Threats affecting pkg:swift/linecorp/line-client-ios

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable.

LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions.

LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications.

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.

CVE-2023-5554 is a medium-severity vulnerability affecting the LINE client for iOS versions prior to 13.16.0, specifically version 13.12.0. The flaw involves a lack of TLS certificate verification during log transmission in a financial module, which could allow an attacker to intercept or manipulate sensitive data. Exploitation requires network access but no user interaction or privileges. While no known exploits are currently in the wild, the vulnerability impacts confidentiality and integrity of transmitted data. European organizations using LINE for financial communications on iOS devices should prioritize updating to patched versions. Mitigations include updating the app, using secure network environments, and monitoring for suspicious network activity.