CVE-2008-4228

The CVE-2008-4228 issue affects Apple iPhone OS versions 1.0–2.1 and iPhone OS for iPod touch 1.1–2.1. A design/logic flaw in the Passcode Lock feature lets physically proximate attackers exploit the device’s Emergency Call ability to place a call to an arbitrary number while the device is locked...

CVE-2008-4232

Safari in Apple iPhone OS 2.0–2.1 and iPhone OS for iPod touch 2.1 suffer an IFRAME boundary enforcement flaw: an IFRAME can display content beyond its boundaries, enabling remote UI spoofing via crafted HTML. The affected components are Safari on iPhone OS 2.x and iPod touch OS 2.x; root cause i...

CVE-2008-4227

Apple iPhone OS 1.0–2.1 and iPhone OS for iPod touch 1.1–2.1 change the PPTP VPN encryption level to a lower one, making it easier for remote attackers to decrypt traffic or hijack connections. Affected software: Apple iPhone OS 1.0–2.1 and iPod touch OS 1.1–2.1. Root cause: reduction in PPTP enc...

CVE-2008-1586

The CVE-2008-1586 issue affects ImageIO in Apple iPhone OS 1.0–2.1 and iPhone OS for iPod touch 1.1–2.1, where remote attackers can trigger denial of service via a crafted TIFF image. The core risk is memory consumption leading to a device reset. Connected sources also reference libtiff-related a...

CVE-2008-4232

Safari in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.1 through 2.1 does not restrict an IFRAME's content display to the boundaries of the IFRAME, which allows remote attackers to spoof a user interface via a crafted HTML document...

CVE-2008-4227

Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 changes the encryption level of PPTP VPN connections to a lower level than was previously used, which makes it easier for remote attackers to obtain sensitive information or hijack a connection by decrypting network...

CVE-2008-4231

The CVE-2008-4231 entry describes a memory corruption/remote code execution vulnerability in Apple Safari on iPhone OS 1.0–2.1 and iPhone OS for iPod touch 1.1–2.1, caused by improper handling of HTML TABLE elements in crafted HTML documents. This allows remote attackers to execute arbitrary code...

CVE-2008-4229

CVE-2008-4229 describes a race condition in the Passcode Lock feature affecting Apple iPhone OS 2.0–2.1 and iPhone OS for iPod touch 2.0–2.1, enabling physically proximate attackers to bypass the lock and launch arbitrary applications by restoring the device from a backup. The issue is tied to th...

CVE-2008-4231

Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not properly handle HTML TABLE elements, which allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted HTML document...

PT-2008-5521 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.1 Apple iPhone OS for iPod touch versions 1.1 through 2.1 Description: The issue allows physically proximate attackers to make a phone call to an arbitrary number by leveraging the emergency-call ability...

PT-2008-5524 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: Safari versions 1.0 through 2.1 in Apple iPhone OS Safari versions 1.1 through 2.1 in iPhone OS for iPod touch Description: The issue is related to the improper handling of HTML TABLE elements, which can be exploited by remote attackers to...

PT-2008-5523 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.1 iPhone OS for iPod touch versions 1.1 through 2.1 Description: The Passcode Lock feature displays SMS messages when the emergency-call screen is visible. This allows physically proximate attackers to...

PT-2008-5520 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.1 Apple iPhone OS for iPod touch versions 1.1 through 2.1 Description: The issue concerns a change in the encryption level of PPTP VPN connections, which is lowered to a level that makes it easier for...

CVE-2008-3623

The CVE-2008-3623 entry describes a heap-based buffer overflow in CoreGraphics affecting Apple Safari before 3.2 on Windows and in iPhone OS 1.0–2.2.1 (and iPod touch 1.1–2.2.1). The vulnerability arises from improper handling of color spaces in image parsing, enabling remote attackers to execute...

多个产品库MP4文件远程拒绝服务漏洞

BUGTRAQ ID: 31957 CNCAN ID：CNCAN-2008102904 多个电话和音频产品使用的库在处理畸形MP4文件时存在问题，可导致应用程序崩溃。 这些产品包括： Apple iPhone Apple iPod touch VideoLan VLC 目前没有详细漏洞细节提供。其他产品也可能受此漏洞影响。 VideoLAN VLC media player 0.9.4 VideoLAN VLC media player 0.9.3 VideoLAN VLC media player 0.9.2 VideoLAN VLC media player 0.9.1 VideoL...

CVE-2008-3950

Off-by-one error in the webdrawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service browser crash via a JavaScript alert call with an argument that lacks breakabl...

CVE-2008-3950

Off-by-one error in the webdrawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service browser crash via a JavaScript alert call with an argument that lacks breakabl...

Design/Logic Flaw

Off-by-one error in the webdrawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service browser crash via a JavaScript alert call with an argument that lacks breakabl...

CVE-2008-3950

The CVE is based on a real DoS vulnerability in WebKit used by Safari on iPhone/iPod touch (versions 1.1.4 and 2.0). The issue is an off-by-one in _web_drawInRect:withFont:ellipsis:alignment:measureOnly: triggered by a crafted alert() string with a length that is a multiple of the 4096-byte memor...

CVE-2008-3950

Off-by-one error in the webdrawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service browser crash via a JavaScript alert call with an argument that lacks breakabl...