Apple Releases Dozens of Security Patches for Everything

While Windows users are currently in fear of getting their systems hijacked by the WannaCry ransomware outbreak, Apple users are sitting relaxed, thinking that malware attacks are something that happens to Windows users, and not Apple. But you are mistaken – Apple products are also not immune to...

About the security content of Safari 10.1.1

About the security content of Safari 10.1.1 This document describes the security content of Safari 10.1.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

PT-2017-15417

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 10.3.2 Apple Safari versions prior to 10.1.1 Description The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and...

PT-2017-15429

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 10.3.2 Apple Safari versions prior to 10.1.1 Apple tvOS versions prior to 10.2.1 Description The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service...

PT-2017-15430

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 10.3.2 Apple Safari versions prior to 10.1.1 Description The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and...

PT-2017-15440

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.3.2 Safari versions prior to 10.1.1 Description The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application...

About the security content of iTunes 12.6.1 for Windows

About the security content of iTunes 12.6.1 for Windows This document describes the security content of iTunes 12.6.1 for Windows. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patche...

About the security content of iCloud for Windows 6.2.1

About the security content of iCloud for Windows 6.2.1 This document describes the security content of iCloud for Windows 6.2.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

Safari Code Execution

The vulnerability of the WebKit component of the Safari browser is caused by an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code...

KLA11013 Buffer overflow vulnerability in Apple iTunes

A buffer overflow vulnerability was found in WebKit component of Apple iTunes versions earlier than 12.6.1. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed web content. Original advisories Apple...

Important: Red Hat Security Advisory: chromium-browser security update

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Apple Safari WebKit JSString Use After Free Code Execution (CVE-2017-2491)

Safari is a web browsing application developed by Apple. Safari browsing functionality is built around the set of components called WebKit. WebKit is a development toolkit which allows third party developers to build applications that use Internet technologies such as HTML, HTTP, and others. A...

Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities : - Multiple vulnerabilities exist in the expat component, the most severe of which are remote code execution vulnerabilities. An unauthenticated, remote...

Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes running on the remote host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities : - Multiple vulnerabilities exist in the expat component, the most severe of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can...

Apple Safari 10.0.3 - JSC::CachedCall Use-After-Free Exploit

Exploit for macOS platform in category remote exploits function makecompiledfunction function targetx return x5 + x - xx; // Call only once so that function gets compiled with low level interpreter // but none of the optimizing JITs target0; return target; function pwn var haxs = new Array0x100;...

Pwn2Own 2017: UAF in JSC::CachedCall (WebKit)

Pwn2Own 2017: UAF in JSC::CachedCall WebKit As a quick introduction, we are Samuel Groß, AKA saelo, and Niklas Baumstark, both students at Karlsruhe Institute of Technology, and have been playing CTF together for quite some time before we decided to team up for this year’s Pwn2Own. Today we are...

Apple Safari 10.0.3 - 'JSC::CachedCall' Use-After-Free

function makecompiledfunction function targetx return x5 + x - xx; // Call only once so that function gets compiled with low level interpreter // but none of the optimizing JITs target0; return target; function pwn var haxs = new Array0x100; for var i = 0; i 0x100; ++i haxsi = new Uint8Array0x100...

RHEL 6 : chromium-browser (RHSA-2017:1124)

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Important: Red Hat Security Advisory: chromium-browser security update

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Apple iOS WebKit Web Inspector Denial of Service Vulnerability

Apple iOS is an operating system for Apple smart devices. A denial of service vulnerability exists in Apple iOS WebKit Web Inspector, which allows attackers to exploit the vulnerability to build malicious WEB pages that can be clicked by users, which can crash the application...