CVE-2017-2480

The CVE-2017-2480 entry concerns WebKit in multiple Apple platforms (iOS before 10.3, Safari before 10.1, iCloud/iTunes on Windows, tvOS before 10.2). The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. Connected documents co...

CVE-2017-2470

CVE-2017-2470 affects WebKit components across Apple devices (iOS before 10.3, Safari before 10.1, tvOS before 10.2). The issue enables remote arbitrary code execution or memory corruption via a crafted web site, potentially crashing the application. Root cause involves memory corruption in WebKi...

CVE-2017-2478

CVE-2017-2478 describes a race condition in Apple’s Kernel across iOS, macOS, tvOS and watchOS that could allow a crafted app to execute code with kernel privileges. The connected Apple security entries indicate the issue affected multiple platforms (iOS <10.3, macOS <10.12.4, tvOS <10.2...

CVE-2017-2416

CVE-2017-2416 involves a memory corruption in ImageIO across Apple platforms. A crafted image can trigger remote code execution or DoS. Affected: iOS <10.3, macOS <10.12.4, tvOS <10.2, watchOS

CVE-2017-2428

CVE-2017-2428 affects nghttp2 before 1.17.0 in the HTTPProtocol component across Apple products (iOS <10.3, macOS <10.12.4, tvOS <10.2, watchOS

CVE-2017-2456

CVE-2017-2456 is a kernel race condition in Apple’s XNU mach_msg handling that can enable arbitrary code execution in kernel space via a non-atomic vm_map_copy move optimization. The connected Project Zero analysis details how two concurrent threads may trigger a flawed move path during vm_map_co...

CVE-2017-2472

CVE-2017-2472 affects Apple OSes (iOS < 10.3, macOS < 10.12.4, tvOS < 10.2, watchOS

CVE-2017-2440

CVE-2017-2440 is described in Apple advisories as a Kernel-level integer overflow issue that could allow a crafted app to execute arbitrary code with kernel privileges or cause a denial of service. Affected platforms include iOS prior to 10.3, macOS prior to 10.12.4, tvOS prior to 10.2, and watch...

CVE-2017-2475

CVE-2017-2475 affects WebKitGTK+ (and WebKit in related builds) with UXSS via crafted frames on malicious websites. Public docs in connected sources describe CVE-2017-2475 as a cross-site scripting/UXSS issue in WebKit components. Mitigation as per Gentoo and Arch Linux advisories is to upgrade W...

CVE-2017-2490

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause...

CVE-2017-2406

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "FontParser" component. It allows remote attackers to execute arbitrary code or cause a denial of...

CVE-2017-2447

CVE-2017-2447 concerns WebKit in Apple products (iOS, Safari, tvOS) with impact described as information disclosure and potential memory corruption. Connected sources confirm a WebKit issue that could allow remote attackers to obtain sensitive information or cause a denial of service via crafted ...

CVE-2017-2482

CVE-2017-2482 is a kernel heap overflow in the BSD Packet Filter (bpf) BIOCSBLEN handling in Apple’s XNU kernel. The vulnerability allows an unauthenticated user-space process to manipulate the kernel heap by changing the bpf buffer size and reattaching interfaces, enabling potential kernel-level...

CVE-2017-2396

CVE-2017-2396 affects Apple WebKit in iOS (pre-10.3), Safari (pre-10.1), and tvOS (pre-10.2). Remote code execution or memory corruption leading to application crash via a crafted web site is described; root cause is memory corruption in WebKit when handling web content. Remediation is available:...

CVE-2017-2367

CVE-2017-2367 is documented as a WebKit/Safari family issue affecting Apple platforms (iOS before 10.3, Safari before 10.1, tvOS before 10.2). The description states a remote attacker can bypass the Same Origin Policy and obtain sensitive information via a crafted website. Connected docs enumerat...

CVE-2017-2379

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Carbon" component. It allows remote attackers to execute arbitrary code or cause a denial of...

CVE-2017-2458

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Keyboards" component. A buffer overflow allows attackers to execute arbitrary code in a privilege...

CVE-2017-2446

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages the mishandling of...

CVE-2017-2445

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS UXSS attacks via crafted frame objects...

CVE-2017-2472

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause...