Input validation

A permissions issue was addressed with improved validation. This issue is fixed in iOS 14.7. A malicious application may be able to access Find My data...

CVE-2021-30761

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...

CVE-2021-30761

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited...

CVE-2021-30932

The issue was addressed with improved permissions logic. This issue is fixed in iOS 15.2 and iPadOS 15.2. A person with physical access to an iOS device may be able to access contacts from the lock screen...

CVE-2021-30900

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges...

CVE-2021-30948

CVE-2021-30948 affects Apple iOS and iPadOS; an inconsistent UI state management bug potentially allows a person with physical access to an iOS device to access stored passwords without authentication. The issue is fixed in iOS 15.2 / iPadOS 15.2. Vulnerable component details are not fully specif...

CVE-2021-30900

CVE-2021-30900 affects Apple’s GPU Drivers in iOS/iPadOS (Smartphone OS); root cause is an out-of-bounds write leading to memory corruption. Impact: potential arbitrary code execution with kernel privileges, exploitable locally. Apple fixes were released in iOS 14.8.1 / iPadOS 14.8.1 and iOS 15.1...

CVE-2021-30869

CVE-2021-30869 is a type confusion vulnerability in Apple’s XNU kernel that may allow a malicious application to execute arbitrary code with kernel privileges. The issue affects iOS/iPadOS and macOS (XNU IPC-related code) and was observed in-the-wild in conjunction with WebKit-related flaws; expl...

CVE-2021-30583

Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

An Explosive Spyware Report Shows the Limits of iOS Security

Amnesty International sheds alarming light on an NSO Group surveillance tool—and the gaps in Apple’s and Google's defenses...

Fuzzing iOS code on macOS at native speed

Or how iOS apps on macOS work under the hood Posted by Samuel Groß, Project Zero This short post explains how code compiled for iOS can be run natively on Apple Silicon Macs. With the introduction of Apple Silicon Macs, Apple also made it possible to run iOS apps natively on these Macs. This is...

Telegram heap buffer overflow vulnerability (CNVD-2021-38310)

Telegram is an instant messaging mobile application. A heap buffer overflow vulnerability exists in the custom derived LottieParserImpl :: parseDashProperty function of the rlottie library in Telegram for Android prior to version 7.1.0 2090, iOS prior to version 7.1, and macOS prior to version 7....

CVE-2021-21208

Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing via a crafted QR code...

About the security content of iOS 12.5.2

About the security content of iOS 12.5.2 This document describes the security content of iOS 12.5.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

CVE-2021-21186

Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code...

CVE-2021-21163

Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server...

Apple iOS < 12.4.9 Multiple Vulnerabilities

Binary data appleios1249check.nbin...

CVE-2020-15984

Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted URL...

CVE-2020-9787

CVE-2020-9787 is a logic issue in WebKit/Safari affecting macOS Catalina and iOS/watchOS/tvOS platforms where some websites may not appear in Safari Preferences. The issue was addressed with improved restrictions and patches are provided in iOS 13.4 / iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13....

CVE-2020-9968

CVE-2020-9968 is an Apple logic issue fixed in iOS 14.0/iPadOS 14.0, macOS Catalina 10.15.7, tvOS 14.0, and watchOS 7.0. A malicious application could access restricted files due to improved restrictions. Referenced Apple advisories HT211843, HT211844, and HT211850 corroborate the affected platfo...