CVE-2016-1830

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1828,...

CVE-2016-1841

libxslt, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site...

CVE-2016-1827

CVE-2016-1827 is a kernel heap overflow in the flow_divert path (flow_divert_handle_app_map_create) on macOS OS X and iOS, enabling local privilege escalation to kernel/privileged context or memory corruption via a crafted app. Exploitation requires root on affected platforms; an exploit exists i...

CVE-2016-1808

The Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-1840

CVE-2016-1840: libxml2 contains a heap-based buffer overflow in xmlFAParsePosCharGroup (pre-2.9.4). Affected on Apple iOS (pre-9.3.2), OS X (pre-10.11.5), tvOS (pre-9.2.1), watchOS (pre-2.2.1); can lead to remote code execution or memory corruption. Remediation: upgrade libxml2 to 2.9.4 or later ...

CVE-2016-1813

The IOAccelSharedUserClient2::pageoffresource method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service NULL pointer dereference via a crafted app...

CVE-2016-1827

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1828, CVE-2016-1829,...

CVE-2016-1858

CVE-2016-1858 affects WebKit used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1. The issue is an improper taint-tracking tracking in WebKit, enabling a remote attacker to obtain sensitive information via a crafted website. The vulnerability is described across multiple sou...

CVE-2016-1847

CVE-2016-1847 affects WebKit/OpenGL on Apple TV (4th generation) with tvOS 9.2.1 and earlier. The root cause is an insufficient taint-tracking issue in parsing SVG images, enabling data disclosure when processing malicious web content. tvOS 9.2.1 includes the security update addressing this CVE.

CVE-2016-1818

IOAcceleratorFamily in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1817 and...

CVE-2016-1833

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document...

CVE-2016-1823

CVE-2016-1823 affects Apple iOS 9.3.2 and OS X 10.11.5 (as well as tvOS 9.2.1 and watchOS 2.2.1) via IOHIDDevice::handleReportWithTime. A crafted IOHIDReportType enum can trigger an incorrect cast, causing out-of-bounds read and memory corruption, enabling an attacker to execute arbitrary code in...

CVE-2016-1819

Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a craft...

CVE-2016-1828

CVE-2016-1827: Kernel heap overflow in flow_divert_handle_app_map_create on OS X and iOS. Root-privilege exploitation possible; memory corruption may lead to kernel compromise. Patched in OS X 10.11.5 and iOS 9.3.2; exploit code/public PoC exists (flow_divert-heap-overflow) describing OS X Yosemi...

CVE-2016-1856

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857...

CVE-2016-1855

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1856, and CVE-2016-1857...

CVE-2016-1854

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and CVE-2016-1857...

CVE-2016-1811

CVE-2016-1811 affects ImageIO in Apple products: iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1. Root cause: a crafted image leads to a NULL pointer dereference, causing a denial of service. Apple’s security notes for tvOS 9.2.1 list ImageIO remediation; update...

CVE-2016-1857

CVE-2016-1857 affects WebKit as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1. Root cause: memory corruption in WebKit via a crafted website, enabling remote code execution or a denial of service. Exploitation status: not detailed in provided docs. Mitigation: update ...

CVE-2016-1814

Affected software/hardware: Apple TV (4th generation) running tvOS. Issue: IOAcceleratorFamily contains a vulnerability that can be triggered by a crafted app, leading to a NULL pointer dereference and denial of service. Root cause: memory access validation/locking issues in IOAcceleratorFamily, ...