CVE-2016-4677

CVE-2016-4677 affects Apple WebKit components in iOS (pre-10.1), Safari (pre-10.0.1), and tvOS (pre-10.0.1). The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site, due to memory corruption in WebKit’s handling of web content. The public do...

CVE-2016-4665

CVE-2016-4665 is an Apple vulnerability affecting the Sandbox Profiles component, allowing a crafted app to read audio-recording metadata on affected systems. The issue is listed for iOS prior to 10.1, tvOS prior to 10.0.1, and watchOS prior to 3.1. Affected products include iPhone/iPad/iPod touc...

CVE-2016-7613

CVE-2016-7613 affects Apple OS X/macOS/iOS family. Apple documents show kernel-level local code execution due to multiple object-lifetime issues in MIG-generated code when spawning new processes. Affected: macOS Sierra 10.12 (and earlier OS X versions), iOS 10.1, watchOS/tvOS/macOS variants; Atta...

CVE-2016-4675

CVE-2016-4675 affects Apple platforms via the libxpc component. The issue is a logic flaw that could allow an attacker to execute arbitrary code in a privileged context when a crafted app is involved, on macOS Sierra 10.12.x, iOS 10.x, tvOS 10.x, and watchOS 3.x. Apple addressed this with securit...

CVE-2017-2350

Affected products: iOS <10.2.1, Safari <10.0.3, tvOS

CVE-2016-7626

CVE-2016-7626 affects Apple platforms (iOS < 10.2, tvOS < 10.1, watchOS

CVE-2016-4669

This CVE corresponds to a Safari WebKit JIT exploit for iOS 7.1.2 that chain-exploits a JIT optimization bug (CVE-2016-4669) to write shellcode into RWX memory, obtain kernel RW/root, and disable code signing. The linked Metasploit/PacketStorm entries confirm a kernel-level exploit used to run a ...

CVE-2017-2373

CVE-2017-2373 concerns a memory-related issue in WebKit used by Apple products. The advisory states that iOS < 10.2.1, Safari < 10.0.3, and tvOS

CVE-2017-2369

The CVE-2017-2369 entry affects WebKit in Apple products (iOS < 10.2.1, Safari < 10.0.3, tvOS

CVE-2017-2365

CVE-2017-2365 affects Apple WebKit components across iOS (pre-10.2.1), Safari (pre-10.0.3), and tvOS (pre-10.1.1). The issue enables cross-origin data exfiltration via crafted web content and is described in Apple’s security content for iOS 10.2.1 and tvOS 10.1.1. Apple indicates patches exist in...

CVE-2017-2363

CVE-2017-2363 affects Apple WebKit components across iOS (iOS before 10.2.1), Safari (before 10.0.3), tvOS (before 10.1.1) and watchOS (before 3.1.3). The issue permits a remote attacker to bypass the Same Origin Policy and exfiltrate sensitive data via a crafted web site, due to a WebKit prototy...

CVE-2017-2362

CVE-2017-2362 affects WebKit in Apple devices: iOS before 10.2.1, Safari before 10.0.3, and tvOS before 10.1.1. The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site, involving memory corruption and application crash. The root cause is des...

CVE-2016-7584

CVE-2016-7584 affects Apple platforms (iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, watchOS before 3.1) in the AppleMobileFileIntegrity component. Root cause: a validation issue in handling code signatures that allows a signed executable to be substituted if it uses the same team ID...

CVE-2017-2370

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or...

CVE-2016-4679

CVE-2016-4679 affects Apple OSes (iOS <10.1, macOS <10.12.1, tvOS <10.0.1, watchOS

CVE-2016-4673

CVE-2016-4673 (Apple CoreGraphics JPEG bug) affects multiple Apple OSes: iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, watchOS before 3.1. A memory corruption issue in CoreGraphics may allow arbitrary code execution or memory corruption leading to a crash when processing a crafted JP...

CVE-2017-2370

CVE-2017-2370 is a kernel vulnerability affecting iOS (pre-10.2.1), macOS (pre-10.12.3), tvOS (pre-10.1.1) and watchOS (pre-3.1.3). It stems from a linear heap buffer overflow in the kernel, triggered via an attacker-controlled length argument in a copyin-like path within mach_voucher_extract_att...

CVE-2016-4664

CVE-2016-4664 affects iOS before 10.1, tvOS before 10.0.1, and watchOS before 3.1. The issue is in Sandbox Profiles, allowing a crafted app to read metadata for photo directories. The Apple TV/Sandbox Profiles entries mirror this access issue (metadata disclosure for photo directories) alongside ...

CVE-2016-4764

CVE-2016-4764 concerns WebKit in Apple platforms (iOS 10 and Safari 10 predecessors, tvOS 10, iTunes 12.5.1) with remote code execution and memory corruption via crafted web content. The issue is tracked across multiple vendors/documents; Apple advisories for iOS 10/tvOS 10 describe patches and m...

CVE-2016-4660

CVE-2016-4660 affects Apple platforms via the FontParser component. Public docs show an out-of-bounds read in a crafted font could disclose data or cause a denial of service, with related entries describing a buffer overflow that could lead to arbitrary code execution. Affected products include i...