CVE-2014-4413

CVE-2014-4413 concerns WebKit, as used in Apple iOS before 8 and Apple TV before 7, where a crafted website can trigger memory corruption leading to remote code execution or a memory-related crash. Affected component: WebKit; vulnerable vector is remote web content. Root cause described as memory...

CVE-2014-4420

The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4371,...

CVE-2014-4408

The rtsetgate function in the kernel in Apple iOS before 8 and Apple TV before 7 allows local users to gain privileges or cause a denial of service out-of-bounds read and device crash via a crafted call...

CVE-2014-4407

CVE-2014-4407 affects Apple IOKit on iOS (pre-8) and Apple TV (pre-7). Root cause: uninitialized kernel memory in IOKit functions leading to memory-content disclosure via crafted IOKit calls. Public details show IODataQueue/IOKit memory initialization issues; impact is kernel memory disclosure. R...

CVE-2014-4405

IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context or cause a denial of service NULL pointer dereference via an application that provides crafted key-mapping properties...

CVE-2014-4369

CVE-2014-4369 affects Apple’s IOAcceleratorFamily API: an attacker can trigger a denial of service (NULL pointer dereference) by feeding crafted arguments to apps using the API. The vulnerability spans iOS versions before 8 and Apple TV before 7. Root cause: NULL pointer dereference in IOAccelera...

CVE-2014-4389

CVE-2014-4389 corresponds to an IODataQueue/IOSharedDataQueue integer overflow in IOKit that could let a crafted API argument overflow queue bounds and corrupt kernel memory, enabling arbitrary code execution with system privileges on affected iOS 7.x/Apple TV 6.x/7.x era devices. Connected mater...

CVE-2014-4410

CVE-2014-4410 affects WebKit as used in Apple iOS before 8 and Apple TV before 7, enabling remote code execution or memory corruption via a crafted web site. Connected sources reference the same WebKit memory-corruption vector and note that patches were released through Apple advisories (e.g., iO...

CVE-2014-4404

CVE-2014-4404 describes a heap-based buffer overflow in IOHIDFamily that affects Apple iOS prior to 8 and Apple TV prior to 7. The vulnerability occurs when parsing crafted key-mapping properties, enabling an attacker to execute arbitrary code in a privileged context via a user-space application....

CVE-2014-4421

CVE-2014-4421 involves the kernel’s network-statistics interface where memory is not properly initialized in iOS before 8 and Apple TV before 7, allowing an attacker’s crafted app to obtain sensitive memory-content and memory-layout information. The connected documents also list CVE-2014-4421 amo...

CVE-2014-4373

CVE-2014-4373: In Apple’s IOAcceleratorFamily, the IntelAccelerator driver on iOS (before v8) and Apple TV (before v7) contains a NULL pointer dereference that can be triggered by a crafted app, leading to a denial of service (and device restart). Apple’s remediation is to improve error handling ...

CVE-2014-4418

Summary of CVE-2014-4418 findings: The issue concerns the IODataQueue implementation in IOKit where kernel trusted fields (queueSize, head, tail) live in a shared memory region mapped into userspace. IOSharedDataQueue extends IODataQueue and places an appendix immediately after the queue, enablin...

CVE-2014-4389

Integer overflow in IOKit in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted API arguments...

CVE-2014-4371

The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4419,...

CVE-2014-4413

WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and...

CVE-2014-4372

syslogd in the syslog subsystem in Apple iOS before 8 and Apple TV before 7 allows local users to change the permissions of arbitrary files via a symlink attack on an unspecified file...

CVE-2014-4422

The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot process, which allows attackers to bypass certain kernel-hardening protection mechanisms by using a user-space process to observe data related to the random numbe...

CVE-2014-4414

WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and...

CVE-2014-4418

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than...

CVE-2014-4415

CVE-2014-4415 affects WebKit as used in Apple iOS before 8 and Apple TV before 7 . A crafted web site can trigger memory corruption, allowing a remote attacker to execute arbitrary code or cause a denial of service (application crash). Root cause is memory handling issues in WebKit (as described ...