Guillaume Ross

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11.4 **Description** The issue is related to the Reminders component in Apple OS X, which has inadequate access control. This allows attackers to bypass the intended user-confirmation requirement. By exploiting this, an attacker can trigger a dialing action via a `tel:` URL without the user's permission. **Recommendations** For Apple OS X versions prior to 10.11.4, update to version 10.11.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of `tel:` URLs in the Reminders component until the update is applied.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 9 **Description** The issue is related to insufficient input validation in the WebKit component of the iOS operating system. This can be exploited by a remote attacker to trigger certain actions by manipulating `tel://`, `facetime://`, or `facetime-audio://` URLs. **Recommendations** For versions prior to 9, update to iOS version 9 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebKit component until a patch is available. Avoid using the `tel://`, `facetime://`, and `facetime-audio://` URLs in affected iOS versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 8.4.1 **Description** The issue exists due to insufficient input validation in the UIKit WebView component of the iOS operating system. This allows a remote attacker to initiate arbitrary FaceTime calls using a specially crafted URL, bypassing the intended user-confirmation requirement. **Recommendations** For iOS versions prior to 8.4.1, update to version 8.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to FaceTime or avoiding the use of specially crafted URLs in the affected UIKit WebView component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Tweetbot versions 1.3.3 for Mac, and 2.8.5 for iPad and iPhone **Description** The issue allows remote attackers to automatically force the user to perform undesired actions, such as follow or favorite actions, without confirmation. This can be achieved via the "tweetbot:///follow/" URL. **Recommendations** For Tweetbot version 1.3.3 on Mac, consider disabling the ability to perform follow or favorite actions via URLs until a patch is available. For Tweetbot version 2.8.5 on iPad and iPhone, restrict access to the tweetbot:///follow/ URL to minimize the risk of exploitation.