Apple iOS vulnerabilities
4,311 known vulnerabilities affecting apple/iphone_os.
Total CVEs
4,311
CISA KEV
93
actively exploited
Public exploits
277
Exploited in wild
142
Severity breakdown
CRITICAL345HIGH1730MEDIUM1938LOW298
Vulnerabilities
Page 105 of 216
CVE-2015-5756P4MEDIUMCVSS 6.8≤ 8.42015-08-17
CVE-2015-5756 [MEDIUM] CVE-2015-5756: FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbi
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-3804 and CVE-2015-5775.
nvd
CVE-2015-3689P4MEDIUMCVSS 6.8≤ 8.32015-07-03
CVE-2015-3689 [MEDIUM] CVE-2015-3689: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrar
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3687, and CVE-2015-3688.
nvd
CVE-2015-3685P4MEDIUMCVSS 6.8≤ 8.32015-07-03
CVE-2015-3685 [MEDIUM] CWE-119 CVE-2015-3685: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrar
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
nvd
CVE-2020-9826P4HIGHCVSS 7.5fixed in 13.52020-06-09
CVE-2020-9826 [HIGH] CWE-20 CVE-2020-9826: A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 1
A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5. A remote attacker may be able to cause a denial of service.
nvd
CVE-2016-4626P4HIGHCVSS 7.8fixed in 9.3.32016-07-22
CVE-2016-4626 [HIGH] CWE-476 CVE-2016-4626: IOHIDFamily in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.
IOHIDFamily in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
nvd
CVE-2013-1036P3MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2013-09-19
CVE-2013-1036 [MEDIUM] CWE-119 CVE-2013-1036: Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of
Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
nvd
CVE-2016-4689P4HIGHCVSS 7.5≤ 10.1.12017-02-20
CVE-2016-4689 [HIGH] CWE-254 CVE-2016-4689: An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves t
An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Mail" component, which does not alert the user to an S/MIME email signature that used a revoked certificate.
nvd
CVE-2015-7064P4MEDIUMCVSS 6.8≤ 9.12015-12-11
CVE-2015-7064 [MEDIUM] CWE-119 CVE-2015-7064: OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows
OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-7066.
nvd
CVE-2015-7066P4MEDIUMCVSS 6.8≤ 9.12015-12-11
CVE-2015-7066 [MEDIUM] CVE-2015-7066: OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows
OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-7064.
nvd
CVE-2017-13888P4HIGHCVSS 7.5fixed in 11.22019-01-11
CVE-2017-13888 [HIGH] CWE-704 CVE-2017-13888: In iOS before 11.2, a type confusion issue was addressed with improved memory handling.
In iOS before 11.2, a type confusion issue was addressed with improved memory handling.
nvd
CVE-2015-5926P4MEDIUMCVSS 6.8≤ 9.0.22015-10-23
CVE-2015-5926 [MEDIUM] CVE-2015-5926: The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 al
The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-5925.
nvd
CVE-2015-5925P4MEDIUMCVSS 6.8≤ 9.0.22015-10-23
CVE-2015-5925 [MEDIUM] CWE-119 CVE-2015-5925: The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 al
The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-5926.
nvd
CVE-2015-7065P4MEDIUMCVSS 6.8≤ 9.12015-12-11
CVE-2015-7065 [MEDIUM] CWE-119 CVE-2015-7065: OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to
OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
nvd
CVE-2015-1104P4MEDIUMCVSS 5.0≤ 8.22015-04-10
CVE-2015-1104 [MEDIUM] CWE-20 CVE-2015-1104: The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not prop
The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly determine whether an IPv6 packet had a local origin, which allows remote attackers to bypass an intended network-filtering protection mechanism via a crafted packet.
nvd
CVE-2015-5940P4MEDIUMCVSS 6.8≤ 9.0.22015-10-23
CVE-2015-5940 [MEDIUM] CWE-119 CVE-2015-5940: The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threa
The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threading is enabled, omits certain validation and locking steps, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
nvd
CVE-2015-5924P4MEDIUMCVSS 6.8≤ 9.0.22015-10-23
CVE-2015-5924 [MEDIUM] CWE-119 CVE-2015-5924: The OpenGL implementation in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to
The OpenGL implementation in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
nvd
CVE-2020-9952P4HIGHCVSS 7.1fixed in 14.02020-10-16
CVE-2020-9952 [HIGH] CWE-79 CVE-2020-9952: An input validation issue was addressed with improved input validation. This issue is fixed in iOS 1
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack.
nvd
CVE-2016-1779P4MEDIUMCVSS 6.5≤ 9.2.12016-03-24
CVE-2016-1779 [MEDIUM] CWE-200 CVE-2016-1779: WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Orig
WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request.
nvd
CVE-2018-4188P3MEDIUMCVSS 6.5fixed in 11.42018-06-08
CVE-2018-4188 [MEDIUM] CWE-20 CVE-2018-4188: An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof the address bar via a crafted web site.
nvd
CVE-2021-30857P4HIGHCVSS 7.0fixed in 15.02021-08-24
CVE-2021-30857 [HIGH] CWE-362 CVE-2021-30857: A race condition was addressed with improved locking. This issue is fixed in Security Update 2021-00
A race condition was addressed with improved locking. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, watchOS 8, macOS Big Sur 11.6. A malicious application may be able to execute arbitrary code with kernel privileges.
nvd