Apple iOS vulnerabilities

CVE-2017-2412 [MEDIUM] CVE-2017-2412: iOS 10.3 Apple Security Update: About the security content of iOS 10.3 Product: iOS Version: 10.3 CVE: CVE-2017-2412 Component: CVE-2016-3619 Impact: An attacker in a privileged network position may be able to tamper with iTunes network traffic Description: Requests to iTunes sandbox web services were sent in cleartext. This was addressed by enabling HTTPS.

CVE-2018-4260 [MEDIUM] CVE-2018-4260: iOS 11.4.1 Apple Security Update: About the security content of iOS 11.4.1 Product: iOS Version: 11.4.1 CVE: CVE-2018-4260 Component: WebKit Page Loading Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management.

CVE-2017-13891 [MEDIUM] CVE-2017-13891: iOS 11.2 Apple Security Update: About the security content of iOS 11.2 Product: iOS Version: 11.2 CVE: CVE-2017-13891 Component: SafariViewController Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed through improved state management.

CVE-2019-8813 [MEDIUM] CWE-79 CVE-2019-8813: A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPad A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.

CVE-2019-8719 [MEDIUM] CVE-2019-8719: iOS 13 Apple Security Update: About the security content of iOS 13 Product: iOS Version: 13 CVE: CVE-2019-8719 Component: WebKit Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue was addressed with improved state management.

CVE-2014-3660 [MEDIUM] CVE-2014-3660: iOS 8.4.1 Apple Security Update: About the security content of iOS 8.4.1 Product: iOS Version: 8.4.1 CVE: CVE-2014-3660 Component: CVE-ID Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A memory corruption issue existed in handling of malformed XPC messages. This issue was improved through improved bounds checking.

CVE-2019-8625 [MEDIUM] CVE-2019-8625: iOS 13 Apple Security Update: About the security content of iOS 13 Product: iOS Version: 13 CVE: CVE-2019-8625 Component: WebKit Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue was addressed with improved state management.

CVE-2015-7023 [MEDIUM] CVE-2015-7023: iOS 9.1 Apple Security Update: About the security content of iOS 9.1 Product: iOS Version: 9.1 CVE: CVE-2015-7023 Component: CVE-ID Impact: A malicious application may be able to elevate privileges Description: A heap based buffer overflow issue existed in the DNS client library. A malicious application with the ability to spoof responses from the local configd service may have been able to cause arbitrary code execution in DNS clients.

CVE-2017-2497 [MEDIUM] CVE-2017-2497: iOS 10.3.2 Apple Security Update: About the security content of iOS 10.3.2 Product: iOS Version: 10.3.2 CVE: CVE-2017-2497 Component: Foundation Impact: Parsing maliciously crafted data may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling.

CVE-2015-5770 [MEDIUM] CVE-2015-5770: iOS 8.4.1 Apple Security Update: About the security content of iOS 8.4.1 Product: iOS Version: 8.4.1 CVE: CVE-2015-5770 Component: CVE-ID

CVE-2017-7164 [MEDIUM] CVE-2017-7164: iOS 11.2 Apple Security Update: About the security content of iOS 11.2 Product: iOS Version: 11.2 CVE: CVE-2017-7164 Component: App Store Impact: An attacker in a privileged network position may be able to spoof password prompts in App Store Description: An input validation issue was addressed through improved input validation.

CVE-2017-13080 [MEDIUM] CVE-2017-13080: iOS 11.2 Apple Security Update: About the security content of iOS 11.2 Product: iOS Version: 11.2 CVE: CVE-2017-13080 Component: Wi-Fi Impact: An attacker in Wi-Fi range may force nonce reuse in WPA multicast/GTK clients (Key Reinstallation Attacks - KRACK) Description: A logic issue existed in the handling of state transitions. This was addressed with improved state management.

CVE-2017-2414 [MEDIUM] CVE-2017-2414: iOS 10.3 Apple Security Update: About the security content of iOS 10.3 Product: iOS Version: 10.3 CVE: CVE-2017-2414 Component: DataAccess Impact: Configuring an Exchange account with a mistyped email address may resolve to an unexpected server Description: An input validation issue existed in the handling of Exchange email addresses. This issue was addressed through improved input validation.

CVE-2015-7037 [MEDIUM] CVE-2015-7037: iOS 9.2 Apple Security Update: About the security content of iOS 9.2 Product: iOS Version: 9.2 CVE: CVE-2015-7037 Component: CVE-ID

CVE-2014-8130 [MEDIUM] CVE-2014-8130: iOS 8.4 Apple Security Update: About the security content of iOS 8.4 Product: iOS Version: 8.4 CVE: CVE-2014-8130 Component: CVE-2014-8130

CVE-2015-5769 [HIGH] CVE-2015-5769: iOS 8.4.1 Apple Security Update: About the security content of iOS 8.4.1 Product: iOS Version: 8.4.1 CVE: CVE-2015-5769 Component: CVE-ID

CVE-2015-6994 [HIGH] CVE-2015-6994: iOS 9.1 Apple Security Update: About the security content of iOS 9.1 Product: iOS Version: 9.1 CVE: CVE-2015-6994 Component: CVE-ID Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in DNS data parsing. These issues were addressed through improved bounds checking.

CVE-2015-1102 [HIGH] CVE-2015-1102: iOS 8.3 Apple Security Update: About the security content of iOS 8.3 Product: iOS Version: 8.3 CVE: CVE-2015-1102 Component: CVE-ID

CVE-2017-7151 [HIGH] CVE-2017-7151: iOS 11.2 Apple Security Update: About the security content of iOS 11.2 Product: iOS Version: 11.2 CVE: CVE-2017-7151 Component: CoreFoundation Impact: An application may be able to gain elevated privileges Description: A race condition was addressed with additional validation.

CVE-2016-4592 [MEDIUM] CVE-2016-4592: iOS 9.3.3 Apple Security Update: About the security content of iOS 9.3.3 Product: iOS Version: 9.3.3 CVE: CVE-2016-4592 Component: WebKit Impact: Visiting a maliciously crafted webpage may lead to a system denial of service Description: A memory consumption issue was addressed through improved memory handling.