CVE-2023-42839

CVE-2023-42839 pertains to an Apple-wide issue fixed by improved state management. Affected products/environments include tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1, and iPadOS 17.1. The vulnerability potentially allowed an app to access sensitive user data. Remediation is OS updates to...

CVE-2023-42953

CVE-2023-42953 is an Apple ecosystem vulnerability describing a permissions issue that could allow an app to access sensitive user data. The connected sources specify remediation in updated versions across multiple Apple platforms: tvOS 17.1, watchOS 10.1, iOS 17.1, iPadOS 17.1, and macOS Sonoma ...

CVE-2023-42946

CVE-2023-42946: Apple platform information-disclosure issue where an app may leak sensitive user data. Affected products include tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1, and iPadOS 17.1. Root cause described as improved redaction of sensitive information; public details consistently ...

CVE-2023-42823

CVE-2023-42823 affects Apple platforms (iOS/iPadOS/watchOS/macOS/tvOS). The issue arises from logging sanitization that allows an app to access user-sensitive data via log entries. Affected versions include iOS 16.7.2 and 17.1, iPadOS 16.7.2 and 17.1, watchOS 10.1, tvOS 17.1, macOS Sonoma 14.1, m...

CVE-2023-42873

CVE-2023-42873 affects Apple platforms and is resolved via updated bounds checks that prevent arbitrary code execution with kernel privileges. The fixed versions include macOS Sonoma 14.1; tvOS 17.1; macOS Monterey 12.7.1; macOS Ventura 13.6.1; iOS 16.7.2 and 17.1; and iPadOS 16.7.2 and 17.1. The...

CVE-2023-42848

CVE-2023-42848 affects Apple media/image processing components across multiple platforms. The issue causes heap corruption when processing a maliciously crafted image, addressed by updated bounds checks and fixes in: watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, iOS 16.7.2 and 17.1, and iPadOS 16.7...

CVE-2024-27816

The CVE-2024-27816 entry affects tvOS 17.5 (Apple TV) via the AppleMobileFileIntegrity component. A logic issue was addressed with improved checks, with the impact that an attacker may be able to access user data. Apple’s security content indicates this fix is part of tvOS 17.5, and related Apple...

CVE-2020-27918

CVE-2020-27918 is a use-after-free vulnerability in WebKitGTK/WebKit where processing maliciously crafted web content may lead to arbitrary code execution. The issue is documented across multiple advisories and is fixed upstream in WebKitGTK/WebKit version 2.30.6 (and corresponding package update...

CVE-2023-32373

CVE-2023-32373 is a use-after-free in WebKitGTK/WebKit related to processing malicious web content. Connected advisories confirm this vulnerability affects WebKitGTK/WebKit components and note exploitation activity. The issue is fixed in WebKitGTK/WebKit updates (e.g., webkitgtk4 packages) across...

CVE-2023-28204

CVE-2023-28204 is an out-of-bounds read in WebKit caused by improper input handling while processing web content. It affects WebKit-based components and was fixed in multiple vendor advisories: Apple updates (watchOS/macOS/iOS/iPadOS/Safari) and WebKitGTK/WPE WebKit packages (e.g., webkitgtk4 2.3...

CVE-2023-32409

CVE-2023-32409 is a WebKit sandbox-escape vulnerability in WebKit’s handling of web content. The issue allowed a remote attacker to break out of the Web Content sandbox and was addressed by improved bounds checks. Fixes are included in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iP...

CVE-2022-2294

CVE-2022-2294 is a heap-buffer-overflow in WebRTC code within Google Chrome (Chromium-based) prior to 103.0.5060.114. Reported as enabling remote heap corruption via a crafted HTML page, potentially leading to code execution. Affected component: WebRTC in Chrome/Chromium. Remediation: upgrade to ...

CVE-2021-30661

CVE-2021-30661 is a use-after-free vulnerability in WebKit Storage that could lead to arbitrary code execution when processing malicious web content. Affected: WebKit/WebKitGTK/WebKit Storage components on Apple platforms (Safari/WebKit on macOS/iOS/iPadOS, and WebKitGTK implementations) as descr...

CVE-2021-1789

The CVE-2021-1789 entry refers to a type-confusion vulnerability in WebKitGTK and WebKit prior to 2.30.6 that could allow remote attackers to execute arbitrary code by processing malicious web content. Connected advisories (Arch Linux ASA-202103-24/ASA-202103-25 and ALAS/ALPINE entries) confirm t...

CVE-2020-6514

CVE-2020-6514 affects Google Chrome WebRTC data channel where an attacker in a privileged network position could trigger a memory corruption (heap) via a crafted SCTP stream. The initial description notes an inappropriate WebRTC implementation as the underlying cause, with the vulnerability explo...

CVE-2022-22675

CVE-2022-22675 is an Apple kernel-related out-of-bounds write vulnerability (AppleAVD) that could allow code execution with kernel privileges. Affected macOS Big Sur 11.x, Monterey, tvOS, watchOS, iOS, and iPadOS components were fixed in specific updates: tvOS 15.5, watchOS 8.6, macOS Big Sur 11....

CVE-2020-7463

CVE-2020-7463 is a FreeBSD kernel use-after-free vulnerability caused by improper handling of large user messages from multiple threads on the same SCTP socket. Affected: FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEA...

CVE-2020-15969

CVE-2020-15969 is a use-after-free in WebRTC that was exploitable via a crafted HTML page, potentially causing heap corruption and arbitrary code execution. Connected Apple advisories (Safari 14.0.2, watchOS 7.2, tvOS 14.3) indicate this was addressed by Apple in respective security updates; appl...

CVE-2021-30663

CVE-2021-30663 relates to WebKit/WebKitGTK and involves an integer overflow when processing malicious web content, potentially allowing arbitrary code execution. Publicly documented fixes include upstream WebKitGTK and related WebKit components, with patches delivering non-exploit code paths, and...

CVE-2021-30665

CVE-2021-30665 is a memory corruption vulnerability in WebKitGTK/WebKit (before 2.32.3) that can lead to arbitrary code execution when processing malicious web content. It is listed in multiple advisories across WebKitGTK/WebKit and Apple platforms (watchOS/iOS/iPadOS/macOS/tvOS) with exploitatio...

CVE-2019-8506

CVE-2019-8506 is a type-confusion memory issue that affects WebKit components and was fixed in multiple Apple platforms (iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes/Windows, iCloud for Windows 7.11) and WebKitGTK/WebKitGTK+ up to 2.28.x. The vulnerability can allow arbitrary code execut...

CVE-2020-9859

CVE-2020-9859 is an Apple kernel code execution vulnerability triggered by a memory consumption issue. Affected products include iOS 13.5.1/iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, and watchOS 6.2.6. Root cause: memory handling flaw that could allow an application t...

CVE-2016-9843

CVE-2016-9843 concerns zlib 1.2.8 and its crc32_big implementation (big-endian CRC calculation). Connected docs show affected packages: FLTK builds for zlib before 1.3.8-1 in CBLMariner, and Cloud Foundry/ALAS advisories link multiple zlib-related CVEs with remediation guidance. The FLTK note sta...

CVE-2023-37450

CVE-2023-37450 is a WebKit/WebKitGTK-related vulnerability where processing web content may lead to arbitrary code execution. Apple’s documentation states the issue was addressed with improved checks and memory handling, with fixes in iOS 16.6 / iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventur...

CVE-2019-8605

CVE-2019-8605 is a use-after-free vulnerability in Apple’s XNU kernel (iOS, macOS, tvOS, watchOS) that could allow a malicious app to execute arbitrary code with system privileges. The initial description notes a use-after-free that was fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, and watc...

CVE-2021-30883

CVE-2021-30883 is an memory-corruption vulnerability in Apple’s IOMobileFrameBuffer that can allow a malicious app to execute arbitrary code with kernel privileges. Apple patched it across iOS/iPadOS 14.8.1 and 15.0.2, macOS Big Sur 11.6.1 and Monterey 12.0.1, tvOS 15.1, and watchOS 8.1. The Appl...

CVE-2021-1782

CVE-2021-1782 is an iOS/XNU in-the-wild vulnerability in the IPC vouchers subsystem. Project Zero details a race window around user_data handling: an non-atomic increment of e_made in a user_data_value_element can desynchronize with ivace->ivace_made, enabling a race between releasing and revi...

CVE-2014-4404

CVE-2014-4404 describes a heap-based buffer overflow in IOHIDFamily that affects Apple iOS prior to 8 and Apple TV prior to 7. The vulnerability occurs when parsing crafted key-mapping properties, enabling an attacker to execute arbitrary code in a privileged context via a user-space application....

CVE-2023-27930

CVE-2023-27930 is a kernel-level type confusion vulnerability addressed by Apple in iOS 16.5 / iPadOS 16.5, watchOS 9.5, tvOS 16.5, and macOS Ventura 13.4. The issue allows an app to potentially execute arbitrary code with kernel privileges due to a type confusion in the kernel; Apple notes impro...

CVE-2022-42856

CVE-2022-42856 is a type-confusion vulnerability in WebKit/WebKitGTK that could allow arbitrary code execution when processing malicious web content. The connected documents confirm impact across WebKit-based products, including Apple WebKit (Safari) and WebKitGTK, with fixes in Safari 16.2, macO...

CVE-2020-3837

CVE-2020-3837 is an Apple memory-corruption issue fixed in iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, and watchOS 6.1.2, with potential to run arbitrary code with kernel privileges. Connected analysis documents reveal concrete Android exploitation research tied to this CVE fa...

CVE-2025-6965

CVE-2025-6965 affects SQLite prior to 3.50.2, where the number of aggregate terms could exceed available columns, causing a memory corruption issue. The description in the Initial document notes upgrading to 3.50.2 or newer as the recommended fix. Connected documents corroborate the vulnerability...

CVE-2024-27804

CVE-2024-27804 affects Apple platforms (iOS 17.5/iPadOS 17.5, tvOS 17.5, watchOS 10.5, macOS Sonoma 14.5). The issue is described as improved memory handling that may allow an app to execute arbitrary code with kernel privileges. Affected component/behavior: memory handling in the kernel space. I...

CVE-2020-9907

CVE-2020-9907 is an Apple AVEVideoEncoder-related memory corruption vulnerability. The issue was mitigated by removing the vulnerable code and is fixed in iOS 13.6 and iPadOS 13.6, and tvOS 13.4.8. Apple’s entry documents indicate the impact as an application potentially executing arbitrary code ...

CVE-2018-4344

CVE-2018-4344 is a memory corruption issue often referred to as LightSpeed. The official entry notes a memory corruption in Apple OS components that was fixed with memory handling improvements, affecting iOS versions older than iOS 12, macOS Mojave 10.14, tvOS 12, and watchOS 5. Several connected...

CVE-2023-38606

CVE-2023-38606 affects Apple’s kernel across iOS, iPadOS, macOS, tvOS and watchOS; the issue allows an app to modify a sensitive kernel state. The vulnerability was addressed with updated state management and patches, with fixes in macOS Monterey 12.6.8, iOS 15.7.8/iPadOS 15.7.8, iOS 16.6/iPadOS ...

CVE-2013-0340

CVE-2013-0340 concerns the expat XML parser. The issue arises from improper handling of XML entity expansion (XXE) unless an application enables XML_SetEntityDeclHandler. This can allow a remote attacker to cause denial of service (resource consumption), trigger requests to intranet endpoints, or...

CVE-2021-30836

CVE-2021-30836 is an out-of-bounds read vulnerability in WebKitGTK/WebKitGTK-based WebKit, manifested while processing a malicious audio file. The root cause is an input-validation/bounds-check issue leading to memory disclosure. Affected products include WebKitGTK/WebKitGTK2, with multiple advis...

CVE-2025-14174

CVE-2025-14174 = Out-of-bounds memory access in ANGLE within Google Chrome on macOS prior to 143.0.7499.110. A remote attacker could trigger memory access errors via a crafted HTML page. Affected software: Google Chrome on macOS; vulnerable component: ANGLE. Impact: high enough to potentially ena...

CVE-2023-32412

CVE-2023-32412 involves a use-after-free in a component likely within Apple platform software. Affected: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 15.7.6/iPadOS 15.7.6 and iOS 16.5/iPadOS 16.5. Root cause: use-after-free memory issue addressed by...

CVE-2016-9841

CVE-2016-9841 is a vulnerability in zlib 1.2.8 related to improper pointer arithmetic in inffast.c that could have context-dependent impact. Connected advisories confirm public details and show remediation by upgrading zlib to a newer version (e.g., 1.2.11) across affected products and distributi...

CVE-2020-15358

CVE-2020-15358 (SQLite) affects the SQLite library, specifically the query engine path in select.c where the query-flattener optimization mishandles constant propagation for multiSelectOrderBy. The root cause is a mishandling of transitive properties during constant propagation, leading to a heap...

CVE-2023-38572

CVE-2023-38572 concerns WebKitGTK/WebKit components where a website may bypass the Same Origin Policy. The CVE is addressed with updated checks and is fixed in multiple Apple platforms: iOS 15.7.8 and iPadOS 15.7.8; iOS 16.6 and iPadOS 16.6; tvOS 16.6; macOS Ventura 13.5; Safari 16.6; watchOS 9.6...

CVE-2023-38611

CVE-2023-38611 affects WebKitGTK/WebKitGTK+ in WebKitGTK’s handling of web content. The vulnerability stems from memory handling issues that could allow arbitrary code execution when processing web content. Debian, Fedora, Gentoo, AlmaLinux advisories and the CVE pages indicate updates to WebKitG...

CVE-2023-38133

CVE-2023-38133 affects WebKit/WebKitGTK components and is documented across multiple advisories. The issue involves processing web content that may disclose sensitive information. Fixes are implemented in Apple platforms (iOS 15.7.8 / 16.6, iPadOS 15.7.8 / 16.6, tvOS 16.6, watchOS 9.6, macOS Vent...

CVE-2024-23222

Summary (CVE-2024-23222) : A type confusion vulnerability in Apple WebKit leads to arbitrary code execution when processing malicious web content. The issue affects multiple Apple platforms and is fixed in versions listed by the sources: iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, and...

CVE-2023-38594

The CVE-2023-38594 issue is a WebKitGTK/WebKitGTK+ vulnerability: processing web content could lead to arbitrary code execution. Connected advisories confirm a fixed version across multiple distributions and products (e.g., WebKitGTK/WebKitGTK+), with fixes described as “improved checks” or relat...

CVE-2023-38595

CVE-2023-38595 is a WebKitGTK+ related vulnerability: processing web content may lead to arbitrary code execution. Connected advisories show affected packages as WebKitGTK/WebKitGTK+ (webkitgtk or webkitgtk4) across Linux distributions. Fixed versions vary by distro: Debian lists fixes in webkit2...

CVE-2020-9802

CVE-2020-9802 is a memory-related/logic issue in WebKit-based components where processing maliciously crafted web content may lead to arbitrary code execution. The initial Apple advisory links the vulnerability to multiple products and states that the issue is fixed in Apple iOS 13.5 and iPadOS 1...

CVE-2023-38600

CVE-2023-38600 is a WebKitGTK/WebKit vulnerability that may allow arbitrary code execution when processing web content. The connected advisories confirm a fix across multiple platforms: Apple OS updates (iOS 16.6, iPadOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6), and Linux distributions...