Jack Dates

Name of the Vulnerable Software and Affected Versions: Sonos Era 300 (affected versions not specified) Description: This issue allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. The specific flaw exists within the processing of HLS playlist data, resulting from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Phoenix Contact CHARX SEC-3100 CANopenDevice (affected versions not specified) **Description** An unauthenticated remote attacker can disrupt the charging functionality by causing a denial-of-service (DoS) in the control agent due to access of an uninitialized pointer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Phoenix Contact CHARX SEC-3100 (affected versions not specified) **Description** An unauthenticated remote attacker can cause a denial of service (DoS) to the control agent due to an out-of-bounds read, which may prevent or disrupt the charging functionality. The issue is related to the HomePlug Protocol. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 (affected versions not specified) Description: The issue is related to an incomplete cleanup during service restart after a Denial of Service (DoS), allowing an unauthenticated remote attacker to gain service level privileges. This can also lead to remote code execution due to a use-after-free vulnerability in the ClientSession. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.1 macOS Big Sur versions prior to 11.6.2 Security Update versions prior to 2021-008 Catalina **Description** A buffer overflow issue was addressed with improved bounds checking, which may allow a malicious application to execute arbitrary code with kernel privileges. **Recommendations** For macOS versions prior to 12.1, update to macOS Monterey 12.1 or later. For macOS Big Sur versions prior to 11.6.2, update to macOS Big Sur 11.6.2 or later. For Security Update versions prior to 2021-008 Catalina, apply Security Update 2021-008 Catalina or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.1 macOS Big Sur versions prior to 11.6.2 Security Update versions prior to 2021-008 Catalina **Description** A buffer overflow issue was addressed with improved bounds checking, which may allow an application to execute arbitrary code with kernel privileges. **Recommendations** For macOS versions prior to 12.1, update to macOS Monterey 12.1 or later. For macOS Big Sur versions prior to 11.6.2, update to macOS Big Sur 11.6.2 or later. For Security Update versions prior to 2021-008 Catalina, apply Security Update 2021-008 Catalina or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.0.1 macOS Big Sur versions prior to 11.6.1 Security Update versions prior to 2021-007 Catalina **Description** The issue involves multiple out-of-bounds write problems that have been resolved through enhanced bounds checking. A malicious application could potentially execute arbitrary code with kernel privileges. **Recommendations** For macOS versions prior to 12.0.1, update to macOS Monterey 12.0.1. For macOS Big Sur versions prior to 11.6.1, update to macOS Big Sur 11.6.1. For Security Update versions prior to 2021-007 Catalina, apply Security Update 2021-007 Catalina.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.6.1 **Description** The issue involves multiple out-of-bounds write problems that have been resolved through enhanced bounds checking. A malicious application could potentially execute arbitrary code with kernel privileges. **Recommendations** For versions prior to 11.6.1, update to macOS Big Sur 11.6.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.0.1 macOS Big Sur versions prior to 11.6 **Description** A race condition was addressed with improved state handling, which could allow a malicious application to execute arbitrary code with kernel privileges. **Recommendations** For macOS versions prior to 12.0.1, update to macOS Monterey 12.0.1 or later. For macOS Big Sur versions prior to 11.6, update to macOS Big Sur 11.6 or later.

Name of the Vulnerable Software and Affected Versions: Parallels Desktop version 16.1.3 Description: This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other issues to escalate privileges and execute arbitrary code in the context of the hypervisor. Recommendations: For Parallels Desktop version 16.1.3, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 14.1.1 tvOS versions prior to 14.6 iOS versions prior to 14.6 iPadOS versions prior to 14.6 macOS Big Sur versions prior to 11.4 watchOS versions prior to 7.5 **Description** The issue is related to multiple memory corruption problems that have been addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using malicious web content. **Recommendations** For Safari version prior to 14.1.1, update to Safari 14.1.1 or later. For tvOS version prior to 14.6, update to tvOS 14.6 or later. For iOS version prior to 14.6, update to iOS 14.6 or later. For iPadOS version prior to 14.6, update to iPadOS 14.6 or later. For macOS Big Sur version prior to 11.4, update to macOS Big Sur 11.4 or later. For watchOS version prior to 7.5, update to watchOS 7.5 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 11.4 Security Update versions prior to 2021-003 Catalina Security Update versions prior to 2021-004 Mojave **Description** A malicious application may be able to execute arbitrary code with kernel privileges due to an out-of-bounds write issue. This issue was addressed with improved bounds checking. **Recommendations** For macOS versions prior to 11.4, update to macOS Big Sur 11.4 or later. For Security Update versions prior to 2021-003 Catalina, apply Security Update 2021-003 Catalina or later. For Security Update versions prior to 2021-004 Mojave, apply Security Update 2021-004 Mojave or later.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Big Sur 11.3 Security Update versions prior to 2021-002 Catalina Description: A malicious application may be able to execute arbitrary code with kernel privileges due to an out-of-bounds write issue. This issue was addressed with improved bounds checking. Recommendations: For macOS versions prior to Big Sur 11.3, update to macOS Big Sur 11.3 or later to resolve the issue. For versions that require Security Update, apply Security Update 2021-002 Catalina or later to fix the problem.