CVE-2013-5141

The kernel in Apple iOS before 7 uses an incorrect data size for a certain integer variable, which allows attackers to cause a denial of service infinite loop and device hang via a crafted application, related to an "integer truncation vulnerability."...

CVE-2013-5151

Mobile Safari in Apple iOS before 7 does not prevent HTML interpretation of a document served with a text/plain content type, which allows remote attackers to conduct cross-site scripting XSS attacks by uploading a file...

CVE-2013-5140

The kernel in Apple iOS before 7 allows remote attackers to cause a denial of service assertion failure and device restart via an invalid packet fragment...

CVE-2013-5145

kextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC messages, which allows local users to 1 load or 2 unload kernel extensions via a crafted message...

CVE-2013-5147

Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card...

Race condition

Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card...

Out-of-bounds

The IOSerialFamily driver in Apple iOS before 7 allows attackers to execute arbitrary code or cause a denial of service out-of-bounds array access via a crafted application...

Integer overflow

The kernel in Apple iOS before 7 uses an incorrect data size for a certain integer variable, which allows attackers to cause a denial of service infinite loop and device hang via a crafted application, related to an "integer truncation vulnerability."...

Code injection

The Sandbox subsystem in Apple iOS before 7 allows attackers to cause a denial of service infinite loop via an application that writes crafted values to /dev/random...

Design/Logic Flaw

The Sandbox subsystem in Apple iOS before 7 determines the sandboxing requirement for a ! application on the basis of the script interpreter instead of the script, which allows attackers to bypass intended access restrictions via a crafted application...

Code injection

Mobile Safari in Apple iOS before 7 allows remote attackers to spoof the URL bar via a crafted web site...

Code injection

The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon...

CVE-2013-5138

IOCatalogue in IOKitUser in Apple iOS before 7 allows attackers to cause a denial of service NULL pointer dereference and device crash via a crafted application...

CVE-2013-5142

The kernel in Apple iOS before 7 does not initialize unspecified kernel data structures, which allows local users to obtain sensitive information from kernel stack memory via the 1 msgctl API or 2 segctl API...

Design/Logic Flaw

IOKit in Apple iOS before 7 allows attackers to send user-interface events to the foreground app by leveraging control over a background app and using the 1 task-completion API or 2 VoIP API...

Code injection

Springboard in Apple iOS before 7 does not properly manage the lock state in Lost Mode, which allows physically proximate attackers to read notifications via unspecified vectors...

Design/Logic Flaw

The Push Notifications subsystem in Apple iOS before 7 provides the push-notification token to an app without user approval, which allows attackers to obtain sensitive information via an app that employs a crafted push-notification registration process...

Null pointer dereference

IOCatalogue in IOKitUser in Apple iOS before 7 allows attackers to cause a denial of service NULL pointer dereference and device crash via a crafted application...

Authorization

kextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC messages, which allows local users to 1 load or 2 unload kernel extensions via a crafted message...

Information disclosure

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...