4800 matches found
CVE-2013-5145
CVE-2013-5145 involves kextd in Apple iOS before 7, where IPC message authorization is not properly verified. This allows a local attacker to load or unload kernel extensions via a crafted message, representing a local privilege escalation risk. Root cause: missing authorization checks in kextd’s...
CVE-2013-5149
The CVE-2013-5149 affect Apple iOS prior to 7.0, where the push-notification token could be disclosed to an app during registration without user consent. Root cause: token access was granted before user approval. Impact: potential information disclosure via apps. Mitigation: upgrade to iOS 7.0 or...
CVE-2013-5151
CVE-2013-5151 affects Mobile Safari on iOS prior to 7. The issue arises when a document served with Content-Type: text/plain is treated as HTML, allowing remote attackers to trigger cross-site scripting by uploading a file. Apple’s vulnerability entry for Safari (CVE-2013-5151) notes the impact a...
CVE-2013-5152
CVE-2013-5152 affects Mobile Safari on Apple iOS versions prior to 7.0, where a crafted website can spoof the URL bar. The Apple advisory notes addressing this with iOS 7.0 (and later) updates, i.e., remediation via updating to the latest iOS version. No additional technical details (root cause o...
CVE-2013-5154
The CVE-2013-5154 entry describes a sandbox bypass in Apple iOS prior to 7, where the Sandbox subsystem bases the sandboxing requirement for a #! script on the script interpreter rather than the script itself. This allowed crafted applications that used #! to run scripts to bypass intended access...
CVE-2013-5155
CVE-2013-5155 affects Apple iOS prior to 7, specifically the Sandbox subsystem. A malicious or misbehaving app that writes crafted values to /dev/random can trigger an infinite loop, causing a denial of service on the device. Technical detail: the vulnerability arises from how the Sandbox handles...
CVE-2013-5156
CVE-2013-5156 affects Apple iOS before 7, where the Telephony subsystem does not require API conformity for access to telephony-daemon interfaces. A crafted app can bypass restrictions and send direct requests to the daemon, potentially causing interference with telephony functionality. The Apple...
CVE-2013-5158
In Apple iOS before version 7, the Social subsystem did not properly restrict access to the Twitter icon cache, enabling physically proximate attackers to disclose information about recent Twitter interactions. Affected component: Social subsystem cache handling in iOS 6.x and earlier. Root cause...
CVE-2013-5159
The CVE-2013-5159 entry concerns WebKit in Apple iOS prior to 7, where a vulnerability allowed a remote attacker to bypass the Same Origin Policy via an iframe and infer use of the window.webkitRequestAnimationFrame API, potentially exposing information about page behavior. Affected component: We...
CVE-2013-5125
CVE-2013-5125 is listed among Apple iTunes WebKit-related vulnerabilities. Nessus/OpenVAS entries indicate it is part of memory corruption flaws in WebKit (and related components) used by iTunes on Windows, potentially enabling arbitrary code execution via memory corruption when browsing the iTun...
CVE-2013-0957
Data Protection in Apple iOS before 7 allows attackers to bypass intended limits on incorrect passcode entry, and consequently avoid a configured Erase Data setting, by leveraging the presence of an app in the third-party sandbox...
CVE-2013-5159
WebKit in Apple iOS before 7 allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive information about use of the window.webkitRequestAnimationFrame API via an IFRAME element...
CVE-2013-1042
CVE-2013-1042 affects WebKit as used in Apple iOS before version 7. A crafted website can remotely cause memory corruption, leading to arbitrary code execution or a denial of service (application crash). The provided documents do not include a remediation.*
CVE-2013-5158
The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors...
CVE-2013-1040
CVE-2013-1040 is listed among Apple iTunes Windows vulnerabilities prior to version 11.1.4. The connected Nessus/NASL entry indicates the WebKit/libxml/libxslt components may cause memory corruption, enabling remote code execution or a denial of service when visiting the iTunes Store via a crafte...
CVE-2013-5138
CVE-2013-5138 affects Apple iOS (pre-7) with IOCatalogue in IOKitUser. A crafted local app can cause a NULL pointer dereference, leading to a denial of service (device crash). Root cause is described as a NULL pointer dereference in IOCatalogue; no remediation details are provided in the connecte...
CVE-2013-1046
CVE-2013-1046 concerns WebKit as used in Apple iOS prior to version 7. The vulnerability allows a remote attacker to execute arbitrary code or cause a memory corruption crash via a crafted web site, potentially leading to application instability or compromise. The available connected records corr...
CVE-2013-0957
CVE-2013-0957 affects Apple iOS prior to 7, where a privilege-separation issue in Data Protection allowed a third‑party sandboxed app to repeatedly attempt passcode entry, bypassting the device’s Erase Data setting. The root cause is a failure to enforce passcode‑attempt limits across app sandbox...
CVE-2013-5150
CVE-2013-5150 is a Safari history-clearing flaw affecting Apple iOS prior to 7, where clearing a tab’s history did not clear the back/forward history for that open tab. The issue enables physically proximate attackers with access to an unattended workstation to potentially view sensitive informat...