Improper Restriction of XML External Entity Reference (‘XXE’) vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
Posted by Apple Product Security via Fulldisclosure on Sep 12
APPLE-SA-2022-09-12-5 Safari 16
Safari 16 addresses the following issues.
Information about the security content is also available at https://support.apple.com/HT213442.
Safari Extensions
Available for: macOS Big Sur and macOS Monterey
Impact: A website may be able to track users through Safari web
extensions
Description: A logic issue was addressed with improved state
management.
WebKit Bugzilla: 242278
CVE-2022-32868: Michael
Posted by Apple Product Security via Fulldisclosure on Sep 12
APPLE-SA-2022-09-12-4 macOS Monterey 12.6
macOS Monterey 12.6 addresses the following issues.
Information about the security content is also available at https://support.apple.com/HT213444.
ATS
Available for: macOS Monterey
Impact: An app may be able to bypass Privacy preferences
Description: A logic issue was addressed with improved state
management.
CVE-2022-32902: Mickey Jin (@patch1t)
iMovie
Available for: macOS Monterey
Impact: A user may…
Posted by Apple Product Security via Fulldisclosure on Sep 12
APPLE-SA-2022-09-12-2 iOS 15.7 and iPadOS 15.7
iOS 15.7 and iPadOS 15.7 addresses the following issues.
Information about the security content is also available at https://support.apple.com/HT213445.
Contacts
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2
and later, iPad 5th generation and later, iPad mini 4 and later, and
iPod touch (7th generation)
Impact: An app may be able to bypass Privacy preferences
Description:…
Contacts
Available for: iPhone 8 and later
Impact: An app may be able to bypass Privacy preferences
Description: This issue was addressed with improved checks.
CVE-2022-32854: Holger Fuhrmannek of Deutsche Telekom Security
