CVE-2016-7662

CVE-2016-7662 affects Apple platforms: iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3. The issue lies in the Security component and allows remote attackers to spoof certificates via unspecified vectors, enabling potential trust bypass. The CVSS data indicates a network exploit wi...

CVE-2016-7714

CVE-2016-7714 affects Apple platforms (iOS before 10.2, macOS before 10.12.2, watchOS before 3.1.3) via the IOKit IOReportUserClient path. Connected advisory ZDI-16-687 details an OOB read in IOReportUserClient that allows a local attacker to disclose kernel memory-layout information. The root ca...

CVE-2016-7615

CVE-2016-7615 concerns a kernel‑level vulnerability in Apple’s operating systems (iOS prior to 10.2, macOS prior to 10.12.2, watchOS prior to 3.1.3) that can be triggered by a local user. The connected data explicitly describes this as a kernel memory‑management issue (use‑after‑free) with the im...

CVE-2016-4680

CVE-2016-4680 affects Apple kernels across iOS (pre-10.1), tvOS (pre-10.0.1), and watchOS (pre-3.1). The vulnerability exposes kernel memory via a crafted app due to multiple input-validation issues in MIG-generated code, enabling a local attacker to disclose kernel memory. Apple addressed this i...

CVE-2016-4693

CVE-2016-4693 affects Apple platforms (iOS 10.2 and earlier, macOS 10.12.1/10.12.2 and earlier, watchOS 3.1.3 and earlier) where the Security component could allow bypassing cryptographic protections by leveraging the 3DES cipher. The vulnerability is tied to the removal of 3DES as a default ciph...

CVE-2016-4691

CVE-2016-4691 affects Apple platforms where the FontParser component mishandles crafted font files, causing memory corruption and potential remote code execution or a denial of service. Affected: iOS prior to 10.2, macOS prior to 10.12.2, watchOS prior to 3.1.3. The vulnerability is addressed by ...

CVE-2016-4688

CVE-2016-4688 affects FontParser in macOS (macOS Sierra 10.12.3 security content). The issue: memory corruption/buffer handling in font file processing, enabling remote code execution when a crafted font is opened. Apple references multiple FontParser CVEs (including 2017-2406/2407/2439/2487, etc...

CVE-2016-7636

CVE-2016-7636 affects Apple platforms (iOS 10.2 and earlier, macOS 10.12.2 and earlier, watchOS 3.1.3 and earlier). Root cause: in the Security component, OCSP responder URL handling can be abused by a man-in-the-middle to cause an application crash (denial of service). Impact is partial availabi...

CVE-2016-4669

This CVE corresponds to a Safari WebKit JIT exploit for iOS 7.1.2 that chain-exploits a JIT optimization bug (CVE-2016-4669) to write shellcode into RWX memory, obtain kernel RW/root, and disable code signing. The linked Metasploit/PacketStorm entries confirm a kernel-level exploit used to run a ...

CVE-2017-2370

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or...

CVE-2017-2363

CVE-2017-2363 affects Apple WebKit components across iOS (iOS before 10.2.1), Safari (before 10.0.3), tvOS (before 10.1.1) and watchOS (before 3.1.3). The issue permits a remote attacker to bypass the Same Origin Policy and exfiltrate sensitive data via a crafted web site, due to a WebKit prototy...

CVE-2016-4664

CVE-2016-4664 affects iOS before 10.1, tvOS before 10.0.1, and watchOS before 3.1. The issue is in Sandbox Profiles, allowing a crafted app to read metadata for photo directories. The Apple TV/Sandbox Profiles entries mirror this access issue (metadata disclosure for photo directories) alongside ...

CVE-2017-2363

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain...

CVE-2016-7584

CVE-2016-7584 affects Apple platforms (iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, watchOS before 3.1) in the AppleMobileFileIntegrity component. Root cause: a validation issue in handling code signatures that allows a signed executable to be substituted if it uses the same team ID...

CVE-2016-4673

CVE-2016-4673 (Apple CoreGraphics JPEG bug) affects multiple Apple OSes: iOS before 10.1, macOS before 10.12.1, tvOS before 10.0.1, watchOS before 3.1. A memory corruption issue in CoreGraphics may allow arbitrary code execution or memory corruption leading to a crash when processing a crafted JP...

CVE-2016-7657

CVE-2016-7657 is an Apple IOKit memory-corruption vulnerability that could allow a crafted app to read kernel memory on affected systems. Public details in the initial entry reference iOS < 10.2, macOS < 10.12.2, and watchOS

CVE-2017-2360

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or...

CVE-2017-2352

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Unlock with iPhone" component, which allows attackers to bypass the wrist-presence protection mechanism and unlock a Watch device via unspecified vectors...

CVE-2016-7607

CVE-2016-7607 affects Apple OS components (Kernel) on iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3, enabling an app to read kernel memory and obtain sensitive information. The bundled data confirms this is a kernel memory access issue described in the CVE summary and is listed ...

CVE-2016-7588

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "CoreMedia Playback" component. It allows remote attackers to execute arbitrary code or cause a denial of service memory...