Design/Logic Flaw

The UIKit Alerts component in Apple iOS before 5 allows remote attackers to cause a denial of service device hang via a long tel: URL that triggers a large size for the acceptance dialog...

Design/Logic Flaw

The Settings component in Apple iOS before 5, when a configuration profile is used for a locale other than English, does not properly implement localization, which makes it easier for attackers to have an unspecified impact by leveraging incorrect configuration display...

CVE-2011-3243

Cross-site scripting XSS vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows...

Design/Logic Flaw

The Home screen component in Apple iOS before 5 does not properly support a certain application-switching gesture, which might allow physically proximate attackers to obtain sensitive state information by watching the device's screen...

CVE-2011-3260

Buffer overflow in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted Microsoft Word document...

CVE-2011-3260

CVE-2011-3260 describes a memory corruption/buffer overflow vulnerability in Apple’s OfficeImport framework used by iOS, triggered when parsing Microsoft Word documents. The issue allowed remote code execution or a denial of service (application crash) on iOS versions before 5. The iDefense/iOS b...

CVE-2011-3243

Cross-site scripting XSS vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows...

CVE-2011-3245

The Keyboards component in Apple iOS before 5 displays the final character of an entered password during a subsequent use of a keyboard, which allows physically proximate attackers to obtain sensitive information by reading this character...

CVE-2011-3253

CalDAV in Apple iOS before 5 does not validate X.509 certificates for SSL sessions, which allows man-in-the-middle attackers to spoof calendar servers and obtain sensitive information via an arbitrary certificate...

CVE-2011-3254

Cross-site scripting XSS vulnerability in Calendar in Apple iOS before 5 allows remote attackers to inject arbitrary web script or HTML via an invitation note...

CVE-2011-3255

CFNetwork in Apple iOS before 5 stores AppleID credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application...

CVE-2011-3426

Cross-site scripting XSS vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header...

CVE-2011-3427

The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate...

CVE-2011-3429

The Settings component in Apple iOS before 5 stores a cleartext parental-restrictions passcode in an unspecified file, which might allow physically proximate attackers to obtain sensitive information by reading this file...

CVE-2011-3434

The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application...

CVE-2011-3253

CalDAV in Apple iOS before 5 does not validate X.509 certificates for SSL sessions, allowing MITM attackers to spoof calendar servers and obtain sensitive information via an arbitrary certificate. Affected: iOS

CVE-2011-3254

The CVE-2011-3254 entry corresponds to a cross-site scripting (XSS) vulnerability in the Calendar component of Apple iOS prior to version 5. The issue allows a remote attacker to inject arbitrary script or HTML via an invitation note, expanding the attack surface to calendar-related interactions....

CVE-2011-3255

The CVE-2011-3255 issue affects CFNetwork in iOS before 5. It arises because AppleID credentials can be stored in a local file, making sensitive information accessible to remote attackers who craft apps that access the file. The core impact is credential exposure and potential leakage of AppleID ...

CVE-2011-3256

CVE-2011-3256 affects FreeType 2 up to 2.4.7 (used in CoreGraphics on Apple iOS before 5 and in Mandriva ES 5; others possibly affected). The vulnerability enables remote code execution or a denial of service via a crafted font due to memory corruption from improper input handling. Public advisor...

CVE-2011-3259

The CVE-2011-3259 vulnerability affects Apple iOS prior to 5 and Apple TV prior to 4.4 where the kernel does not promptly recover memory allocated for incomplete TCP connections. This can allow a remote attacker to cause resource exhaustion leading to a denial of service by establishing numerous ...