CVE-2014-4412

WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and...

CVE-2014-4414

CVE-2014-4414 affects WebKit as used in Apple iOS before 8 and Apple TV before 7. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website due to memory corruption in WebKit. This is a WebKit-specific issue distinct from other WebKit C...

CVE-2014-4378

CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive information or cause a denial of service out-of-bounds read and application crash via a crafted PDF document...

CVE-2014-4410

WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and...

CVE-2014-4383

CVE-2014-4383 affects the Assets subsystem in Apple iOS (pre-8) and Apple TV (pre-7), where an attacker in a network position can spoof a device’s update status by crafting Last-Modified HTTP response headers, enabling MITM-style deception of update checks. The issue is addressed in iOS 8 and App...

CVE-2014-4377

CVE-2014-4377 affects Apple iOS prior to 8 and Apple TV prior to 7. It is a CoreGraphics memory corruption in PDF handling: specifically an integer overflow in the Indexed color space processing of PDFs that can trigger a heap overflow via a controlled allocation path (x_calloc) and a follow-on m...

CVE-2014-4421

The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4371,...

CVE-2014-4420

The CVE-2014-4420 entry describes a kernel memory initialization flaw in the network-statistics interface of Apple iOS (pre-8) and Apple TV (pre-7). A crafted application could leak memory contents and layout information from the kernel, similarly to other CVEs in the bundle. The root cause is me...

CVE-2014-4404

Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties...

CVE-2014-4357

Accounts Framework in Apple iOS before 8 and Apple TV before 7 allows attackers to obtain sensitive information by reading log data that was not intended to be present in a log...

CVE-2014-4379

CVE-2014-4379 affects IOHIDFamily in Apple iOS (pre-8) and Apple TV (pre-7). The issue is an out-of-bounds read in IOHIDFamily’s handling of a function, allowing a local attacker to read kernel pointers and bypass ASLR. Apple’s remediation is included in iOS 8 and TV OS 7 updates (vendor patch ev...

CVE-2014-4372

CVE-2014-4372 affects Apple iOS before 8 and Apple TV before 7. The vulnerability lies in syslogd in the syslog subsystem, where a local attacker can cause symlink-based file permission changes. The GTISC/Apple TV NASL plugin corroborates the issue as a local-symlink permission escalation within ...

CVE-2014-4388

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than...

CVE-2014-4422

CVE-2014-4422 concerns the Apple kernel hardening RNG used early in the boot process. The connected sources confirm that the issue allowed some RNG output to be inferable by user space, enabling bypass of kernel-hardening protections. A fix was applied by replacing the early-boot RNG with a crypt...

CVE-2014-4407

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to obtain sensitive memory-content information via an application that makes crafted IOKit function calls...

CVE-2014-4357

CVE-2014-4357 affects the Accounts Framework in iOS prior to 8 and Apple TV prior to 7, allowing an attacker to read sensitive user information from logs. The linked Apple security update notes confirm CVE-4357 is addressed in iOS 8 / Apple TV 7 (and later) by updating the Accounts handling; no a...

CVE-2014-4378

CVE-2014-4378 affects CoreGraphics in Apple iOS before 8 and Apple TV before 7. A crafted PDF can trigger an out-of-bounds read, potentially allowing an attacker to obtain sensitive information or cause an application crash (DoS). The vulnerability is due to improper bounds checking in PDF handli...

CVE-2014-4411

CVE-2014-4411 affects WebKit as used in Apple iOS prior to 8 and Apple TV prior to 7. It enables remote attackers to execute arbitrary code or cause a denial of service via a crafted web site, via memory corruption and application crash. Root cause: memory corruption in WebKit triggered by crafte...

CVE-2014-4369

The IOAcceleratorFamily API implementation in Apple iOS before 8 and Apple TV before 7 allows attackers to cause a denial of service NULL pointer dereference and device crash via an application that uses crafted arguments...

CVE-2014-4420

The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4371,...