iPadOS 17.4

Microsoft Security Update Guide entry — NVD enrichira.

[Apple libxpc] An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges

[Apple ExtensionKit] An app may be able to access sensitive user data

[Apple WebKit] Processing web content may lead to arbitrary code execution

[Apple Share Sheet] An app may be able to access user-sensitive data

[Apple Kernel] An app may be able to access user-sensitive data

[Apple Sandbox] An app may be able to leak sensitive user information

[Apple Spotlight] An app may be able to leak sensitive user information

[Apple Synapse] An app may be able to view Mail data

[Apple UIKit] An app may be able to break out of its sandbox

[Apple CoreBluetooth - LE] An app may be able to access Bluetooth-connected microphones without user permission

[Apple WebKit] A malicious website may exfiltrate audio data cross-origin

[Apple Photos] Photos in the Hidden Photos Album may be viewed without authentication

[Apple Safari] Processing web content may lead to a denial-of-service

[Apple WebKit] Processing maliciously crafted web content may prevent Content Security Policy from being enforced

[Apple Metal] An application may be able to read restricted memory

[Apple Kernel] An app may be able to cause unexpected system termination or write kernel memory

[Apple Image Processing] An app may be able to execute arbitrary code with kernel privileges

[Apple Safari Private Browsing] Private Browsing tabs may be accessed without authentication

[Apple Bluetooth] An attacker in a privileged network position may be able to inject keystrokes by spoofing a keyboard

[Apple libxpc] An app may be able to break out of its sandbox

[Apple WebKit] A maliciously crafted webpage may be able to fingerprint the user

[Apple WebKit] Processing maliciously crafted web content may prevent Content Security Policy from being enforced

[Apple ImageIO] Processing an image may lead to arbitrary code execution

[Apple Messages] An app may be able to access user-sensitive data

[Apple AppleMobileFileIntegrity] An app may be able to elevate privileges

[Apple Siri] A person with physical access to a device may be able to use Siri to access private calendar information

[Apple Sandbox] An app may be able to access user-sensitive data

[Apple Accessibility] A malicious app may be able to observe user data in log entries related to accessibility notifica…

[Apple Shortcuts] An app may be able to access information about a user's contacts

[Apple Siri] An attacker with physical access may be able to use Siri to access sensitive user data

[Apple WebKit] Processing web content may lead to arbitrary code execution

[Apple WebKit] Processing web content may lead to a denial-of-service

[Apple Safari] An app may be able to fingerprint the user

[Apple Photos] Shake-to-undo may allow a deleted photo to be re-surfaced without authentication

[Apple Accessibility] An app may be able to read sensitive location information

[Apple Safari Private Browsing] A user's locked tabs may be briefly visible while switching tab groups when Locked Priv…

[Apple Accessibility] An app may be able to spoof system notifications and UI

[Apple MediaRemote] A malicious application may be able to access private information