Memory corruption

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause...

CVE-2017-2390

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves symlink mishandling in the "libarchive" component. It allows local users to change arbitrary directory...

Race condition

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. A race condition allows attackers to execute arbitrary code in a privileged...

CVE-2017-2379

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Carbon" component. It allows remote attackers to execute arbitrary code or cause a denial of...

CVE-2017-2401

CVE-2017-2401 affects Apple devices (iOS <10.3, macOS <10.12.4, tvOS <10.2, watchOS

CVE-2017-2401

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause...

CVE-2017-2379

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Carbon" component. It allows remote attackers to execute arbitrary code or cause a denial of...

CVE-2017-2450

CVE-2017-2450 affects Apple platforms (iOS <10.3; macOS <10.12.4; tvOS <10.2; watchOS

CVE-2017-2490

CVE-2017-2490 is a kernel vulnerability in macOS/iOS/watchOS/tvOS involving the FSEVENTS device. Connected data identifies a double-free race in fsevents locking: two threads may read the same devices_not_to_watch pointer at the (a) point and free it at (d) without proper protection, creating a u...

CVE-2017-2483

CVE-2017-2483 affects Apple kernel on iOS <10.3, macOS <10.12.4, tvOS <10.2 and watchOS

CVE-2017-2482

CVE-2017-2482 is a kernel heap overflow in the BSD Packet Filter (bpf) BIOCSBLEN handling in Apple’s XNU kernel. The vulnerability allows an unauthenticated user-space process to manipulate the kernel heap by changing the bpf buffer size and reattaching interfaces, enabling potential kernel-level...

CVE-2017-2478

CVE-2017-2478 describes a race condition in Apple’s Kernel across iOS, macOS, tvOS and watchOS that could allow a crafted app to execute code with kernel privileges. The connected Apple security entries indicate the issue affected multiple platforms (iOS <10.3, macOS <10.12.4, tvOS <10.2...

CVE-2017-2474

CVE-2017-2474 affects Apple devices (iOS, macOS, tvOS, watchOS) with kernel (XNU) memory corruption via an off-by-one error in the SIOCGIFORDER ioctl. The bug writes one entry beyond the allocated ordered_indices buffer because the loop uses a > comparison instead of >=, causing out-of-boun...

CVE-2017-2473

CVE-2017-2473 is a kernel memory corruption/out-of-bounds read vulnerability affecting Apple platforms (iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, watchOS before 3.2). The root cause is improper bounds checking in necp_client_copy_interface: an attacker-controlled interface_index ca...

CVE-2017-2471

CVE-2017-2471 is a use-after-free in WebKit affecting Apple WebKit-based components (iOS 10.3, Safari 10.1, watchOS 3.2). It allows remote code execution via a crafted web site. Public evidence includes an exploitation entry (Exploit-DB) and multiple advisories linking WebKitGTK+ variants. Remedi...

CVE-2017-2462

CVE-2017-2462 affects multiple Apple platforms via the Audio component. A crafted audio file may trigger memory corruption, enabling remote code execution or denial of service. Affected: iOS < 10.3, macOS < 10.12.4, tvOS < 10.2, watchOS

CVE-2017-2439

CVE-2017-2439 (FontParser) affects Apple platforms: iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS before 3.2. The issue is a memory corruption/out-of-bounds read in FontParser when processing crafted font files, which can enable information disclosure or cause an applicatio...

CVE-2017-2439

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "FontParser" component. It allows remote attackers to obtain sensitive information or cause a deni...

CVE-2017-2461

CVE-2017-2461 affects CoreText in Apple OSes: iOS 10.3 and earlier, macOS 10.12.4 and earlier, tvOS 10.2 and earlier, watchOS 3.2 and earlier. The issue enables remote denial of service via a crafted text message (resource exhaustion). Apple’s security updates patch this by updating to macOS 10.1...

CVE-2017-2435

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "CoreText" component. It allows remote attackers to execute arbitrary code or cause a denial of...