Apple iOS vulnerabilities
4,134 known vulnerabilities affecting apple/iphone_os.
Total CVEs
4,134
CISA KEV
92
actively exploited
Public exploits
276
Exploited in wild
141
Severity breakdown
CRITICAL340HIGH1687MEDIUM1818LOW289
Vulnerabilities
Page 125 of 207
CVE-2014-4470P4MEDIUMCVSS 6.8≤ 8.1.22014-12-10
CVE-2014-4470 [MEDIUM] CWE-399 CVE-2014-4470: WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.
nvd
CVE-2014-4475P4MEDIUMCVSS 6.8≤ 8.1.22014-12-10
CVE-2014-4475 [MEDIUM] CWE-399 CVE-2014-4475: WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.
nvd
CVE-2014-4469P4MEDIUMCVSS 6.8≤ 8.1.22014-12-10
CVE-2014-4469 [MEDIUM] CWE-399 CVE-2014-4469: WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.
nvd
CVE-2014-4472P4MEDIUMCVSS 6.8≤ 8.1.22014-12-10
CVE-2014-4472 [MEDIUM] CWE-399 CVE-2014-4472: WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.
nvd
CVE-2014-4468P4MEDIUMCVSS 6.8≤ 8.1.22014-12-10
CVE-2014-4468 [MEDIUM] CWE-399 CVE-2014-4468: WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote
WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.
nvd
CVE-2012-0672P4MEDIUMCVSS 6.8≤ 5.1v3.0+20 more2012-05-08
CVE-2012-0672 [MEDIUM] CWE-119 CVE-2012-0672: WebKit in Apple iOS before 5.1.1 allows remote attackers to execute arbitrary code or cause a denial
WebKit in Apple iOS before 5.1.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
nvd
CVE-2013-5199P4MEDIUMCVSS 6.8≤ 7.0.62013-12-18
CVE-2013-5199 [MEDIUM] CWE-119 CVE-2013-5199: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
nvd
CVE-2015-6982P4MEDIUMCVSS 6.8≤ 9.0.22015-10-23
CVE-2015-6982 [MEDIUM] CWE-119 CVE-2015-6982: WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
nvd
CVE-2015-1123P4MEDIUMCVSS 6.8≤ 8.22015-04-10
CVE-2015-1123 [MEDIUM] CVE-2015-1123: WebKit, as used in Apple iOS before 8.3 and Apple TV before 7.2, allows remote attackers to execute
WebKit, as used in Apple iOS before 8.3 and Apple TV before 7.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-3 and APPLE-SA-2015-04-08-4.
nvd
CVE-2013-5198P4MEDIUMCVSS 6.8≤ 7.0.62013-12-18
CVE-2013-5198 [MEDIUM] CWE-119 CVE-2013-5198: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
nvd
CVE-2015-7005P4MEDIUMCVSS 6.8≤ 9.0.22015-10-23
CVE-2015-7005 [MEDIUM] CWE-119 CVE-2015-7005: WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
nvd
CVE-2015-6981P4MEDIUMCVSS 6.8≤ 9.0.22015-10-23
CVE-2015-6981 [MEDIUM] CWE-119 CVE-2015-6981: WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
nvd
CVE-2013-5228P4MEDIUMCVSS 6.8≤ 7.0.62013-12-18
CVE-2013-5228 [MEDIUM] CWE-119 CVE-2013-5228: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
nvd
CVE-2012-3726P4MEDIUMCVSS 6.8≤ 5.1.1v1.0.0+38 more2012-09-20
CVE-2012-3726 [MEDIUM] CWE-399 CVE-2012-3726: Double free vulnerability in ImageIO in Apple iOS before 6 allows remote attackers to execute arbitr
Double free vulnerability in ImageIO in Apple iOS before 6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image.
nvd
CVE-2013-5196P4MEDIUMCVSS 6.8≤ 7.0.62013-12-18
CVE-2013-5196 [MEDIUM] CWE-119 CVE-2013-5196: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
nvd
CVE-2013-5197P4MEDIUMCVSS 6.8≤ 7.0.62013-12-18
CVE-2013-5197 [MEDIUM] CWE-119 CVE-2013-5197: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
nvd
CVE-2013-5225P4MEDIUMCVSS 6.8≤ 7.0.62013-12-18
CVE-2013-5225 [MEDIUM] CWE-119 CVE-2013-5225: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut
WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.
nvd
CVE-2021-36976P4MEDIUMCVSS 6.5fixed in 15.42021-07-20
CVE-2021-36976 [MEDIUM] CWE-416 CVE-2021-36976: libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block
libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
nvd
CVE-2015-7499P4MEDIUMCVSS 5.0≤ 9.2.12015-12-15
CVE-2015-7499 [MEDIUM] CWE-119 CVE-2015-7499: Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows contex
Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
nvd
CVE-2021-30788P4HIGHCVSS 7.1fixed in 14.72021-09-08
CVE-2021-30788 [HIGH] CVE-2021-30788: This issue was addressed with improved checks. This issue is fixed in iOS 14.7, macOS Big Sur 11.5,
This issue was addressed with improved checks. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-005 Mojave, Security Update 2021-004 Catalina. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents.
nvd