CVE-2017-2474

CVE-2017-2474 affects Apple devices (iOS, macOS, tvOS, watchOS) with kernel (XNU) memory corruption via an off-by-one error in the SIOCGIFORDER ioctl. The bug writes one entry beyond the allocated ordered_indices buffer because the loop uses a > comparison instead of >=, causing out-of-boun...

CVE-2017-2456

CVE-2017-2456 is a kernel race condition in Apple’s XNU mach_msg handling that can enable arbitrary code execution in kernel space via a non-atomic vm_map_copy move optimization. The connected Project Zero analysis details how two concurrent threads may trigger a flawed move path during vm_map_co...

CVE-2017-2416

CVE-2017-2416 involves a memory corruption in ImageIO across Apple platforms. A crafted image can trigger remote code execution or DoS. Affected: iOS <10.3, macOS <10.12.4, tvOS <10.2, watchOS

CVE-2017-2483

CVE-2017-2483 affects Apple kernel on iOS <10.3, macOS <10.12.4, tvOS <10.2 and watchOS

CVE-2017-2441

CVE-2017-2441 involves a use-after-free in the libc++abi demangling path across Apple products (iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, watchOS before 3.2). A remote attacker could execute arbitrary code by presenting a crafted C++ application. Public sources link this to Apple s...

CVE-2017-2406

CVE-2017-2406 (FontParser) affects Apple devices: iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS before 3.2. The vulnerability, in the FontParser component, allows remote attackers to cause memory corruption and either execute arbitrary code or trigger a denial of service vi...

CVE-2017-2450

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "CoreText" component. It allows remote attackers to obtain sensitive information or cause a denial...

CVE-2017-2417

CVE-2017-2417 affects Apple’s CoreGraphics across multiple OSs (iOS, macOS, tvOS, watchOS). The issue allows remote attackers to cause a denial-of-service through an image that triggers infinite recursion in CoreGraphics. Affected: iOS prior to 10.3, macOS prior to 10.12.4, tvOS prior to 10.2, wa...

CVE-2017-2435

CVE-2017-2435 relates to a CoreText memory corruption issue in Apple OSes. A crafted font file could allow remote attackers to execute arbitrary code or cause a denial of service on affected platforms. The vulnerability affects iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS ...

CVE-2017-2472

CVE-2017-2472 affects Apple OSes (iOS < 10.3, macOS < 10.12.4, tvOS < 10.2, watchOS

CVE-2017-2406

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "FontParser" component. It allows remote attackers to execute arbitrary code or cause a denial of...

CVE-2017-2441

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "libc++abi" component. A use-after-free vulnerability allows remote attackers to execute arbitrary...

CVE-2017-2450

CVE-2017-2450 affects Apple platforms (iOS <10.3; macOS <10.12.4; tvOS <10.2; watchOS

CVE-2017-2428

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves nghttp2 before 1.17.0 in the "HTTPProtocol" component. It allows remote HTTP/2 servers to have an...

CVE-2017-2430

CVE-2017-2430 affects the Audio component in several Apple platforms (iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, watchOS before 3.2). A crafted audio file may allow a remote attacker to execute arbitrary code or cause a memory corruption leading to a denial of service. Apple documen...

CVE-2017-2439

CVE-2017-2439 (FontParser) affects Apple platforms: iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS before 3.2. The issue is a memory corruption/out-of-bounds read in FontParser when processing crafted font files, which can enable information disclosure or cause an applicatio...

CVE-2017-2487

CVE-2017-2487 affects Apple platforms (iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, watchOS before 3.2) and targets the FontParser component. The issue allows a remote attacker to execute arbitrary code or cause a denial of service via a crafted font file, caused by memory corruption/...

CVE-2017-2478

CVE-2017-2478 describes a race condition in Apple’s Kernel across iOS, macOS, tvOS and watchOS that could allow a crafted app to execute code with kernel privileges. The connected Apple security entries indicate the issue affected multiple platforms (iOS <10.3, macOS <10.12.4, tvOS <10.2...

CVE-2017-2471

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. watchOS before 3.2 is affected. The issue involves the "WebKit" component. A use-after-free vulnerability allows remote attackers to execute arbitrary code via a crafted web site...

Remote code execution triggered by malformed GIF in ImageIO framework, affecting most iOS/macOS apps

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the “ImageIO” component. It allows remote attackers to execute arbitrary code or cause a denial of...