CVE-2009-2199

Removed by vendor...

PT-2009-4648 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0.3 iPhone OS versions prior to 3.1 iPhone OS versions prior to 3.1.1 for iPod touch Description: The issue allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via...

CVE-2009-2204

Unspecified vulnerability in the CoreTelephony component in Apple iPhone OS before 3.0.1 allows remote attackers to execute arbitrary code, obtain GPS coordinates, or enable the microphone via an SMS message that triggers memory corruption, as demonstrated by Charlie Miller at SyScan '09 Singapor...

CVE-2009-2204

CVE-2009-2204 affects Apple iPhone OS prior to 3.0.1 in the CoreTelephony component. A memory-corruption flaw triggered by an SMS can enable remote code execution and expose GPS coordinates or enable the microphone, as demonstrated by Charlie Miller at SyScan ’09. A patch addressing this issue wa...

Memory corruption

WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit aka Qt toolkit; and possibly other products do not properly handle numeric character references, which allows remote attackers to...

Cross site scripting

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects...

CVE-2009-1725

WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit aka Qt toolkit; and possibly other products do not properly handle numeric character references, which allows remote attackers to...

CVE-2009-1725

WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit aka Qt toolkit; and possibly other products do not properly handle numeric character references, which allows remote attackers to...

CVE-2009-1725

WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit aka Qt toolkit; and possibly other products do not properly handle numeric character references, which allows remote attackers to...

CVE-2009-1724

Summary: CVE-2009-1724 is a cross-site scripting (XSS) vulnerability in WebKit used by Apple Safari prior to 4.0.2 (on iPhone OS before 3.1 and 3.1.1 for iPod touch, among others). Root cause: arbitrary web script/HTML can be injected via vectors related to parent and top objects. Impact (as stat...

CVE-2009-1725

CVE-2009-1725 is a vulnerability in WebKit-based rendering used by Apple Safari (and KDE’s khtml/kdelibs, QtWebKit, and related WebKit-powered components) where improper handling of numeric character references can allow remote attackers to cause memory corruption, potentially executing code or c...

CVE-2009-1724

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects...

CVE-2009-1724

Removed by vendor...

PT-2009-4198 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0.2 iPhone OS versions prior to 3.1 iPhone OS versions prior to 3.1.1 for iPod touch Description: A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via...

CVE-2009-1679

The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy, which allows physically proximate attackers to bypass the...

CVE-2009-0958

Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an untrusted Exchange server certificate, which causes it to be accepted without prompting in future usage and allows remote Exchange servers to obtain sensiti...

CVE-2009-0959

The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service device reset via a crafted MPEG-4 video file that triggers an "input validation issue."...

Design/Logic Flaw

The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not provide an option to disable remote image loading in HTML email, which allows remote attackers to determine the device address and when an e-mail is read via an HTML email containing an...

Code injection

The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog when another alert appears, which might allow remote attackers to force the iPhone to place a call without user approval by causing an application to trigger a...

CVE-2009-1683

The Telephony component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service device reset via a crafted ICMP echo request, which triggers an assertion error related to a "logic issue."...