CVE-2014-4372

syslogd in the syslog subsystem in Apple iOS before 8 and Apple TV before 7 allows local users to change the permissions of arbitrary files via a symlink attack on an unspecified file...

CVE-2014-4369

CVE-2014-4369 affects Apple’s IOAcceleratorFamily API: an attacker can trigger a denial of service (NULL pointer dereference) by feeding crafted arguments to apps using the API. The vulnerability spans iOS versions before 8 and Apple TV before 7. Root cause: NULL pointer dereference in IOAccelera...

CVE-2014-4410

CVE-2014-4410 affects WebKit as used in Apple iOS before 8 and Apple TV before 7, enabling remote code execution or memory corruption via a crafted web site. Connected sources reference the same WebKit memory-corruption vector and note that patches were released through Apple advisories (e.g., iO...

CVE-2014-4377

Integer overflow in CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted PDF document...

CVE-2014-4371

The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4419,...

CVE-2014-4389

Integer overflow in IOKit in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted API arguments...

CVE-2014-4421

CVE-2014-4421 involves the kernel’s network-statistics interface where memory is not properly initialized in iOS before 8 and Apple TV before 7, allowing an attacker’s crafted app to obtain sensitive memory-content and memory-layout information. The connected documents also list CVE-2014-4421 amo...

CVE-2014-4389

CVE-2014-4389 corresponds to an IODataQueue/IOSharedDataQueue integer overflow in IOKit that could let a crafted API argument overflow queue bounds and corrupt kernel memory, enabling arbitrary code execution with system privileges on affected iOS 7.x/Apple TV 6.x/7.x era devices. Connected mater...

CVE-2014-4404

CVE-2014-4404 describes a heap-based buffer overflow in IOHIDFamily that affects Apple iOS prior to 8 and Apple TV prior to 7. The vulnerability occurs when parsing crafted key-mapping properties, enabling an attacker to execute arbitrary code in a privileged context via a user-space application....

CVE-2014-4415

CVE-2014-4415 affects WebKit as used in Apple iOS before 8 and Apple TV before 7 . A crafted web site can trigger memory corruption, allowing a remote attacker to execute arbitrary code or cause a denial of service (application crash). Root cause is memory handling issues in WebKit (as described ...

CVE-2014-4373

CVE-2014-4373: In Apple’s IOAcceleratorFamily, the IntelAccelerator driver on iOS (before v8) and Apple TV (before v7) contains a NULL pointer dereference that can be triggered by a crafted app, leading to a denial of service (and device restart). Apple’s remediation is to improve error handling ...

CVE-2014-4422

The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot process, which allows attackers to bypass certain kernel-hardening protection mechanisms by using a user-space process to observe data related to the random numbe...

CVE-2014-4418

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than...

CVE-2014-4407

CVE-2014-4407 affects Apple IOKit on iOS (pre-8) and Apple TV (pre-7). Root cause: uninitialized kernel memory in IOKit functions leading to memory-content disclosure via crafted IOKit calls. Public details show IODataQueue/IOKit memory initialization issues; impact is kernel memory disclosure. R...

CVE-2014-4418

Summary of CVE-2014-4418 findings: The issue concerns the IODataQueue implementation in IOKit where kernel trusted fields (queueSize, head, tail) live in a shared memory region mapped into userspace. IOSharedDataQueue extends IODataQueue and places an appendix immediately after the queue, enablin...

PT-2014-5868 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 8 Apple TV versions prior to 7 Description: The issue is related to a heap-based buffer overflow in the IOHIDFamily component, allowing attackers to execute arbitrary code in a privileged context. This can be...

CVE-2014-4404

Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assess...

Apple Releases Security Updates for iOS, Apple TV, and Xcode

Apple released security updates for iOS devices, Apple TV, and Xcode to address multiple vulnerabilities, some of which could allow attackers to execute code with system privileges or cause an unexpected application termination. Updates available include: iOS 8 for iPhone 4s and later, iPod touch...

CVE-2014-5877

The TV Guide aka net.micene.minigroup.palimpsests.lite application 5.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The TV Guide aka net.micene.minigroup.palimpsests.lite application 5.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...