CVE Vulnerability Catalog

An authentication issue in iOS 27 and iPadOS 27 was addressed with improved state management. An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication.

A data protection issue was addressed with improved data protection mechanisms. The vulnerability affects iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, and watchOS 27. An app may be able to access sensitive user data.

An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, and visionOS 27. Processing a maliciously crafted file may lead to unexpected app termination.

A denial-of-service issue in iOS and iPadOS was addressed with improved validation. The issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service.

A privacy issue was addressed by moving sensitive data. The issue affects iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.

The issue was addressed through improved state management. The issue affects macOS Golden Gate 27. An app may be able to access sensitive user data.

The issue was addressed with improved memory handling. The issue affects iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

A buffer overflow was addressed with improved bounds checking. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Mounting a malicious disk image may cause unexpected system termination.

A use-after-free issue was addressed with improved memory management. The issue affects macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

A logic issue in macOS allows an application to bypass Gatekeeper checks. The flaw was addressed with improved checks and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.6/26.7.

A correctness issue in macOS Sonoma allows an attacker with physical access to silently persist an Apple Account on an erased device. The issue is fixed in macOS Sonoma 14.8.8.

An authentication issue in Apple systems allows an app to use the Sign In With Apple flow to access the user's Apple Account. It was addressed with improved state management in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27.

IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in certain versions could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a buffer overflow in a PASE process that can lead to denial of service. An authenticated attacker could leverage this to terminate their own process.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.

IBM i Access Family versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a session file.

IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a malicious emulator macro RunProgram action.