CVE-2016-1856

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857...

CVE-2016-1811

CVE-2016-1811 affects ImageIO in Apple products: iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1. Root cause: a crafted image leads to a NULL pointer dereference, causing a denial of service. Apple’s security notes for tvOS 9.2.1 list ImageIO remediation; update...

CVE-2016-1803

CVE-2016-1803 affects Apple’s CoreCapture component across iOS, OS X, tvOS, and watchOS. The vulnerability is a NULL pointer dereference that could allow a crafted app to execute arbitrary code with kernel or privileged context, or cause a denial of service. Mitigation details from Apple security...

CVE-2016-1839

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document...

CVE-2016-1834

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted XML...

CVE-2016-1840

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a...

CVE-2016-1841

CVE-2016-1841 affects libxslt as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Connected advisories/plug...

CVE-2016-1857

CVE-2016-1857 affects WebKit as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1. Root cause: memory corruption in WebKit via a crafted website, enabling remote code execution or a denial of service. Exploitation status: not detailed in provided docs. Mitigation: update ...

CVE-2016-1818

CVE-2016-1818 affects IOAcceleratorFamily on Apple TV (4th generation) running tvOS 9.2.x up to 9.2.0; root cause is a memory corruption issue that could allow an attacker to execute arbitrary code with kernel privileges. The Apple tvOS 9.2.1 security content (HT206564) notes this CVE and indicat...

CVE-2016-1852

CVE-2016-1852 is tied to iOS prior to 9.3.2 where Siri could expose contacts and photos from the lock screen due to a state-management issue with data detectors in Siri results. The Apple security content for iOS 9.3.2 states the fix involved addressing such issues in that release; remediation is...

CVE-2016-1854

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and CVE-2016-1857...

CVE-2016-1859

The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site...

CVE-2016-1834

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted XML...

CVE-2016-1841

libxslt, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site...

CVE-2016-1856

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857...

CVE-2016-1835

Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document...

CVE-2016-1839

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document...

CVE-2016-1833

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document...

Apple iOS < 9.3.2 Multiple Vulnerabilities

Binary data appleios932check.nbin...

Apple iOS MDM Profile Signing Bypass

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple iOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of signed...