CVE-2016-4637

CVE-2016-4637 affects Apple platforms (iOS prior to 9.3.3, OS X prior to 10.11.6, tvOS prior to 9.2.2, watchOS prior to 2.2.2). The issue arises in CoreGraphics BMP image decoding, where a crafted BMP can trigger memory corruption, enabling remote code execution or a denial of service. Publicly d...

CVE-2016-4632

ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service memory consumption via unspecified vectors...

CVE-2016-4631

CVE-2016-4631 affects Apple ImageIO's TIFF handling across iOS before 9.3.3, macOS before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2. The issue is a memory corruption/heap overflow in TIFF tile processing inside ImageIO, caused by reading tiles into a buffer sized for a minimal tile (ti...

CVE-2016-4651

Cross-site scripting XSS vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting XPXSS" vulnerability...

CVE-2016-4604

This CVE affects Safari on iOS (pre-9.3.3). The vulnerability allows a remote attacker to spoof the displayed URL by delivering an HTTP redirect to an invalid TCP port, enabling potential UI spoofing of the address bar. Affected product/area: Safari in iOS. Root cause: improper handling of redire...

CVE-2016-4587

WebKit in Apple iOS before 9.3.3 and tvOS before 9.2.2 allows remote attackers to obtain sensitive information from uninitialized process memory via a crafted web site...

CVE-2016-4587

CVE-2016-4587 affects WebKit in Apple iOS versions before 9.3.3 and tvOS versions before 9.2.2. The described flaw enables remote attackers to obtain sensitive information from uninitialized process memory when visiting a crafted website. The issue is categorized as an information-disclosure vuln...

CVE-2016-4582

The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-1863 and CVE-2016-4653...

CVE-2016-4605

Apple iOS 9.3.3 fixes a Calendar denial-of-service flaw (CVE-2016-4605) caused by a NULL pointer dereference when processing a crafted calendar invitation. Affected: iOS 9.3.x devices (Calendar component). Root cause: memory handling issue leading to device restart. Remediation: install iOS 9.3.3...

CVE-2016-4616

CVE-2016-4616 is a libxml2 vulnerability affecting Apple platforms (iOS 9.3.3, OS X 10.11.6, and corresponding Apple apps) where parsing a maliciously crafted XML document could cause memory corruption and may lead to disclosure of user information. The issue is categorized as a memory handling p...

CVE-2016-4593

The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors...

CVE-2016-4609

CVE-2016-4609 affects libxslt across Apple platforms: iOS prior to 9.3.3, OS X prior to 10.11.6, iTunes prior to 12.4.2 on Windows, iCloud prior to 5.2.1 on Windows, tvOS prior to 9.2.2, and watchOS prior to 2.2.2. The vulnerability allows remote attackers to cause a denial of service via memory ...

CVE-2016-4622

CVE-2016-4622 : WebKit-based components in Apple iOS prior to 9.3.3, Safari prior to 9.1.2, and tvOS prior to 9.2.2 are vulnerable to a crafted website that can lead to remote code execution or memory corruption. The entry notes this is a different issue from CVE-2016-4589, CVE-2016-4623, and CVE...

CVE-2016-4626

IOHIDFamily in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service NULL pointer dereference via unspecified vectors...

CVE-2016-4582

CVE-2016-4582 affects Apple kernel components across iOS ≤9.3.3, OS X ≤10.11.6, tvOS ≤9.2.2, and watchOS ≤2.2.2. Description: local memory corruption may let a user escalate privileges or cause a denial of service; vectors are unspecified and separate from CVE-2016-1863 and CVE-2016-4653. In Appl...

CVE-2016-4614

CVE-2016-4614 affects libxml2 used by Apple platforms (iOS before 9.3.3, OS X before 10.11.6, iTunes/iCloud on Windows, tvOS, watchOS). The base description notes memory corruption with remote triggering via unknown vectors, and potential unspecified impact. Connected documents corroborate libxml...

CVE-2016-4627

IOAcceleratorFamily in Apple iOS before 9.3.3, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service NULL pointer dereference via unspecified vectors...

CVE-2016-4605

Calendar in Apple iOS before 9.3.3 allows remote attackers to cause a denial of service NULL pointer dereference and device restart via a crafted invitation...

CVE-2016-4610

CVE-2016-4610 affects libxslt in multiple Apple platforms: iOS (pre-9.3.3), OS X (pre-10.11.6), iTunes (pre-12.4.2 on Windows), iCloud (pre-5.2.1 on Windows), tvOS (pre-9.2.2), and watchOS (pre-2.2.2). The vulnerability allows remote attackers to cause a denial of service through memory corruptio...

CVE-2016-4585

Cross-site scripting XSS vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari...