PT-2014-4137

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 7.1.2 Apple OS X versions prior to 10.9.4 Apple TV versions prior to 6.1.2 Description A heap-based buffer overflow issue exists in launchd, allowing attackers to execute arbitrary code via a crafted application tha...

Apple iOS < 7.1.2 Multiple Vulnerabilities

Binary data appleios712check.nbin...

Apple iOS 7.x < 7.1.1 Multiple Vulnerabilities

Binary data 8275.prm...

Apple iOS multiple security vulnerabilities

Unsafe cookie handling, protection ypass, information leakage, multiple WebKit vulnerabilities...

CVE-2014-1295

Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive...

Design/Logic Flaw

CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP...

CVE-2014-1320

IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object...

CVE-2014-1296

CFNetwork in iOS before 7.1.1, OS X up to 10.9.2, and Apple TV before 6.1.1 mishandles incomplete Set-Cookie headers, allowing a remote attacker to bypass access restrictions by closing the TCP connection during header transmission (HTTPOnly). Public fix/version not specified in the provided docu...

CVE-2014-1320: Exposure of Sensitive Information to an Unauthorized Actor

IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object...

CVE-2014-1295: Improper Authentication

Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive...

PT-2014-4079

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 7.1.1 Apple OS X versions 10.8.x through 10.9.2 Apple TV versions prior to 6.1.1 Description The issue allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple...

Warning: Malware Campaign targeting Jailbroken Apple iOS Devices

A new piece of malicious malware infection targeting jailbroken Apple iOS devices in an attempt to steal users’ credentials, has been discovered by Reddit users. The Reddit Jailbreak community discovered the malicious infection dubbed as ‘Unflod Baby Panda’, on some jailbroken Apple iOS devices o...

Apple iOS multiple security vulnerabilities

Symbolic links vulnerability, root certificates problems, protection bypass, DoS, privilege escalation, memory corruption, information leakage, code execution...

Apple iOS < 7.1.1 Multiple Vulnerabilities

Binary data appleios711check.nbin...

Apple iOS PRNG熵漏洞

Apple iOS是一款运行在苹果iPhone和iPod touch设备上的最新的操作系统。 Apple iOS用于物理内核映射随机化，stack-check guard，zone cookie保护等的Early Random PRNG存在一个缺陷，由于使用弱熵，允许攻击者利用漏洞恢复输出，绕过利用保护机制进行攻击。 0 Apple iOS 7.0 目前没有详细解决方案提供： http://www.apple.com/support/downloads/...

CVE-2014-1275

Buffer overflow in ImageIO in Apple iOS before 7.1 and Apple TV before 6.1 allows remote attackers to execute arbitrary code or cause a denial of service application crash via crafted JPEG2000 data in a PDF document...

CVE-2014-1278

The ptmxgetioctl function in the ARM kernel in Apple iOS before 7.1 and Apple TV before 6.1 allows local users to gain privileges or cause a denial of service out-of-bounds memory access and device crash via a crafted call...

CVE-2014-1287

USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service memory corruption via crafted USB messages...

CVE-2014-1290

WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293...

CVE-2014-1294

WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292...