436 matches found
Design/Logic Flaw
An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "Security" component. It allows attackers to bypass the keychain access prompt, and consequently extract passwords, via a synthetic click...
Security feature bypass
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Security" component. It allows attackers to track users across installs via a crafted app that leverages Keychain data mishandling...
CVE-2017-7150
CVE-2017-7150 affects macOS before 10.13 Supplemental Update. It concerns the Security component and allows bypassing the keychain access prompt via a synthetic click, enabling password extraction. Apple released mitigations through Security Updates (e.g., macOS 10.13.1/2017-001 Sierra and 2017-0...
CVE-2017-7150
An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "Security" component. It allows attackers to bypass the keychain access prompt, and consequently extract passwords, via a synthetic click...
CVE-2017-7146
CVE-2017-7146 affects iOS before 11, involving the Security component. A crafted app could mishandle Keychain data to track users across installs. The issue is documented by Apple’s security content for iOS 11, indicating remediation via updating to iOS 11 or later. If evaluating risk, note that ...
CVE-2017-7146
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Security" component. It allows attackers to track users across installs via a crafted app that leverages Keychain data mishandling...
Apple macOS High Sierra Security Security Bypass Vulnerability
Apple macOS High Sierra is a specialized operating system developed by Apple Inc. for Mac computers.Security component is one of the security components. A security bypass vulnerability exists in the Security component of Apple macOS High Sierra versions prior to 10.13. An attacker can exploit th...
Emergency Apple Patch Fixes High Sierra Password Hint Leak
Apple rushed out an emergency patch Thursday that fixed an incredulous bug in its shiny new High Sierra operating system that revealed APFS volume passwords via the password hint feature. Brazilian researcher Matheus Mariano of Leet Tech found the bug and privately disclosed it to Apple. He said...
About the security content of macOS High Sierra 10.13 Supplemental Update - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...
CVE-2017-1000097
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...
CVE-2017-1000097
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...
AZL-79076 CVE-2017-1000097 affecting package golang 1.26.5-2
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...
Code injection
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...
About the security content of macOS High Sierra 10.13 Supplemental Update
About the security content of macOS High Sierra 10.13 Supplemental Update This document describes the security content of macOS High Sierra 10.13 Supplemental Update. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an...
CVE-2017-1000097
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...
CVE-2017-1000097
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...
CVE-2017-1000097
CVE-2017-1000097 affects Go on Darwin where root-trust preferences in the Keychain are ignored; a Go program could verify a TLS connection using a root certificate that is explicitly not trusted. The connected records (e.g., OSV GO-2022-0171) confirm this misbehavior in crypto/x509 on Darwin and ...
CVE-2017-1000097
Removed by vendor...
A week in security (September 25 – October 01)
Recently, we talked about the hacking incident at Deloitte, one of the 'big four' global accounting firms. It was reported that client email addresses, usernames, and passwords were exposed. This also brought to light weaknesses in their policies and lack of threat intelligence to recover leaked...
On the macOS Keychain Attack, Signal’s New Contact Service, the Deloitte Hack, and More
Mike Mimoso and Chris Brook recap the news of the week, including the macOS Keychain attack, Signal’s new private contact discovery service, the Deloitte hack, and a handful of mobile stock trading app vulnerabilities. Download: ThreatpostNewsWrapSeptember292017.mp3 Music by Chris Gonsalves Show...