DER Entitlements: The (Brief) Return of the Psychic Paper
Google Project Zero's Ivan Fratric describes CVE-2022-42855, a flaw in how Apple operating systems checked app entitlements, which were stored as XML and parsed by four different parsers in different places. Because the parsers could disagree on the same...