Memory corruption

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1829,...

Heap overflow

The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document...

Design/Logic Flaw

Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document...

Null pointer dereference

ImageIO in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted image...

Design/Logic Flaw

Multiple use-after-free vulnerabilities in the 1 htmlPArsePubidLiteral and 2 htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a...

Heap overflow

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted XML...

CVE-2016-1859

CVE-2016-1859 affects WebKit Canvas in Apple iOS < 9.3.2, Safari < 9.1.1, and tvOS

CVE-2016-1790

Apple iOS CVE-2016-1790 affects the Accessibility component prior to iOS 9.3.2. The issue is a memory safety vulnerability in the Accessibility code path that could allow a crafted app to cause an out-of-bounds read, effectively leaking sensitive kernel memory-layout information. Some sources fra...

CVE-2016-1827

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1828, CVE-2016-1829,...

CVE-2016-1833

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document...

CVE-2016-1818

CVE-2016-1818 affects IOAcceleratorFamily on Apple TV (4th generation) running tvOS 9.2.x up to 9.2.0; root cause is a memory corruption issue that could allow an attacker to execute arbitrary code with kernel privileges. The Apple tvOS 9.2.1 security content (HT206564) notes this CVE and indicat...

CVE-2016-1830

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1828,...

CVE-2016-1802

CVE-2016-1802 affects Apple platforms via a CommonCrypto (CCCrypt) issue: return-value handling during key-length calculations allows a crafted app to obtain sensitive information. Public sources in the Apple security content show the vulnerability and assign CVE-2016-1802 to the CommonCrypto ent...

CVE-2016-1819

CVE-2016-1819 is a use-after-free in IOAccelContext2::clientMemoryForType that affects Apple platforms (iOS prior to 9.3.2, OS X prior to 10.11.5, tvOS prior to 9.2.1, watchOS prior to 2.2.1). The issue can allow an attacker to execute arbitrary code in a privileged context or cause a memory corr...

CVE-2016-1828

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1829,...

CVE-2016-1807

Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows local users to obtain sensitive information from kernel memory via unspecified vectors...

CVE-2016-1856

Technical details for CVE-2016-1856 are not publicly available in the provided documents. The entries reference WebKit components and affected Apple platforms but do not specify affected versions, root cause, exploit status, or fixes. Monitor for updates.

CVE-2016-1819

Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a craft...

CVE-2016-1852

CVE-2016-1852 is tied to iOS prior to 9.3.2 where Siri could expose contacts and photos from the lock screen due to a state-management issue with data detectors in Siri results. The Apple security content for iOS 9.3.2 states the fix involved addressing such issues in that release; remediation is...

CVE-2016-1803

CVE-2016-1803 affects Apple’s CoreCapture component across iOS, OS X, tvOS, and watchOS. The vulnerability is a NULL pointer dereference that could allow a crafted app to execute arbitrary code with kernel or privileged context, or cause a denial of service. Mitigation details from Apple security...