CVE-2016-1808

CVE-2016-1808 concerns a memory corruption issue in the Disk Images parsing path that could allow an attacker to execute arbitrary code in the kernel context on affected Apple platforms. Affected products/versions include iOS prior to 9.3.2, OS X prior to 10.11.5, tvOS prior to 9.2.1, and watchOS...

CVE-2016-1807

CVE-2016-1807 affects Apple’s Disk Images subsystem across iOS (before 9.3.2), OS X (before 10.11.5), tvOS (before 9.2.1), and watchOS (before 2.2.1). The vulnerability is a race condition in Disk Images parsing/handling that can allow a local user to read kernel memory, i.e., obtain sensitive in...

CVE-2016-1847

CVE-2016-1847 affects WebKit/OpenGL on Apple TV (4th generation) with tvOS 9.2.1 and earlier. The root cause is an insufficient taint-tracking issue in parsing SVG images, enabling data disclosure when processing malicious web content. tvOS 9.2.1 includes the security update addressing this CVE.

CVE-2016-1832

libc in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows local users to gain privileges or cause a denial of service memory corruption via unspecified vectors...

CVE-2016-1830

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1828,...

CVE-2016-1841

libxslt, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site...

CVE-2016-1827

CVE-2016-1827 is a kernel heap overflow in the flow_divert path (flow_divert_handle_app_map_create) on macOS OS X and iOS, enabling local privilege escalation to kernel/privileged context or memory corruption via a crafted app. Exploitation requires root on affected platforms; an exploit exists i...

CVE-2016-1808

The Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-1840

CVE-2016-1840: libxml2 contains a heap-based buffer overflow in xmlFAParsePosCharGroup (pre-2.9.4). Affected on Apple iOS (pre-9.3.2), OS X (pre-10.11.5), tvOS (pre-9.2.1), watchOS (pre-2.2.1); can lead to remote code execution or memory corruption. Remediation: upgrade libxml2 to 2.9.4 or later ...

CVE-2016-1841

CVE-2016-1841 affects libxslt as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Connected advisories/plug...

CVE-2016-1818

IOAcceleratorFamily in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-1817 and...

CVE-2016-1833

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted XML document...

CVE-2016-1823

CVE-2016-1823 affects Apple iOS 9.3.2 and OS X 10.11.5 (as well as tvOS 9.2.1 and watchOS 2.2.1) via IOHIDDevice::handleReportWithTime. A crafted IOHIDReportType enum can trigger an incorrect cast, causing out-of-bounds read and memory corruption, enabling an attacker to execute arbitrary code in...

CVE-2016-1819

Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a craft...

CVE-2016-1807

Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows local users to obtain sensitive information from kernel memory via unspecified vectors...

CVE-2016-1828

CVE-2016-1827: Kernel heap overflow in flow_divert_handle_app_map_create on OS X and iOS. Root-privilege exploitation possible; memory corruption may lead to kernel compromise. Patched in OS X 10.11.5 and iOS 9.3.2; exploit code/public PoC exists (flow_divert-heap-overflow) describing OS X Yosemi...

CVE-2016-1847

OpenGL, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site...

CVE-2016-1811

CVE-2016-1811 affects ImageIO in Apple products: iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1. Root cause: a crafted image leads to a NULL pointer dereference, causing a denial of service. Apple’s security notes for tvOS 9.2.1 list ImageIO remediation; update...

CVE-2016-1803

CVE-2016-1803 affects Apple’s CoreCapture component across iOS, OS X, tvOS, and watchOS. The vulnerability is a NULL pointer dereference that could allow a crafted app to execute arbitrary code with kernel or privileged context, or cause a denial of service. Mitigation details from Apple security...

CVE-2016-1830

CVE-2016-1830 is listed in Apple security content as a Kernel memory corruption issue affecting OS X El Capitan and tvOS (and related iOS watchOS entries) with the TV 4th generation reference, indicating a kernel-level vulnerability that could allow arbitrary code execution in a privileged contex...