iPadOS 18.4

[Apple libarchive] An input validation issue was addressed

[Apple libxml2] Parsing a file may lead to an unexpected app termination

[Apple curl] An input validation issue was addressed

[Apple libxml2] Parsing a file may lead to an unexpected app termination

[Apple Logging] An app may be able to access sensitive user data

[Apple Sandbox Profiles] An app may be able to read a persistent device identifier

[Apple AirDrop] An app may be able to read arbitrary file metadata

[Apple CoreGraphics] Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memo…

[Apple RepairKit] An app may be able to bypass Privacy preferences

[Apple Safari] Visiting a malicious website may lead to user interface spoofing

[Apple CoreAudio] Parsing a file may lead to an unexpected app termination

[Apple Safari] A download's origin may be incorrectly associated

[Apple Power Services] An app may be able to break out of its sandbox

[Apple libxpc] An app may be able to break out of its sandbox

[Apple Authentication Services] A malicious website may be able to claim WebAuthn credentials from another website that…

[Apple CoreText] Processing a maliciously crafted font may result in the disclosure of process memory

[Apple CoreMedia] Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process…

[Apple Web Extensions] Visiting a website may leak sensitive data

[Apple MobileLockdown] An attacker with a USB-C connection to an unlocked device may be able to programmatically access…

[Apple libnetcore] Processing maliciously crafted web content may result in the disclosure of process memory

[Apple Siri] An attacker with physical access may be able to use Siri to access sensitive user data

[Apple Accessibility] An app may be able to access sensitive user data

[Apple Kernel] An app may be able to modify protected parts of the file system

[Apple Siri] An app may be able to access user-sensitive data

[Apple AirPlay] An attacker on the local network may be able to bypass authentication policy

[Apple WebKit] Loading a malicious iframe may lead to a cross-site scripting attack

[Apple WebKit] Processing maliciously crafted web content may lead to an unexpected process crash

[Apple ImageIO] Parsing an image may lead to disclosure of user information

[Apple CoreMedia] Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process…

[Apple Calendar] An app may be able to break out of its sandbox

[Apple Siri] An app may be able to access sensitive user data

[Apple WebKit] Processing maliciously crafted web content may lead to an unexpected Safari crash

[Apple Siri] An app may be able to access sensitive user data

[Apple Accounts] Sensitive keychain data may be accessible from an iOS backup

[Apple CoreAudio] Playing a malicious audio file may lead to an unexpected app termination

[Apple BiometricKit] An app may be able to cause unexpected system termination

[Apple libxpc] An app may be able to gain elevated privileges

[Apple Audio] Processing a maliciously crafted file may lead to arbitrary code execution

[Apple Audio] Processing a maliciously crafted font may result in the disclosure of process memory

[Apple AirPlay] An attacker on the local network may cause an unexpected app termination

[Apple AirPlay] An attacker on the local network may be able to corrupt process memory

[Apple IOGPUFamily] An app may be able to cause unexpected system termination or write kernel memory

[Apple WebKit] Processing maliciously crafted web content may lead to an unexpected Safari crash

[Apple AirPlay] An attacker on the local network may be able to leak sensitive user information

[Apple AirPlay] An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without p…

[Apple Focus] An app may be able to access sensitive user data

[Apple WebKit] A malicious website may be able to track users in Safari private browsing mode

[Apple NetworkExtension] An app may be able to enumerate a user's installed apps

[Apple WebKit] Processing maliciously crafted web content may lead to an unexpected Safari crash

[Apple Photos] Photos in the Hidden Photos Album may be viewed without authentication

[Apple Calendar] An app may be able to break out of its sandbox

[Apple Authentication Services] Password autofill may fill in passwords after failing authentication

[Apple Kernel] A malicious app may be able to attempt passcode entries on a locked device and thereby cause escalating …

[Apple Shortcuts] A shortcut may be able to access files that are normally inaccessible to the Shortcuts app

[Apple Journal] Processing a maliciously crafted file may lead to a cross site scripting attack

[Apple Siri] An attacker may be able to use Siri to enable Auto-Answer Calls

[Apple Share Sheet] A malicious app may be able to dismiss the system notification on the Lock Screen that a recording …

[Apple Focus] An attacker with physical access to a locked device may be able to view sensitive user information

[Apple AirPlay] An attacker on the local network may cause an unexpected app termination

[Apple Foundation] An app may be able to access sensitive user data

[Apple CoreMedia Playback] A malicious app may be able to access private information

[Apple DiskArbitration] An app may be able to gain root privileges

[Apple Handoff] An app may be able to access sensitive user data

[Apple Safari] A website may be able to bypass Same Origin Policy

[Apple Safari] Visiting a malicious website may lead to address bar spoofing

[Apple Photos] A person with physical access to an iOS device may be able to access photos from the lock screen

[Apple Maps] An app may be able to read sensitive location information

[Apple Security] A remote user may be able to cause a denial-of-service

[Apple libxpc] An app may be able to delete files for which it does not have permission

[Apple Siri] An app may be able to access sensitive user data

[Apple Web Extensions] An app may gain unauthorized access to Local Network

[Apple CoreServices] An app may be able to access sensitive user data

[Apple Safari] A website may be able to access sensor information without user consent

[Apple AirPlay] An attacker on the local network may cause an unexpected app termination

[Apple AirPlay] An attacker on the local network may be able to cause a denial-of-service

[Apple CoreUtils] An attacker on the local network may be able to cause a denial-of-service

[Apple Audio] An app may be able to bypass ASLR