CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple » Iphone Os : Security Vulnerabilities (CVSS score >= 9)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2015-7113 119 DoS Exec Code Overflow Mem. Corr. 2015-12-11 2015-12-11
10.0
Admin Remote Low Not required Complete Complete Complete
The LaunchServices component in Apple iOS before 9.2 and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a malformed plist.
2 CVE-2015-7112 119 DoS Exec Code Overflow Mem. Corr. 2015-12-11 2015-12-11
9.3
None Remote Medium Not required Complete Complete Complete
The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7111.
3 CVE-2015-7111 119 DoS Exec Code Overflow Mem. Corr. 2015-12-11 2015-12-11
9.3
None Remote Medium Not required Complete Complete Complete
The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7112.
4 CVE-2015-7109 119 DoS Exec Code Overflow Mem. Corr. 2015-12-11 2015-12-11
9.3
None Remote Medium Not required Complete Complete Complete
IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
5 CVE-2015-7079 20 Exec Code 2015-12-11 2015-12-11
9.3
None Remote Medium Not required Complete Complete Complete
dyld in Apple iOS before 9.2 and tvOS before 9.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
6 CVE-2015-7072 20 Exec Code 2015-12-11 2015-12-11
9.3
None Remote Medium Not required Complete Complete Complete
dyld in Apple iOS before 9.2, tvOS before 9.1, and watchOS before 2.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
7 CVE-2015-7070 Exec Code 2015-12-11 2015-12-11
9.3
Admin Remote Medium Not required Complete Complete Complete
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7069.
8 CVE-2015-7069 Exec Code 2015-12-11 2015-12-11
9.3
Admin Remote Medium Not required Complete Complete Complete
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.
9 CVE-2015-7068 DoS Exec Code 2015-12-11 2015-12-11
9.3
Admin Remote Medium Not required Complete Complete Complete
IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.
10 CVE-2015-7055 284 Exec Code 2015-12-11 2015-12-11
9.3
Admin Remote Medium Not required Complete Complete Complete
AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
11 CVE-2015-7051 264 Exec Code 2015-12-11 2015-12-11
9.3
Admin Remote Medium Not required Complete Complete Complete
MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
12 CVE-2015-6988 Exec Code 2015-10-23 2015-10-26
10.0
None Remote Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers to execute arbitrary code via vectors involving an unknown network-connectivity requirement.
13 CVE-2015-6986 Exec Code 2015-10-23 2015-10-23
9.3
None Remote Medium Not required Complete Complete Complete
com.apple.driver.AppleVXD393 in the Graphics Driver subsystem in Apple iOS before 9.1 allows attackers to execute arbitrary code via a crafted app that leverages an unspecified "type confusion."
14 CVE-2015-6979 119 DoS Exec Code Overflow Mem. Corr. 2015-10-23 2015-12-18
9.3
None Remote Medium Not required Complete Complete Complete
GasGauge in Apple iOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
15 CVE-2015-6974 119 DoS Exec Code Overflow Mem. Corr. 2015-10-23 2015-10-26
9.3
None Remote Medium Not required Complete Complete Complete
IOHIDFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
16 CVE-2015-5903 119 DoS Overflow +Priv Mem. Corr. 2015-09-18 2015-10-09
10.0
None Remote Low Not required Complete Complete Complete
The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5868 and CVE-2015-5896.
17 CVE-2015-5876 119 DoS Exec Code Overflow Mem. Corr. 2015-09-18 2015-10-09
9.3
None Remote Medium Not required Complete Complete Complete
dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
18 CVE-2015-5867 119 DoS Exec Code Overflow Mem. Corr. 2015-09-18 2015-10-13
9.3
None Remote Medium Not required Complete Complete Complete
IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
19 CVE-2015-5846 119 DoS Exec Code Overflow Mem. Corr. 2015-09-18 2015-10-09
9.3
None Remote Medium Not required Complete Complete Complete
IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-5844 and CVE-2015-5845.
20 CVE-2015-5845 119 DoS Exec Code Overflow Mem. Corr. 2015-09-18 2015-10-09
9.3
None Remote Medium Not required Complete Complete Complete
IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-5844 and CVE-2015-5846.
21 CVE-2015-5844 119 DoS Exec Code Overflow Mem. Corr. 2015-09-18 2015-10-09
9.3
None Remote Medium Not required Complete Complete Complete
IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-5845 and CVE-2015-5846.
22 CVE-2015-5757 119 DoS Exec Code Overflow Mem. Corr. 2015-08-16 2015-08-19
9.3
None Remote Medium Not required Complete Complete Complete
libpthread in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via an app that uses a crafted syscall to interfere with locking.
23 CVE-2015-3795 119 DoS Exec Code Overflow Mem. Corr. 2015-08-16 2015-08-19
9.3
None Remote Medium Not required Complete Complete Complete
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
24 CVE-2015-3776 119 DoS Exec Code Overflow Mem. Corr. 2015-08-16 2015-08-19
9.3
None Remote Medium Not required Complete Complete Complete
IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.
25 CVE-2015-3768 189 Exec Code Overflow 2015-08-16 2015-08-19
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in the kernel in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that makes unspecified IOKit API calls.
26 CVE-2015-1061 94 Exec Code 2015-03-12 2015-09-28
9.3
None Remote Medium Not required Complete Complete Complete
IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling.
27 CVE-2014-4495 264 Bypass 2015-01-30 2015-11-17
10.0
None Remote Low Not required Complete Complete Complete
The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a shared memory segment during use of a custom cache mode, which allows attackers to bypass intended access restrictions via a crafted app.
28 CVE-2014-4489 DoS Exec Code 2015-01-30 2015-11-17
10.0
None Remote Low Not required Complete Complete Complete
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
29 CVE-2014-4488 19 Exec Code 2015-01-30 2015-11-17
10.0
None Remote Low Not required Complete Complete Complete
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
30 CVE-2014-4487 119 Exec Code Overflow 2015-01-30 2015-11-17
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context via a crafted app.
31 CVE-2014-4486 DoS Exec Code 2015-01-30 2015-02-02
10.0
None Remote Low Not required Complete Complete Complete
IOAcceleratorFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly handle resource lists and IOService userclient types, which allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted app.
32 CVE-2014-4480 59 Dir. Trav. 2015-01-30 2015-11-17
10.0
None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.
33 CVE-2014-4461 20 Exec Code 2014-11-18 2015-02-06
9.3
None Remote Medium Not required Complete Complete Complete
The kernel in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly validate IOSharedDataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted application.
34 CVE-2014-4418 20 Exec Code 2014-09-18 2015-12-23
9.3
None Remote Medium Not required Complete Complete Complete
IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than CVE-2014-4388.
35 CVE-2014-4405 DoS Exec Code 2014-09-18 2015-09-30
9.3
None Remote Medium Not required Complete Complete Complete
IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an application that provides crafted key-mapping properties.
36 CVE-2014-4404 119 Exec Code Overflow 2014-09-18 2015-10-01
9.3
None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
37 CVE-2014-4389 189 Exec Code Overflow 2014-09-18 2015-12-14
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in IOKit in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted API arguments.
38 CVE-2014-4388 20 Exec Code 2014-09-18 2015-12-23
9.3
None Remote Medium Not required Complete Complete Complete
IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than CVE-2014-4418.
39 CVE-2014-4381 119 Exec Code Overflow 2014-09-18 2015-11-24
9.3
None Remote Medium Not required Complete Complete Complete
Libnotify in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, which allows attackers to execute arbitrary code as root via a crafted application.
40 CVE-2014-4380 119 Exec Code Overflow 2014-09-18 2015-10-01
9.3
None Remote Medium Not required Complete Complete Complete
The IOHIDFamily kernel extension in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, which allows attackers to execute arbitrary code in the kernel's context via a crafted application.
41 CVE-2014-1359 189 Exec Code 2014-07-01 2015-12-08
10.0
None Remote Low Not required Complete Complete Complete
Integer underflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
42 CVE-2014-1358 189 Exec Code Overflow 2014-07-01 2015-12-08
10.0
None Remote Low Not required Complete Complete Complete
Integer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application.
43 CVE-2014-1357 119 Exec Code Overflow 2014-07-01 2015-12-08
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that generates log messages.
44 CVE-2014-1356 119 Exec Code Overflow 2014-07-01 2015-12-08
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in launchd in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 allows attackers to execute arbitrary code via a crafted application that sends IPC messages.
45 CVE-2013-5139 119 DoS Exec Code Overflow 2013-09-19 2014-03-05
9.3
None Remote Medium Not required Complete Complete Complete
The IOSerialFamily driver in Apple iOS before 7 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds array access) via a crafted application.
46 CVE-2013-1019 119 DoS Exec Code Overflow 2013-05-24 2013-11-02
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.
47 CVE-2013-1010 399 DoS Exec Code Mem. Corr. 2013-05-20 2013-11-02
9.3
None Remote Medium Not required Complete Complete Complete
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
48 CVE-2013-1008 399 DoS Exec Code Mem. Corr. 2013-05-20 2013-11-02
9.3
None Remote Medium Not required Complete Complete Complete
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
49 CVE-2013-1007 399 DoS Exec Code Mem. Corr. 2013-05-20 2013-11-02
9.3
None Remote Medium Not required Complete Complete Complete
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
50 CVE-2013-1006 399 DoS Exec Code Mem. Corr. 2013-05-20 2013-11-02
9.3
None Remote Medium Not required Complete Complete Complete
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
Total number of vulnerabilities : 133   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.