CVE-2014-4386

CVE-2014-4386 affects Apple iOS prior to 8, where a race condition in App Installation could let a local user escalate privileges and install an unverified app by writing to /tmp. The issue is documented in Apple’s iOS 8 security note (APPLE-SA-2014-09-17-1) with remediation: iOS 8 fixes include ...

CVE-2014-4411

CVE-2014-4411 affects WebKit as used in Apple iOS prior to 8 and Apple TV prior to 7. It enables remote attackers to execute arbitrary code or cause a denial of service via a crafted web site, via memory corruption and application crash. Root cause: memory corruption in WebKit triggered by crafte...

CVE-2014-4412

CVE-2014-4412 affects WebKit as used in Apple iOS before 8 and Apple TV before 7. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and app crash) via a crafted website. Root cause is memory corruption in WebKit; the documents do n...

CVE-2014-4414

CVE-2014-4414 affects WebKit as used in Apple iOS before 8 and Apple TV before 7. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website due to memory corruption in WebKit. This is a WebKit-specific issue distinct from other WebKit C...

CVE-2014-4415

CVE-2014-4415 affects WebKit as used in Apple iOS before 8 and Apple TV before 7 . A crafted web site can trigger memory corruption, allowing a remote attacker to execute arbitrary code or cause a denial of service (application crash). Root cause is memory handling issues in WebKit (as described ...

CVE-2014-4418

Summary of CVE-2014-4418 findings: The issue concerns the IODataQueue implementation in IOKit where kernel trusted fields (queueSize, head, tail) live in a shared memory region mapped into userspace. IOSharedDataQueue extends IODataQueue and places an appendix immediately after the queue, enablin...

CVE-2014-4420

The CVE-2014-4420 entry describes a kernel memory initialization flaw in the network-statistics interface of Apple iOS (pre-8) and Apple TV (pre-7). A crafted application could leak memory contents and layout information from the kernel, similarly to other CVEs in the bundle. The root cause is me...

CVE-2014-4372

syslogd in the syslog subsystem in Apple iOS before 8 and Apple TV before 7 allows local users to change the permissions of arbitrary files via a symlink attack on an unspecified file...

CVE-2014-4362

The Sandbox Profiles implementation in Apple iOS before 8 does not properly restrict the third-party app sandbox profile, which allows attackers to obtain sensitive Apple ID information via a crafted app...

CVE-2014-4356

Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen...

CVE-2014-4419

CVE-2014-4419: Kernel memory disclosure via uninitialized memory in the Apple OS X/iOS network statistics interface (kernel). The issue allows a crafted application to obtain sensitive memory content and memory-layout information. Affected platform references in the public data point to OS X kern...

CVE-2014-4381

Libnotify in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, which allows attackers to execute arbitrary code as root via a crafted application...

CVE-2014-4367

Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attackers to launch unintended calls by speaking a telephone number...

CVE-2014-4410

CVE-2014-4410 affects WebKit as used in Apple iOS before 8 and Apple TV before 7, enabling remote code execution or memory corruption via a crafted web site. Connected sources reference the same WebKit memory-corruption vector and note that patches were released through Apple advisories (e.g., iO...

CVE-2014-4361

CVE-2014-4361 affects the Home & Lock Screen subsystem in Apple iOS before 8, where the private API used to determine the frontmost app lacked sufficient access control. Exploitation would allow a crafted background app to reveal which app is frontmost. The issue is described as a lack of proper ...

CVE-2014-4405

IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context or cause a denial of service NULL pointer dereference via an application that provides crafted key-mapping properties...

CVE-2014-4378

CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive information or cause a denial of service out-of-bounds read and application crash via a crafted PDF document...

CVE-2014-4389

CVE-2014-4389 corresponds to an IODataQueue/IOSharedDataQueue integer overflow in IOKit that could let a crafted API argument overflow queue bounds and corrupt kernel memory, enabling arbitrary code execution with system privileges on affected iOS 7.x/Apple TV 6.x/7.x era devices. Connected mater...

CVE-2014-4422

The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot process, which allows attackers to bypass certain kernel-hardening protection mechanisms by using a user-space process to observe data related to the random numbe...

CVE-2014-4367

The CVE-2014-4367 entry affects Apple iOS versions before 8, where Voice Dial can be triggered during upgrade actions. The underlying issue allows a physically proximate attacker to initiate calls by speaking a telephone number, as documented in multiple sources. According to the Apple security b...