Iphone Os@3.1.2 Security Vulnerabilities and Issues — Iphone Os@3.1.2 CVE List

Lucene search

AppleIphone Os3.1.2

145 matches found

CVE•added 2012/11/03 5:55 p.m.•154 views

CVE-2012-3748

Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.

5.1CVSS7.5AI score0.30417EPSS

CVE•added 2013/09/19 10:27 a.m.•112 views

CVE-2013-1047

WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

6.8CVSS7.8AI score0.02313EPSS

CVE•added 2010/08/16 6:39 p.m.•87 views

CVE-2010-1797

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arb...

9.3CVSS7.8AI score0.3258EPSS

CVE•added 2012/05/16 12:55 a.m.•87 views

CVE-2011-3102

Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

6.8CVSS6.5AI score0.02013EPSS

CVE•added 2012/08/31 7:55 p.m.•84 views

CVE-2012-2870

libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xs...

4.3CVSS6.6AI score0.00906EPSS

CVE•added 2013/09/19 10:27 a.m.•83 views

CVE-2011-2391

The IPv6 implementation in the kernel in Apple iOS before 7 allows remote attackers to cause a denial of service (CPU consumption) via crafted ICMPv6 packets.

6.1CVSS4.1AI score0.01129EPSS

CVE•added 2012/11/28 1:55 a.m.•82 views

CVE-2012-5134

Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML docum...

6.8CVSS9.7AI score0.02065EPSS

CVE•added 2012/08/31 7:55 p.m.•79 views

CVE-2012-2871

libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, relate...

6.8CVSS7.4AI score0.00601EPSS

CVE•added 2011/07/19 10:55 p.m.•78 views

CVE-2011-0226

Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted ...

9.3CVSS8.7AI score0.0845EPSS

CVE•added 2012/12/21 5:46 a.m.•77 views

CVE-2012-0841

libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.

5CVSS7.9AI score0.00725EPSS

CVE•added 2012/06/27 10:18 a.m.•75 views

CVE-2012-2807

Multiple integer overflows in libxml2, as used in Google Chrome before 20.0.1132.43 and other products, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

6.8CVSS6.6AI score0.01524EPSS

CVE•added 2013/05/22 1:29 p.m.•72 views

CVE-2013-2842

Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of widgets.

7.5CVSS6.9AI score0.21099EPSS

CVE•added 2013/09/19 10:27 a.m.•69 views

CVE-2013-1041

6.8CVSS7.8AI score0.02313EPSS

CVE•added 2011/10/14 10:55 a.m.•68 views

CVE-2011-3243

Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows.

4.3CVSS5AI score0.00521EPSS

CVE•added 2010/06/18 4:30 p.m.•63 views

CVE-2010-1387

Use-after-free vulnerability in JavaScriptCore in WebKit in Apple iTunes before 9.2 on Windows, and Apple iOS before 4 on the iPhone and iPod touch, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to page transitions, a differen...

9.3CVSS9AI score0.08537EPSS

CVE•added 2013/09/19 10:27 a.m.•62 views

CVE-2013-1038

6.8CVSS7.8AI score0.02313EPSS

CVE•added 2011/10/14 10:55 a.m.•61 views

CVE-2011-3256

FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226.

4.3CVSS7.1AI score0.0845EPSS

CVE•added 2011/08/29 8:55 p.m.•59 views

CVE-2011-0228

The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbit...

7.5CVSS5.9AI score0.09009EPSS

CVE•added 2011/10/14 10:55 a.m.•59 views

CVE-2011-3246

CFNetwork in Apple iOS before 5.0.1 and Mac OS X 10.7 before 10.7.2 does not properly parse URLs, which allows remote attackers to trigger visits to unintended web sites, and transmission of cookies to unintended web sites, via a crafted (1) http or (2) https URL.

5CVSS6AI score0.0086EPSS

CVE•added 2010/03/25 9:0 p.m.•58 views

CVE-2010-1119

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database...

10CVSS8.6AI score0.28439EPSS

CVE•added 2013/09/19 10:27 a.m.•57 views

CVE-2013-1040

6.8CVSS7.8AI score0.02313EPSS

CVE•added 2012/09/20 9:55 p.m.•56 views

CVE-2012-3722

The Sorenson codec in QuickTime in Apple Mac OS X before 10.7.5, and in CoreMedia in iOS before 6, accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.

6.8CVSS7.5AI score0.02122EPSS

CVE•added 2013/03/20 2:55 p.m.•56 views

CVE-2013-0977

dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, which allows local users to bypass intended code-signing requirements via a file that contains overlapping segments.

4.6CVSS5.5AI score0.00059EPSS

CVE•added 2013/09/19 10:27 a.m.•56 views

CVE-2013-1039

6.8CVSS7.8AI score0.02313EPSS

CVE•added 2010/02/03 7:30 p.m.•55 views

CVE-2010-0038

Recovery Mode in Apple iPhone OS 1.0 through 3.1.2, and iPhone OS for iPod touch 1.1 through 3.1.2, allows physically proximate attackers to bypass device locking, and read or modify arbitrary data, via a USB control message that triggers memory corruption.

4.6CVSS6.3AI score0.00078EPSS

CVE•added 2013/03/20 2:55 p.m.•55 views

CVE-2013-0981

The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe object pointers that originated in userspace, which allows local users to gain privileges via crafted code.

7.2CVSS5.7AI score0.00045EPSS

CVE•added 2013/05/20 2:44 p.m.•55 views

CVE-2013-0999

WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-0...

9.3CVSS7.5AI score0.01302EPSS

CVE•added 2013/09/19 10:27 a.m.•55 views

CVE-2013-1036

Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

6.8CVSS7.5AI score0.02238EPSS

CVE•added 2011/03/10 8:55 p.m.•54 views

CVE-2011-1344

Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then removing the tag, r...

6.8CVSS9AI score0.03992EPSS

CVE•added 2013/03/20 2:55 p.m.•54 views

CVE-2013-0978

The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.

2.1CVSS5.5AI score0.00061EPSS

CVE•added 2011/03/11 5:55 p.m.•53 views

CVE-2011-1417

Integer overflow in QuickLook, as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a Microsoft Office document with a c...

6.8CVSS6.3AI score0.04317EPSS

CVE•added 2011/10/14 10:55 a.m.•53 views

CVE-2011-3427

The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.

2.6CVSS5.1AI score0.0031EPSS

CVE•added 2013/05/20 2:44 p.m.•53 views

CVE-2013-1003

9.3CVSS7.5AI score0.01302EPSS

CVE•added 2013/05/24 4:43 p.m.•53 views

CVE-2013-1019

Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.

9.3CVSS7.7AI score0.04963EPSS

CVE•added 2013/09/19 10:27 a.m.•53 views

CVE-2013-1037

6.8CVSS7.8AI score0.02313EPSS

CVE•added 2011/03/11 10:55 p.m.•52 views

CVE-2011-0157

WebKit, as used in Apple iOS before 4.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-09-1.

7.5CVSS7.9AI score0.01607EPSS

CVE•added 2013/05/20 2:44 p.m.•52 views

CVE-2013-1001

9.3CVSS7.5AI score0.01302EPSS

CVE•added 2013/09/19 10:28 a.m.•52 views

CVE-2013-5142

The kernel in Apple iOS before 7 does not initialize unspecified kernel data structures, which allows local users to obtain sensitive information from kernel stack memory via the (1) msgctl API or (2) segctl API.

4.9CVSS4.9AI score0.00142EPSS

CVE•added 2011/07/19 10:55 p.m.•51 views

CVE-2011-0227

The queueing primitives in IOMobileFrameBuffer in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 do not properly perform type conversion, which allows local users to gain privileges via a crafted application.

7.2CVSS5.8AI score0.00149EPSS

CVE•added 2011/10/14 10:55 a.m.•51 views

CVE-2011-3260

Buffer overflow in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word document.

6.8CVSS7.8AI score0.01604EPSS

CVE•added 2011/10/14 10:55 a.m.•51 views

CVE-2011-3426

Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header.

4.3CVSS5AI score0.00875EPSS

CVE•added 2011/11/11 6:55 p.m.•51 views

CVE-2011-3440

The Passcode Lock feature in Apple iOS before 5.0.1 on the iPad 2 does not properly implement the locked state, which allows physically proximate attackers to access data by opening a Smart Cover during power-off confirmation.

1.2CVSS5.6AI score0.00055EPSS

CVE•added 2012/05/08 10:25 a.m.•51 views

CVE-2012-0672

WebKit in Apple iOS before 5.1.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

6.8CVSS7.7AI score0.01074EPSS

CVE•added 2013/05/20 2:44 p.m.•51 views

CVE-2013-1004

9.3CVSS7.5AI score0.01302EPSS

CVE•added 2013/05/20 2:44 p.m.•51 views

CVE-2013-1005

9.3CVSS7.5AI score0.01302EPSS

CVE•added 2013/09/19 10:27 a.m.•51 views

CVE-2013-5125

6.8CVSS7.8AI score0.01866EPSS

CVE•added 2010/11/26 8:0 p.m.•50 views

CVE-2010-3829

WebKit in Apple iOS before 4.2 allows remote attackers to bypass the remote image loading setting in Mail via an HTML LINK element with a DNS prefetching property, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality, a related issue to CVE-2010-...

5.8CVSS7.8AI score0.00848EPSS

CVE•added 2011/03/11 10:55 p.m.•50 views

CVE-2011-0163

WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle unspecified "cached resources," which allows remote attackers to cause a denial of service (resource unavailability) via a crafted web site that conducts a cache-poisoning attack.

4.3CVSS7.9AI score0.01049EPSS

CVE•added 2011/10/14 10:55 a.m.•50 views

CVE-2011-3434

The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application.

4.3CVSS5.1AI score0.00493EPSS

CVE•added 2013/05/20 2:44 p.m.•50 views

CVE-2013-1002

9.3CVSS7.5AI score0.01302EPSS

Total number of security vulnerabilities145