions prior to 12.1.2, update to tvOS 12.1.2 or later. For Safari versions prior to 12.0.3, update to Safari 12.0.3 or later. For iTunes for Windows versions prior to 12.9.3, update to iTunes 12.9.3 or later. For iCloud for Windows versions prior to 7.10, update to iCloud for Windows 7.10 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 12.1.3 Apple tvOS versions prior to 12.1.2 Apple Safari versions prior to 12.0.3 Apple iTunes for Windows versions prior to 12.9.3 Apple iCloud for Windows versions prior to 7.10 **Description** A memory corruption issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. The issue is related to a WebKit module vulnerability caused by a buffer overflow in memory, which can be exploited by a remote attacker using a specially crafted web page. **Recommendations** For iOS versions prior to 12.1.3, update to iOS 12.1.3 or later. For tvOS versions prior to 12.1.2, update to tvOS 12.1.2 or later. For Safari versions prior to 12.0.3, update to Safari 12.0.3 or later. For iTunes for Windows versions prior to 12.9.3, update to iTunes 12.9.3 or later. For iCloud for Windows versions prior to 7.10, update to iCloud for Windows 7.10 or later.

**Name of the Vulnerable Software and Affected Versions** LightDM versions prior to 1.23.0, specifically versions through 1.22.0 **Description** A directory traversal issue exists in the debian/guest-account.sh script of LightDM, allowing local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out. **Recommendations** For versions through 1.22.0, update to version 1.23.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime (affected versions not specified) **Description** The issue is related to a remote code execution problem in Apple QuickTime's SGI parsing functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SolarWinds Log and Event Manager versions prior to 6.0 **Description** The issue allows remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL. This is due to the use of static credentials. **Recommendations** For versions prior to 6.0, update to version 6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version Microsoft Visio (affected versions not specified) **Description** A vulnerability exists in OLE that could lead to remote code execution if a user opens a file that contains a specially crafted OLE object. An attacker who successfully exploited this issue could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Windows, update to a version that includes the fix for this issue. For Microsoft Visio, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7.4 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted movie file with H.264 encoding. This is related to a buffer overflow in the handling of 3GP parsing. **Recommendations** For versions prior to 7.7.4, update to version 7.7.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of H.264 encoded movie files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7.4 **Description** A buffer overflow issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted MP3 file. **Recommendations** For versions prior to 7.7.4, update to version 7.7.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7.4 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted FPX file. This is related to a buffer overflow in the FlashPix parsing component. **Recommendations** For versions prior to 7.7.4, update to version 7.7.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted FPX files until the update is applied.