CVE-2016-1840

CVE-2016-1840: libxml2 contains a heap-based buffer overflow in xmlFAParsePosCharGroup (pre-2.9.4). Affected on Apple iOS (pre-9.3.2), OS X (pre-10.11.5), tvOS (pre-9.2.1), watchOS (pre-2.2.1); can lead to remote code execution or memory corruption. Remediation: upgrade libxml2 to 2.9.4 or later ...

CVE-2016-1858

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, improperly tracks taint attributes, which allows remote attackers to obtain sensitive information via a crafted web site...

CVE-2016-1811

CVE-2016-1811 affects ImageIO in Apple products: iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1. Root cause: a crafted image leads to a NULL pointer dereference, causing a denial of service. Apple’s security notes for tvOS 9.2.1 list ImageIO remediation; update...

CVE-2016-1807

CVE-2016-1807 affects Apple’s Disk Images subsystem across iOS (before 9.3.2), OS X (before 10.11.5), tvOS (before 9.2.1), and watchOS (before 2.2.1). The vulnerability is a race condition in Disk Images parsing/handling that can allow a local user to read kernel memory, i.e., obtain sensitive in...

CVE-2016-1819

Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a craft...

CVE-2016-1854

Technical details about CVE-2016-1854 are not publicly provided in the supplied documents. Monitor for updates from authoritative advisories (vendor/standard CVE trackers) for affected products, impact, and remediation.

CVE-2016-1855

CVE-2016-1855 affects WebKit used in Apple iOS prior to 9.3.2, Safari prior to 9.1.1, and tvOS prior to 9.2.1. Root cause: memory corruption via a crafted web site, enabling remote code execution or a denial of service. Affected components: WebKit (Apple browser engines). Impact: remote code exec...

CVE-2016-1817

CVE-2016-1817 affects the IOAcceleratorFamily in Apple operating systems. The vulnerability enables memory corruption and potentially arbitrary code execution in a privileged context, or a denial of service, via a crafted app. Affected platforms and versions include: iOS prior to 9.3.2, OS X prio...

CVE-2016-1856

Technical details for CVE-2016-1856 are not publicly available in the provided documents. The entries reference WebKit components and affected Apple platforms but do not specify affected versions, root cause, exploit status, or fixes. Monitor for updates.

CVE-2016-1827

CVE-2016-1827 is a kernel heap overflow in the flow_divert path (flow_divert_handle_app_map_create) on macOS OS X and iOS, enabling local privilege escalation to kernel/privileged context or memory corruption via a crafted app. Exploitation requires root on affected platforms; an exploit exists i...

CVE-2016-1857

CVE-2016-1857 affects WebKit as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1. Root cause: memory corruption in WebKit via a crafted website, enabling remote code execution or a denial of service. Exploitation status: not detailed in provided docs. Mitigation: update ...

CVE-2016-1847

CVE-2016-1847 affects WebKit/OpenGL on Apple TV (4th generation) with tvOS 9.2.1 and earlier. The root cause is an insufficient taint-tracking issue in parsing SVG images, enabling data disclosure when processing malicious web content. tvOS 9.2.1 includes the security update addressing this CVE.

CVE-2016-1830

CVE-2016-1830 is listed in Apple security content as a Kernel memory corruption issue affecting OS X El Capitan and tvOS (and related iOS watchOS entries) with the TV 4th generation reference, indicating a kernel-level vulnerability that could allow arbitrary code execution in a privileged contex...

CVE-2016-1808

The Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-1828

CVE-2016-1827: Kernel heap overflow in flow_divert_handle_app_map_create on OS X and iOS. Root-privilege exploitation possible; memory corruption may lead to kernel compromise. Patched in OS X 10.11.5 and iOS 9.3.2; exploit code/public PoC exists (flow_divert-heap-overflow) describing OS X Yosemi...

CVE-2016-1833

CVE-2016-1833 is a libxml2 memory corruption issue where the htmlCurrentChar function can cause a heap-based buffer over-read during parsing of crafted XML. Public details in connected docs indicate affected platforms include Apple iOS, macOS, tvOS, watchOS and related libxml2 usage, with version...

CVE-2016-1859

CVE-2016-1859 affects WebKit Canvas in Apple iOS < 9.3.2, Safari < 9.1.1, and tvOS

CVE-2016-1814

IOAcceleratorFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to cause a denial of service NULL pointer dereference via a crafted app...

CVE-2016-1854

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and CVE-2016-1857...

CVE-2016-1857

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856...