Marcograss

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.1 macOS versions prior to 10.12.1 tvOS versions prior to 10.0.1 watchOS versions prior to 3.1 **Description** The issue involves the CoreGraphics component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted JPEG file. This is caused by a buffer overflow in the CoreGraphics component of Mac OS X and iOS operating systems. **Recommendations** For iOS versions prior to 10.1, update to version 10.1 or later. For macOS versions prior to 10.12.1, update to version 10.12.1 or later. For tvOS versions prior to 10.0.1, update to version 10.0.1 or later. For watchOS versions prior to 3.1, update to version 3.1 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.2 **Description** The issue involves the `WebSheet` component, which allows attackers to bypass a sandbox protection mechanism via unspecified vectors. This is related to errors in security settings, potentially enabling a remote attacker to exploit the issue and bypass the sandbox protection. **Recommendations** For iOS versions prior to 10.2, update to a version 10.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `WebSheet` component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.6 **Description** The issue is related to insufficient access control in the Intel graphics driver of Mac OS X, which can be exploited by a local attacker to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) using a specially crafted application. **Recommendations** For Apple OS X versions prior to 10.11.6, update to version 10.11.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Intel graphics driver until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Intel Graphics Driver in Apple OS X versions prior to 10.11.5 **Description** The issue is related to errors in security settings of the Intel Graphics Driver component in Mac OS X, allowing a remote attacker to obtain sensitive kernel memory-layout information using a specially crafted app. **Recommendations** For versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.5 **Description** The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. It is caused by a buffer overflow in the IOFireWireFamily component. **Recommendations** For versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the IOFireWireFamily component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** IOHIDFamily in Apple iOS versions prior to 9.3.2 IOHIDFamily in Apple OS X versions prior to 10.11.5 IOHIDFamily in Apple tvOS versions prior to 9.2.1 IOHIDFamily in Apple watchOS versions prior to 2.2.1 **Description** The issue is caused by a buffer overflow in the IOHIDFamily component of iOS and Mac OS X operating systems. Exploitation of this issue may allow a remote attacker to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) using a specially crafted application. **Recommendations** For iOS versions prior to 9.3.2, update to version 9.3.2 or later. For OS X versions prior to 10.11.5, update to version 10.11.5 or later. For tvOS versions prior to 9.2.1, update to version 9.2.1 or later. For watchOS versions prior to 2.2.1, update to version 2.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 5.1.1 LMY48Z Android versions prior to 6.0 2015-12-01 **Description** The issue allows attackers to obtain sensitive information and bypass an unspecified protection mechanism via unknown vectors. This can be demonstrated by obtaining Signature or SignatureOrSystem access. The vulnerability is related to the lack of protection for service data, which can allow a remote attacker to obtain confidential information or bypass protection mechanisms. **Recommendations** For Android versions prior to 5.1.1 LMY48Z, update to version 5.1.1 LMY48Z or later. For Android versions prior to 6.0 2015-12-01, update to version 6.0 2015-12-01 or later.

**Name of the Vulnerable Software and Affected Versions** Amazon Fire OS versions prior to 2016-01-15 **Description** The issue is related to a stack-based buffer overflow in the `havok write` function. This can be exploited by sending a long string to the `/dev/hv` device, potentially causing a denial of service or other unspecified impacts. **Recommendations** For Amazon Fire OS versions prior to 2016-01-15, update to a version released after 2016-01-15 to resolve the issue. As a temporary workaround, consider restricting access to the `/dev/hv` device to minimize the risk of exploitation.