CVE-2015-1108

The Lock Screen component in Apple iOS before 8.3 does not properly enforce the limit on incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making many passcode guesses...

CVE-2015-1092

NSXMLParser in Foundation in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2015-1099

Race condition in the setreuid system-call implementation in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service via a crafted app...

CVE-2015-1126

CVE-2015-1126 affects WebKit components used in Apple iOS prior to 8.3 and Apple Safari prior to 6.2.5, 7.x prior to 7.1.5, and 8.x prior to 8.0.5. The vulnerability arises from improper handling of the userinfo field in FTP URLs, enabling remote attackers to trigger incorrect resource access via...

CVE-2015-1097

IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app...

CVE-2015-1126

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors...

CVE-2015-1099

CVE-2015-1099 is a race condition in the kernel setreuid system-call that can cause a denial of service. Affected products include Apple iOS prior to 8.3, OS X prior to 10.10.3, and Apple TV prior to 7.2. Exploitation details are not provided beyond “crafted app”; remediation is to update to the ...

CVE-2015-1087

CVE-2015-1087 : Directory traversal vulnerability in the iOS Backup system (Apple) due to flawed relative-path evaluation. This allowed reading restricted files from the device. Affected: iOS versions prior to 8.3 (reported across multiple Apple device families). Impact: potential exposure of res...

CVE-2015-1116

The CVE-2015-1116 entry concerns Apple iOS UIKit View, where before iOS 8.3, application snapshots shown in the Task Switcher were not blurred, enabling local attackers in close proximity to read sensitive information from the screen. Affected software: iOS versions prior to 8.3 (UIKit View snaps...

CVE-2015-1086

The Audio Drivers subsystem in Apple iOS before 8.3 and Apple TV before 7.2 does not properly validate IOKit object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app...

CVE-2015-1116

The UIKit View component in Apple iOS before 8.3 displays unblurred application snapshots in the Task Switcher, which makes it easier for physically proximate attackers to obtain sensitive information by reading the device screen...

CVE-2015-1123

WebKit, as used in Apple iOS before 8.3 and Apple TV before 7.2, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-3 and...

CVE-2015-1096

IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app...

CVE-2015-1094

The connected WatchOS advisory (APPLE-SA-2015-05-19-1) confirms CVE-2015-1094 affects IOAcceleratorFamily and could allow a malicious app to disclose kernel memory. Description: the issue caused kernel memory disclosure and was mitigated by removing unneeded code in IOAcceleratorFamily; the fix i...

CVE-2015-1118

libnetcore in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service memory corruption and application crash via a crafted configuration profile...

CVE-2015-1115

CVE-2015-1115 affects Apple's iOS Telephony component prior to iOS 8.3, where an attacker could bypass sandbox protections and access restricted telephony features via a crafted app. The issue stems from an access-control weakness in the Telephony subsystem (sandbox/entitlement handling). Apple r...

CVE-2015-1118

CVE-2015-1118 affects libnetcore on Apple iOS <8.3, macOS <10.10.3, and Apple TV

CVE-2015-1090

CVE-2015-1090 affects CFNetwork in Apple iOS before 8.3. The vulnerability occurs because HTTP Strict Transport Security (HSTS) state is not deleted when Safari history is cleared, enabling an attacker to read sensitive information from the history file. The issue is addressed in iOS 8.3; upgrade...

CVE-2015-1123

CVE-2015-1123 affects WebKit as used in Apple iOS before 8.3 and Apple TV before 7.2. The description states that a crafted website can cause remote code execution or a denial of service (memory corruption and application crash). The root cause is memory corruption in WebKit leading to either arb...

CVE-2015-1125

The CVE-2015-1125 issue is in WebKit’s touch-events handling on Apple iOS prior to 8.3. A crafted website could cause a tap to be associated with an unintended web resource, enabling potential user interaction with a resource different from the tapped one. Affected software is WebKit-based render...