CVE-2015-6993

The CVE-2015-6993 issue affects Apple’s FontParser in iOS (before 9.1) and OS X (before 10.11.1). A crafted font file can lead to remote arbitrary-code execution or a denial of service via memory corruption. Primary vulnerable component: FontParser; root cause centered on parsing a font file craf...

CVE-2015-5929

WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in...

CVE-2015-6990

FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6991, CVE-2015-6993,...

CVE-2015-5939

CVE-2015-5939 affects Apple ImageIO in iOS (pre-9.1), OS X (pre-10.11.1), and watchOS (pre-2.0.1). The vulnerability allows remote attackers to trigger arbitrary code execution or a denial of service via crafted metadata embedded in an image, resulting in memory corruption. The accompanying conne...

CVE-2015-6977

FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993,...

CVE-2015-6991

FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6993,...

CVE-2015-5928

CVE-2015-5928 affects WebKit as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1. A crafted web site can cause remote code execution or a denial of service through memory corruption. The connected advisories indicate this vulnerability was addressed in downstream WebKit...

CVE-2015-6996

IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted app...

CVE-2015-6991

Technical details for CVE-2015-6991 are not publicly provided in the connected documents; monitor for updates.

CVE-2015-7022

The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app...

CVE-2015-7005

WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1...

CVE-2015-7004

The kernel in Apple iOS before 9.1 allows attackers to cause a denial of service via a crafted app...

CVE-2015-6997

The X.509 certificate-trust implementation in Apple iOS before 9.1 does not recognize that the kSecRevocationRequirePositiveResponse flag implies a revocation-checking requirement, which makes it easier for man-in-the-middle attackers to spoof endpoints by leveraging access to a revoked certifica...

Memory corruption

WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1...

CVE-2015-6981

WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1...

Memory corruption

GasGauge in Apple iOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

Design/Logic Flaw

The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certificate...

Memory corruption

WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1...

CVE-2015-6982

WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1...

Type confusion

com.apple.driver.AppleVXD393 in the Graphics Driver subsystem in Apple iOS before 9.1 allows attackers to execute arbitrary code via a crafted app that leverages an unspecified "type confusion."...