Texture Canada Android & iOS Applications - Unencrypted Third Party Analytics (CVE-2019-8632) -- https://www.info-sec.ca/advisories/Texture.html Overview "Texture: Unlimited access to over 100 of the world's best magazines on your computer, smartphone or tablet." (https://play.google.com/store/apps/details?id=com.nim.rogers) (https://itunes.apple.com/ca/app/texture-canada/id649174756) Issue The Texture Canada Android & iOS applications (Android version 4.21.0.1, iOS version 5.11.6 and below) sends potentially sensitive information such as number of app launches, device model, Android or iOS version and screen resolution, unencrypted to a third party site (ScorecardResearch). Impact An attacker who can monitor network traffic could capture potentially sensitive information about the user's device without their knowledge. Timeline July 10, 2018 - Attempted to notify Texture of the issue via security@texture.ca July 10, 2018 - Attempted to notify Texture of the issue via support@texture.ca July 12, 2018 - Provided the details of the issue to Apple via product-security@apple.com May 9, 2019 - Published an advisory to document the issue Solution Upgrade to Android version 4.22.0.4 or iOS version 5.11.10 (U.S. versions are also affected but have not been tested) https://support.apple.com/en-us/HT210110 https://support.apple.com/en-us/HT210111 https://support.apple.com/en-us/HT201222 CVE-ID: CVE-2019-8632