Code injection

Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 mishandle signed disk images, which allows attackers to execute arbitrary code in a privileged context via a crafted app...

Code injection

WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 support...

Memory corruption

WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4735...

Code injection

WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site...

Memory corruption

WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4734...

Memory corruption

WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-4731...

CVE-2016-4763

WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2016-4729

WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-4731...

UBUNTU-CVE-2016-4758

WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site...

CVE-2016-4711

The CVE-2016-4711 entry applies to CCrypt in corecrypto within CommonCrypto, affecting iOS before 10 and macOS before 10.12. Description: an input/output buffer aliasing issue allows an attacker to recover plaintext by a function call that uses the same buffer for input and output. Impact: inform...

CVE-2016-4738

CVE-2016-4738 is a memory corruption vulnerability in libxslt. The issue occurs in the XSLT processing runtime library (libxslt) and could allow a remote attacker to execute arbitrary code or cause a denial of service when a crafted web page is processed. Debian’s security advisory DSA-3709-1 con...

CVE-2016-4730

CVE-2016-4730 affects WebKit in Apple iOS prior to 10, Safari prior to 10, and tvOS prior to 10. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Root cause: memory corruption in WebKit when handling web c...

CVE-2016-4611

CVE-2016-4611 affects WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. The description does not provide affected product versions beyond...

CVE-2016-4767

CVE-2016-4767 affects WebKit used in Apple iOS (pre-10) , tvOS (pre-10) , iTunes (pre-12.5.1 on Windows) , and Safari (pre-10) . The root cause is memory corruption in WebKit that enables a remote attacker to execute arbitrary code or cause a denial of service via a crafted web site. The availabl...

CVE-2016-4778

CVE-2016-4778 affects the Kernel on Apple platforms (iOS before 10, macOS before 10.12, tvOS before 10, watchOS before 3). It enables arbitrary code execution in a privileged context or memory corruption via a crafted app. Apple’s security content pages indicate fixes in iOS 10, macOS Sierra 10.1...

CVE-2016-4728

CVE-2016-4728 affects WebKit in Apple iOS (pre-10), tvOS (pre-10), iTunes for Windows (pre-12.5.1) and Safari (pre-10). Root cause: mishandling of error prototypes, enabling remote attackers to execute arbitrary code via a crafted webpage. Public fixes exist: iOS/tvOS Safari patches in subsequent...

CVE-2016-4658

xpointer.c in libxml2 before 2.9.5 as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free an...

CVE-2016-4777

The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service invalid pointer dereference via a crafted app...

CVE-2016-4728

WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site...

CVE-2016-4776

CVE-2016-4776 concerns the kernel in Apple platforms prior to updates listed below: iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3. An attacker who can run a crafted app may obtain sensitive memory-layout information or cause a denial of service via an out-of-bounds read i...