CVE-2021-30887

CVE-2021-30887 is a WebKit-related logic issue affecting how Content Security Policy is enforced when processing malicious web content. The description states that improved restrictions fix the problem, with the vulnerability fixed in Apple platforms: macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15...

CVE-2020-11764

OpenEXR before 2.4.1 contains an out-of-bounds write in copyIntoFrameBuffer (ImfMisc.cpp), CVE-2020-11764. Amazon Linux 2 ALAS2-2020-1499 confirms the OpenEXR fix and provides updated packages; Red Hat/CentOS advisories (RHSA-2020:4039) also address CVE-2020-11764 among related OpenEXR issues. Re...

CVE-2020-3864

CVE-2020-3864 is a logic issue where a DOM object context may not have had a unique security origin. It is fixed in Apple/software updates across multiple platforms: iCloud for Windows 7.17, iTunes for Windows 12.10.4, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 1...

CVE-2020-9952

CVE-2020-9952 refers to an input validation issue that could enable a cross-site scripting (XSS) attack when processing maliciously crafted web content. The official guidance states this was addressed with improved input validation and is fixed in Apple software releases: iOS 14.0 and iPadOS 14.0...

CVE-2023-42841

CVE-2023-42841: The issue is addressed by improved memory handling and is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, and macOS Ventura 13.6.1. Description states: an app may be able to execute arbitrary code with kernel privileges. This is confirmed by con...

CVE-2019-8813

CVE-2019-8813 is a WebKit/WebKit-derived issue classified as a logic vulnerability in state management that can enable universal cross-site scripting when processing malicious web content. The publicly documented fixes indicate the vulnerability is addressed in iOS 13.2, iPadOS 13.2, tvOS 13.2, a...

CVE-2019-8814

CVE-2019-8814 involves multiple memory corruption issues in WebKit that may be triggered by processing malicious web content, potentially enabling arbitrary code execution. Affected: WebKit/WebKitGTK/WebKit processes across Apple platforms (Safari on iOS/iPadOS/tvOS/macOS) and related WebKitGTK/W...

CVE-2023-38425

CVE-2023-38425 affects Apple systems (iOS, iPadOS, macOS) where the kernel could be compromised due to a memory handling issue in a component named in Apple’s advisories. The vulnerability could allow an app to execute arbitrary code with kernel privileges, according to the CVE entry. It has been...

CVE-2023-40423

CVE-2023-40423 is an Apple vulnerability where improved memory handling fixed an issue that could let an app execute arbitrary code with kernel privileges. Affected/fixed versions per sources: iOS 17.1/iPadOS 17.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1, macOS Sonoma 14.1, and earlier OS ver...

CVE-2024-54551

CVE-2024-54551 is a denial-of-service vulnerability in web content processing within WebKit-based components. The connected documents indicate the issue is addressed by memory-handling improvements and fixes in specific Apple platforms: watchOS 10.6, tvOS 17.6, Safari 17.6, macOS Sonoma 14.6, vis...

CVE-2023-41254

CVE-2023-41254 is a privacy-related issue in Apple platforms where log entries could reveal sensitive user data. It affects iOS/iPadOS 16.7.2 and 17.1, watchOS 10.1, macOS Ventura 13.6.1 and Sonoma 14.1. The root cause is improper private data redaction in logs. The issue is fixed in iOS/iPadOS 1...

CVE-2021-30797

CVE-2021-30797 is a WebKit/WebKitGTK/WebKit2GTK-related vulnerability affecting WebKit-based components. In Arch Linux advisories ASA-202107-67/68, CVE-2021-30797 is listed among multiple issues in webkit2gtk that could allow arbitrary code execution when processing malicious web content, with pa...

CVE-2023-42849

CVE-2023-42849 affects Apple platforms (iOS/iPadOS 17.1/16.7.2; macOS Monterey 12.7.1, Ventura/Sonoma 13.6.1/14.1; watchOS 10.1) where the issue concerns memory handling. The root cause allows an attacker who already has kernel code execution to bypass kernel memory mitigations, potentially eleva...

CVE-2023-41997

CVE-2023-41997 affects Apple platforms where the issue is mitigated by code changes that restrict options on a locked device to prevent Siri from leaking data. The public description confirms vulnerable behavior: an attacker with physical access could use Siri to access sensitive user data. The f...

CVE-2021-30818

CVE-2021-30818 is a type confusion vulnerability in WebKitGTK/WebKit, leading to arbitrary code execution when processing malicious web content. The issue is fixed in Apple platforms (iOS 14.8+, iPadOS 14.8+, Safari 15+, watchOS 8, tvOS 15) and is correlated with WebKitGTK/WebKit fixes in Linux p...

CVE-2022-22600

CVE-2022-22600 affects Apple platforms: tvOS 15.4, iOS 15.4, iPadOS 15.4, macOS Monterey 12.3, and watchOS 8.5. The bulletin states a bypass of certain Privacy preferences via a malicious app, due to an issue in permissions logic. The available sources in the initial description confirm the fix w...

CVE-2022-46689

CVE-2022-46689 is a local privilege-escalation race condition in Apple's XNU kernel related to copy-on-write handling. Public sources describe PoCs/exploits (e.g., MacDirtyCow family) that could enable an app to execute arbitrary code with kernel privileges by exploiting a race window in COW oper...

CVE-2023-40416

CVE-2023-40416 affects Apple ImageIO: processing an image may disclose process memory. Fixed in iOS 17.1 / iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 / iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. The Nessus/OpenVAS entries corroborate the vulnerability family (memory disclosure vi...

CVE-2023-41976

CVE-2023-41976 is a use-after-free vulnerability in processing web content that can lead to arbitrary code execution. Affected products include Apple platforms: iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, and tvOS 17.1. The issue is fixed ...

CVE-2024-4558

CVE-2024-4558: Use-after-free in ANGLE within Google Chrome/Chromium's WebKit/ANGLE path allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affects Chrome/Chromium builds prior to version 124.0.6367.155. The issue is addressed in the referenced Chrome update;...

CVE-2023-41982

CVE-2023-41982 affects Apple devices where an attacker with physical access can use Siri from a locked device to access sensitive user data. The issue is addressed by restricting options offered on a locked device and is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, and ...

CVE-2021-30934

The CVE-2021-30934 entry is valid and has concrete details across connected documents. It concerns WebKit/WebKitGTK family processing malicious web content leading to arbitrary code execution due to a buffer overflow. Affected products include Apple platforms: Safari 15.2, macOS Monterey 12.1, iO...

CVE-2021-36976

CVE-2021-36976 affects libarchive 3.4.1 through 3.5.1 with a use-after-free in copy_string (invoked by do_uncompress_block and process_block). Connected advisories show affected packages across multiple distributions (e.g., Debian libarchive updates to 3.4.3-2+deb11u2; Fedora/libarchive 3.5.3-1; ...

CVE-2019-8823

CVE-2019-8823 affects WebKitGTK/WebKitGTK4. Affected component: WebKitGTK4, part of WebKit; issue described as memory corruption in WebKit leading to possible arbitrary code execution when processing malicious web content. Public references in Apple advisories (WebKit) list CVE-2019-8823 among We...

CVE-2024-54658

CVE-2024-54658 is a memory-handling issue in processing web content that can lead to a denial-of-service. The primary public description states the fix is in Apple software: iOS 17.4 and iPadOS 17.4, Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, and macOS Sonoma 14.4. The vulnerability is m...

CVE-2025-31205

CVE-2025-31205 targets WebKitGTK/WebKit components across multiple platforms. Affected: WebKitGTK/WebKit-based browsers using the GTK toolkit; vulnerability allows a malicious website to exfiltrate data cross-origin. Root cause: cross-origin data leakage via processing/execution paths in web cont...

CVE-2023-42857

CVE-2023-42857 describes a privacy issue where private data redaction for log entries was improved. Affected platforms: macOS Sonoma 14.1, iOS 17.1, and iPadOS 17.1. Root cause: leakage of sensitive user data through logs due to insufficient redaction. Impact: an app may be able to access sensiti...

CVE-2020-11760

CVE-2020-11760 affects OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in ImfRle.cpp (function rleUncompress). OpenEXR releases indicate the fix is to upgrade to v2.4.1. Public references in the connected documents confirm the CVE entry is included among OpenEXR issu...

CVE-2023-41977

CVE-2023-41977 is a Safari-related issue where improved cache handling fixes a vulnerability that could allow a malicious website to reveal browsing history. Affected products/versions (per connected sources): macOS Sonoma 14.1; iOS 16.7.2; iPadOS 16.7.2. Remedy: Apple has addressed the issue in ...

CVE-2020-11765

CVE-2020-11765 concerns OpenEXR prior to 2.4.1, where an off-by-one error in the ImfXdr.h read function used by DwaCompressor::Classifier::Classifier caused an out-of-bounds read. Public disclosures and vendor advisories (OpenEXR/OpenEXR 2.4.1 release notes; GLSA-202107-27; Debian DLA-2358-1) con...

CVE-2021-30682

CVE-2021-30682 is a WebKit/Apple logic-issue vulnerability disclosed as fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. The issue allows a malicious application to leak sensitive user information due to improper restrictions. Connected sources confir...

CVE-2023-40449

CVE-2023-40449 is an Apple vulnerability where an application may cause a denial-of-service due to an issue in memory handling. The published entry specifies a local attack surface with user interaction required, and the root cause is related to memory handling that could be exploited by a compro...

CVE-2020-11758

CVE-2020-11758 affects OpenEXR before 2.4.1 via an out-of-bounds read in ImfOptimizedPixelReading.h. Public docs (Debian DLA-2358-1) note potential denial of service and possible arbitrary code execution when processing malformed EXR files; OpenEXR/ImageIO entries reference the same CVE family. R...

CVE-2022-32816

CVE-2022-32816 is a WebKitGTK/WebKit issue where visiting a website that frames malicious content may lead to UI spoofing. Connected advisories confirm this vulnerability in WebKitGTK/WebKit related packages (e.g., webkitgtk/webkit2gtk) with upstream fixes around version 2.36.5+; Arch Linux ASA-2...

CVE-2023-40413

CVE-2023-40413 affects Apple platforms (iOS 17.1/iPadOS 17.1 and earlier/macOS/macOS Sonoma 14.1 etc.) in the Find My component. The issue is described as an improvement in cache handling that could allow an app to read sensitive location information. The vulnerability is fixed in iOS 17.1/iPadOS...

CVE-2020-11762

OpenEXR CVE-2020-11762: An out-of-bounds read and write in DwaCompressor::uncompress (ImfDwaCompressor.cpp) occurs when handling the UNKNOWN compression case, affecting versions before 2.4.1. The issue is addressed in OpenEXR 2.4.1 (upgrade recommended).

CVE-2023-23520

CVE-2023-23520 involves a race condition in the Apple Crash Reporter that could allow a user to read arbitrary files as root. The issue was addressed with additional validation and patched in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3, and iPadOS 16.3. Affected components and exact root...

CVE-2021-1817

CVE-2021-1817 is a memory corruption bug in Apple WebKit/WebKitGTK components exploited by processing maliciously crafted web content. Affected in macOS Big Sur 11.3, iOS 14.5, iPadOS 14.5, watchOS 7.4, tvOS 14.5; remediation is to upgrade to the fixed OS versions (e.g., macOS Big Sur 11.3+, iOS/...

CVE-2021-30851

CVE-2021-30851 affects WebKitGTK and WPE WebKit. A memory corruption vulnerability could allow arbitrary code execution when processing malicious web content. Upstream fix is WebKitGTK/WebKit/WPE WebKit 2.34.1; Debian/Arch Linux advisories (DSA-4995/4996, ASA-202110-10) note remediation by upgrad...

CVE-2022-21658

CVE-2022-21658 affects Rust’s std::fs::remove_dir_all, due to a race condition (CWE-363) that could allow an attacker to trick a privileged process into deleting files/directories outside the target. Affected Rust releases: 1.0.0–1.58.0; patch released in 1.58.1. Impact can be significant for pri...

CVE-2022-26706

CVE-2022-26706 concerns an access issue in Apple’s sandboxing that allowed a sandboxed process to circumvent sandbox restrictions. Apple fixed the bug in tvOS 15.5, iOS 15.5 / iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, and macOS Monterey 12.4. The vulnerability was addressed by tightening sa...

CVE-2022-26711

CVE-2022-26711 describes an integer overflow in Apple's ImageIO WebP parsing. The root cause is an overflow in row-bytes calculation leading to an undersized buffer and out-of-bounds access during image decoding, enabling arbitrary code execution in apps using ImageIO (Safari, Preview, Mail, Mess...

CVE-2021-30846

CVE-2021-30846 is a memory corruption vulnerability in WebKitGTK and WPE WebKit that could allow remote code execution when processing malicious web content. It is publicly fixed upstream in WebKitGTK/WPE WebKit around version 2.34.1 (Arch Linux ASA-202110-9/ASA-202110-10 indicate vulnerability i...

CVE-2021-30889

CVE-2021-30889 : Buffer overflow in WebKitGTK leading to arbitrary code execution when processing malicious web content. Affected product: WebKitGTK/WebKit. Root cause: buffer overflow in WebKitGTK components (WebCore::ImageBufferCairoImageSurfaceBackend::create). Public references in ALAS2 advis...

CVE-2022-32885

CVE-2022-32885 is a WebKitGTK/WebKit memory corruption issue triggered by processing malicious web content. The connected advisories confirm the root cause as memory corruption from handling web content and show affected/patch targets across platforms: Apple devices (iOS 15.6, iPadOS 15.6, macOS ...

CVE-2022-26709

CVE-2022-26709 is a use-after-free in WebKitGTK that can lead to arbitrary code execution when processing malicious web content. The initial CVE entry notes the fix across Apple platforms (tvOS 15.5, iOS 15.5/iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5). Connected advisories (Debia...

CVE-2022-22594

CVE-2022-22594 describes a cross-origin data exfiltration issue in WebKit/WebKitGTK via cross-origin tracking, later fixed in Safari 15.3, iOS 15.3, iPadOS 15.3, watchOS 8.4, tvOS 15.3, and macOS Monterey 12.2. The connected documents indicate the vulnerability allowed tracking of sensitive user ...

CVE-2025-24126

CVE-2025-24126 describes an input validation issue in AirPlay across Apple platforms. The vulnerability allows a local-network actor to cause an unexpected termination or memory corruption. Patches are provided in visionOS 2.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18....

CVE-2021-30890

CVE-2021-30890 is a WebKit/WebKitGTK/WebKitGTK-derived vulnerability described as a logic/state issue where processing maliciously crafted web content may lead to universal cross-site scripting. Public mentions appear in multiple connected advisories: Debian DSA-5030-1 (webkit2gtk) and DSA-5031-1...

CVE-2022-46698

CVE-2022-46698 is a logic issue in WebKitGTK where processing malicious web content may disclose sensitive user information. Multiple connected advisories confirm this issue in WebKitGTK/WebKit2GTK components and list it among fixed CVEs after updates to WebKitGTK packages. Affected products incl...