CVE-2009-0959

The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service device reset via a crafted MPEG-4 video file that triggers an "input validation issue."...

CVE-2009-1680

Safari in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly clear the search history when it is cleared from the Settings application, which allows physically proximate attackers to obtain the search history...

CVE-2009-1680

CVE-2009-1680 affects Safari on Apple iPhone OS versions 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1. The issue is that the browser does not properly clear the search history when cleared from the Settings application, allowing physically proximate attackers to obtain the sea...

CVE-2009-0961

The CVE-2009-0961 issue affects Apple iPhone OS 1.0–2.2.1 and iPhone OS for iPod touch 1.1–2.2.1. The Mail component could dismiss the call-approval dialog when another alert appears, potentially allowing a remote attacker to place a call without user approval by triggering an alert. The connecte...

PT-2009-4174 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: WebKit versions before r41741 Apple iPhone OS versions 1.0 through 2.2.1 Apple iPhone OS for iPod touch versions 1.1 through 2.2.1 Safari affected versions not specified Description: The issue allows remote attackers to cause a denial of...

PT-2009-3541 · Apple +1 · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.2.1 Apple iPhone OS for iPod touch versions 1.1 through 2.2.1 Description: The issue is related to the MPEG-4 video codec, which allows remote attackers to cause a denial of service, resulting in a devic...

PT-2009-4167 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.2.1 iPhone OS for iPod touch versions 1.1 through 2.2.1 Description: The issue allows remote attackers to cause a denial of service, resulting in a device reset, via a crafted ICMP echo request. This is...

PT-2009-4163 · Microsoft +1 · Exchange Activesync +1

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.2.1 iPhone OS for iPod touch versions 1.1 through 2.2.1 Description: The Profiles component, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weake...

PT-2009-3542 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.2.1 Apple iPhone OS for iPod touch versions 1.1 through 2.2.1 Description: The issue concerns the Mail component, which does not offer an option to disable remote image loading in HTML emails. This allow...

PT-2009-4164 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: Safari in Apple iPhone OS versions 1.0 through 2.2.1 Safari in Apple iPhone OS for iPod touch versions 1.1 through 2.2.1 Description: The issue is related to Safari not properly clearing the search history when it is cleared from the Settings...

JVN#87239696 iPhone OS denial of service (DoS) vulnerability

iPhone OS from Apple contains a denial of service DoS vulnerability. Impact A remote attacker could possibly cause a denial of service DoS attack by sending a specially crafted packet. Solution Update the software Update to latest version according to the information provided by Apple. Products...

CVE-2009-1697

CRLF injection vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site scripting XSS attacks...

Cross site scripting

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper handling of Location and History objects...

CVE-2009-1700

The XSLT implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read XML content from arbitrary web pages via a crafted document...

CVE-2009-1702

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper handling of Location and History objects...

Session fixation

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 uses predictable random numbers in JavaScript applications, which makes it easier for remote web servers to track the behavior of a Safari user during a session...

CVE-2009-1701

Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service application crash by destroying a...

CVE-2009-1702

CVE-2009-1702 is an XSS vulnerability in WebKit used by Apple Safari and the iPhone OS Safari implementation, allowing remote attackers to inject arbitrary web script or HTML via improper handling of Location and History objects. Affected products include Safari

CVE-2009-1696

CVE-2009-1696 affects WebKit/Apple Safari and related iOS components, where Safari before 4.0 (including iPhone OS 1.0–2.2.1 and iPod touch 1.1–2.2.1) used predictable JavaScript RNG. This predictability could allow remote servers to track a Safari user’s session behavior. Connected documents con...

CVE-2009-1698

CVE-2009-1698 affects WebKit-based components (Safari before 4.0 and iPhone OS/iPod touch up to 2.2.1). The issue is an uninitialized pointer during handling of a CSS attr() function with a large numeric argument, enabling remote code execution or memory-corruption-induced denial of service via a...