Meysam Firouzi

**Name of the Vulnerable Software and Affected Versions** (affected versions not specified) **Description** A memory corruption issue exists when handling client exceptions, potentially allowing unauthorized channel access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux Kernel (affected versions not specified) Description: The issue is related to a use-after-free vulnerability in the Linux kernel's 9p file system. This occurs when a thread looks up a fid through dentry while another thread unlinks it, resulting in a use-after-free on dentry's d fsdata fid list. The problem arises because d fsdata was not accessed under d lock, and since d release() is normally only called once the dentry is no longer accessible, but it is also called explicitly in v9fs remove, the lock is required. The vulnerability can be exploited to potentially escalate privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 17.5 iPadOS versions prior to 17.5 tvOS versions prior to 17.5 watchOS versions prior to 10.5 macOS Sonoma versions prior to 14.5 **Description** The issue was addressed with improved memory handling. An app may be able to execute arbitrary code with kernel privileges. **Recommendations** For iOS versions prior to 17.5, update to iOS 17.5 or later. For iPadOS versions prior to 17.5, update to iPadOS 17.5 or later. For tvOS versions prior to 17.5, update to tvOS 17.5 or later. For watchOS versions prior to 10.5, update to watchOS 10.5 or later. For macOS Sonoma versions prior to 14.5, update to macOS Sonoma 14.5 or later.

**Name of the Vulnerable Software and Affected Versions** macOS Ventura versions prior to 13.6.7 macOS Monterey versions prior to 12.7.5 iOS versions prior to 16.7.8 iPadOS versions prior to 16.7.8 tvOS versions prior to 17.5 visionOS versions prior to 1.2 iOS versions prior to 17.5 iPadOS versions prior to 17.5 macOS Sonoma versions prior to 14.5 **Description** An out-of-bounds read issue was addressed with improved input validation. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. **Recommendations** For macOS Ventura versions prior to 13.6.7, update to macOS Ventura 13.6.7. For macOS Monterey versions prior to 12.7.5, update to macOS Monterey 12.7.5. For iOS versions prior to 16.7.8, update to iOS 16.7.8. For iPadOS versions prior to 16.7.8, update to iPadOS 16.7.8. For tvOS versions prior to 17.5, update to tvOS 17.5. For visionOS versions prior to 1.2, update to visionOS 1.2. For iOS versions prior to 17.5, update to iOS 17.5. For iPadOS versions prior to 17.5, update to iPadOS 17.5. For macOS Sonoma versions prior to 14.5, update to macOS Sonoma 14.5.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 12.7.4 macOS Ventura versions prior to 13.6.5 macOS Sonoma versions prior to 14.4 visionOS versions prior to 1.1 iOS versions prior to 17.4 iPadOS versions prior to 17.4 iOS versions prior to 16.7.6 iPadOS versions prior to 16.7.6 tvOS versions prior to 17.4 **Description** A validation issue was addressed with improved input sanitization, allowing an application to potentially read restricted memory. This issue is related to the Metal Framework library and can be exploited by remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the Metal Framework library is required to exploit this vulnerability. **Recommendations** For macOS versions prior to 12.7.4, update to macOS Monterey 12.7.4 or later. For macOS Ventura versions prior to 13.6.5, update to macOS Ventura 13.6.5 or later. For macOS Sonoma versions prior to 14.4, update to macOS Sonoma 14.4 or later. For visionOS versions prior to 1.1, update to visionOS 1.1 or later. For iOS versions prior to 17.4, update to iOS 17.4 or later. For iPadOS versions prior to 17.4, update to iPadOS 17.4 or later. For iOS versions prior to 16.7.6, update to iOS 16.7.6 or later. For iPadOS versions prior to 16.7.6, update to iPadOS 16.7.6 or later. For tvOS versions prior to 17.4, update to tvOS 17.4 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14.2 macOS Ventura versions prior to 13.6.3 macOS Monterey versions prior to 12.7.2 iOS versions prior to 17.2 iOS versions prior to 16.7.3 iPadOS versions prior to 17.2 iPadOS versions prior to 16.7.3 watchOS versions prior to 10.2 tvOS versions prior to 17.2 **Description** The issue is related to a buffer overflow in the ImageIO component of macOS, iOS, iPadOS, tvOS, and watchOS, which may allow an attacker to execute arbitrary code when processing an image. This is due to improper memory handling. **Recommendations** For macOS versions prior to 14.2, update to macOS Sonoma 14.2. For macOS Ventura versions prior to 13.6.3, update to macOS Ventura 13.6.3. For macOS Monterey versions prior to 12.7.2, update to macOS Monterey 12.7.2. For iOS versions prior to 17.2, update to iOS 17.2. For iOS versions prior to 16.7.3, update to iOS 16.7.3. For iPadOS versions prior to 17.2, update to iPadOS 17.2. For iPadOS versions prior to 16.7.3, update to iPadOS 16.7.3. For watchOS versions prior to 10.2, update to watchOS 10.2. For tvOS versions prior to 17.2, update to tvOS 17.2.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue involves memory corruption due to an untrusted pointer dereference in automotive systems during a system call. This can potentially lead to significant security risks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 16.5 Apple iPadOS versions prior to 16.5 Apple watchOS versions prior to 9.5 Apple tvOS versions prior to 16.5 Apple macOS Ventura versions prior to 13.4 **Description** An out-of-bounds read issue was addressed with improved input validation. Processing an image may result in disclosure of process memory. **Recommendations** For iOS versions prior to 16.5, update to iOS 16.5 or later. For iPadOS versions prior to 16.5, update to iPadOS 16.5 or later. For watchOS versions prior to 9.5, update to watchOS 9.5 or later. For tvOS versions prior to 16.5, update to tvOS 16.5 or later. For macOS Ventura versions prior to 13.4, update to macOS Ventura 13.4 or later.

**Name of the Vulnerable Software and Affected Versions** watchOS versions 9.5 and earlier tvOS versions 16.5 and earlier macOS Ventura versions 13.4 and earlier iOS versions 15.7.6 and 16.5 and earlier iPadOS versions 15.7.6 and 16.5 and earlier macOS Big Sur versions 11.7.7 and earlier macOS Monterey versions 12.6.6 and earlier **Description** A buffer overflow issue was addressed with improved bounds checking. This issue may lead to arbitrary code execution when processing an image. The vulnerability is related to the ImageIO component in MacOS, iOS, tvOS, iPadOS, and watchOS operating systems, which can be exploited by an attacker using a specially crafted file. **Recommendations** For watchOS versions prior to 9.5, update to watchOS 9.5 to resolve the issue. For tvOS versions prior to 16.5, update to tvOS 16.5 to resolve the issue. For macOS Ventura versions prior to 13.4, update to macOS Ventura 13.4 to resolve the issue. For iOS versions prior to 15.7.6 and 16.5, update to iOS 15.7.6 or iOS 16.5 to resolve the issue. For iPadOS versions prior to 15.7.6 and 16.5, update to iPadOS 15.7.6 or iPadOS 16.5 to resolve the issue. For macOS Big Sur versions prior to 11.7.7, update to macOS Big Sur 11.7.7 to resolve the issue. For macOS Monterey versions prior to 12.6.6, update to macOS Monterey 12.6.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 Studio Display Firmware versions prior to 16.4 **Description** A memory corruption issue was addressed with improved state management, allowing an app to potentially execute arbitrary code with kernel privileges. **Recommendations** For macOS versions prior to 13.3, update to macOS Ventura 13.3 to resolve the issue. For Studio Display Firmware versions prior to 16.4, apply the Studio Display Firmware Update 16.4 to fix the problem.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 **Description** An out-of-bounds read was addressed with improved input validation. Processing an image may result in disclosure of process memory. **Recommendations** For versions prior to 13.3, update to macOS Ventura 13.3 to resolve the issue. As a temporary workaround, consider avoiding the processing of images until the update is applied.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 tvOS versions prior to 16.4 iOS versions prior to 16.4 iPadOS versions prior to 16.4 watchOS versions prior to 9.4 **Description** An out-of-bounds read issue was addressed with improved input validation. Processing a maliciously crafted image may result in disclosure of process memory. **Recommendations** For macOS versions prior to 13.3, update to macOS Ventura 13.3. For tvOS versions prior to 16.4, update to tvOS 16.4. For iOS versions prior to 16.4, update to iOS 16.4. For iPadOS versions prior to 16.4, update to iPadOS 16.4. For watchOS versions prior to 9.4, update to watchOS 9.4.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 **Description** An out-of-bounds read was addressed with improved input validation. Processing an image may result in disclosure of process memory. **Recommendations** For versions prior to 13.3, update to macOS Ventura 13.3 to resolve the issue. As a temporary workaround, consider avoiding the processing of images until the update is applied.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 tvOS versions prior to 16.4 iOS versions prior to 16.4 iPadOS versions prior to 16.4 watchOS versions prior to 9.4 **Description** The issue is related to an out-of-bounds read in memory, which may allow a remote attacker to disclose protected information. This can occur when processing an image, potentially resulting in the disclosure of process memory. **Recommendations** For macOS versions prior to 13.3, update to macOS Ventura 13.3 to resolve the issue. For tvOS versions prior to 16.4, update to tvOS 16.4 to resolve the issue. For iOS versions prior to 16.4, update to iOS 16.4 to resolve the issue. For iPadOS versions prior to 16.4, update to iPadOS 16.4 to resolve the issue. For watchOS versions prior to 9.4, update to watchOS 9.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 13.3 tvOS versions prior to 16.4 iOS versions prior to 16.4 iPadOS versions prior to 16.4 watchOS versions prior to 9.4 **Description** The issue is related to an out-of-bounds read in the ImageIO component, which can result in the disclosure of process memory when processing an image. This can potentially allow a remote attacker to reveal protected information. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For macOS versions prior to 13.3, update to macOS Ventura 13.3. For tvOS versions prior to 16.4, update to tvOS 16.4. For iOS versions prior to 16.4, update to iOS 16.4. For iPadOS versions prior to 16.4, update to iPadOS 16.4. For watchOS versions prior to 9.4, update to watchOS 9.4.

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 9.3 tvOS versions prior to 16.3 macOS Ventura versions prior to 13.2 iOS versions prior to 16.3 iPadOS versions prior to 16.3 **Description** A memory corruption issue was addressed with improved state management. Processing an image may lead to a denial-of-service. **Recommendations** For watchOS versions prior to 9.3, update to watchOS 9.3 to resolve the issue. For tvOS versions prior to 16.3, update to tvOS 16.3 to resolve the issue. For macOS Ventura versions prior to 13.2, update to macOS Ventura 13.2 to resolve the issue. For iOS versions prior to 16.3, update to iOS 16.3 to resolve the issue. For iPadOS versions prior to 16.3, update to iPadOS 16.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Parallels Desktop version 17.1.1 **Description** This issue allows local attackers to disclose sensitive information on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Parallels Tools component. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this in conjunction with other issues to escalate privileges and execute arbitrary code in the context of the kernel. **Recommendations** For Parallels Desktop version 17.1.1, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 15.3 iPadOS versions prior to 15.3 macOS Big Sur versions prior to 11.6.3 macOS Monterey versions prior to 12.2 **Description** A memory corruption issue was addressed with improved input validation, which may allow a malicious application to execute arbitrary code with kernel privileges. This issue is related to the IOMobileFrameBuffer function in the kernel of iOS, iPadOS, and macOS operating systems, and is associated with a buffer overflow in memory. Apple is aware of a report that this issue may have been actively exploited. The estimated number of potentially affected devices is not specified. **Recommendations** For iOS versions prior to 15.3, update to iOS 15.3 or later. For iPadOS versions prior to 15.3, update to iPadOS 15.3 or later. For macOS Big Sur versions prior to 11.6.3, update to macOS Big Sur 11.6.3 or later. For macOS Monterey versions prior to 12.2, update to macOS Monterey 12.2 or later.

**Name of the Vulnerable Software and Affected Versions** Parallels Desktop version 15.1.4 **Description** This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the prl naptd process. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this issue to escalate privileges and execute code in the context of the hypervisor. **Recommendations** For Parallels Desktop version 15.1.4, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office Access Connectivity Engine (affected versions not specified) **Description** A remote code execution issue exists due to the improper handling of objects in memory by the Microsoft Office Access Connectivity Engine. This could allow a remote attacker to execute arbitrary code on a victim system by enticing the victim to open a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.