CVE-2014-4483

The CVE is confirmed: CVE-2014-4483 affects Apple FontParser in PDF handling on Apple iOS before 8.1.3, OS X before 10.10.2, and Apple TV before 7.0.3. Root cause is a buffer/bounds-related issue in FontParser when processing font data inside PDFs, enabling a crafted font file to trigger a buffer...

CVE-2014-4485

CVE-2014-4485: Buffer overflow in Foundation XML parser affects iOS before 8.1.3, OS X before 10.10.2, and Apple TV before 7.0.3. Remote code execution or app crash possible via crafted XML. Remediation: update to iOS 8.1.3, OS X 10.10.2, or Apple TV 7.0.3+.

CVE-2014-4487

Affected products include Apple iOS, OS X, and Apple TV, with CVE-2014-4487 in IOHIDFamily. The issue is a buffer overflow in IOHIDFamily that allows arbitrary code execution in a privileged context. Apple references indicate updates: iOS 8.1.3, OS X 10.10.2, and Apple TV 7.0.3, addressing the vu...

CVE-2014-4492

CVE-2014-4492 involves a type confusion vulnerability in libnetcore affecting Apple devices (iOS before 8.1.3, OS X before 10.10.2, Apple TV before 7.0.3) where an attacker can craft an XPC message to sandboxed applications to trigger arbitrary code execution in the networkd context. The root cau...

CVE-2014-4496

CVE-2014-4496 affects Apple iOS before 8.1.3 and Apple TV before 7.0.3, where the mach_port_kobject kernel interface leaked kernel addresses and heap permutation values, aiding ASLR bypass. The issue was addressed by disabling the mach_port_kobject interface in production configurations and is li...

CVE-2014-4480

CVE-2014-4480 affects Apple iOS < 8.1.3 and Apple TV

CVE-2014-4496

The machportkobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3 does not properly restrict kernel-address and heap-permutation information, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app...

CVE-2014-4491: Exposure of Sensitive Information to an Unauthorized Actor

The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence of addresses within an OSBundleMachOHeaders key in a response, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app...

PT-2015-3744

Name of the Vulnerable Software and Affected Versions Apple iOS affected versions not specified Apple Safari affected versions not specified Apple TV affected versions not specified Description The issue allows remote attackers to execute arbitrary code or cause a denial of service memory...

PT-2015-3747

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3 Apple OS X versions prior to 10.10.2 Apple TV versions prior to 7.0.3 Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted font file in a PDF...

PT-2015-3750

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3 Apple OS X versions prior to 10.10.2 Apple TV versions prior to 7.0.3 Description The issue is related to the IOAcceleratorFamily, which does not properly handle resource lists and IOService userclient types...

PT-2015-3751

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3 Apple OS X versions prior to 10.10.2 Apple TV versions prior to 7.0.3 Description A buffer overflow issue in the IOHIDFamily component allows attackers to execute arbitrary code in a privileged context via a...

PT-2015-3754

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3 Apple OS X versions prior to 10.10.2 Apple TV versions prior to 7.0.3 Description The issue concerns the extension APIs in the kernel, which fail to prevent the presence of addresses within an...

PT-2015-3753

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3 Apple OS X versions prior to 10.10.2 Apple TV versions prior to 7.0.3 Description The issue is related to the improper initialization of event queues in IOHIDFamily, which can be exploited by attackers to...

PT-2015-3759

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3 Apple TV versions prior to 7.0.3 Description The issue concerns the mach port kobject interface in the kernel, which does not properly restrict certain information. This makes it easier for attackers to bypass...

CVE-2014-4496: Undefined Security Weakness

The machportkobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3 does not properly restrict kernel-address and heap-permutation information, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app...

PT-2015-3757

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3 Description The issue concerns the Springboard component in Apple iOS, which fails to properly validate signatures. This allows attackers to bypass intended restrictions on the first launch of an app by using ...

CVE-2014-4493: Undefined Security Weakness

The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obtain control of the local app container by leveraging access to an enterprise distribution certificate for signing a crafted app...

CVE-2014-8840: Undefined Security Weakness

The iTunes Store component in Apple iOS before 8.1.3 allows remote attackers to bypass a Safari sandbox protection mechanism by leveraging redirection of an SSL URL to the iTunes Store...

CVE-2014-4476: Improper Restriction of Operations within the Bounds of a Memory Buffer

WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different...