Apple iOS vulnerabilities

3,940 known vulnerabilities affecting apple/iphone_os.

Total CVEs

3,940

CISA KEV

actively exploited

Public exploits

248

Exploited in wild

Severity breakdown

CRITICAL313HIGH1610MEDIUM1730LOW287

Vulnerabilities

Page 136 of 197

CVE-2017-2416HIGHCVSS 7.8≤ 10.2.12017-04-02

CVE-2017-2416 [HIGH] CWE-119 CVE-2017-2416: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a craft

nvd

CVE-2017-2482HIGHCVSS 7.8PoC≤ 10.2.12017-04-02

CVE-2017-2482 [HIGH] CWE-119 CVE-2017-2482: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. A buffer overflow allows attackers to execute arbitrary code in a privileged context via a crafted app.

nvd

CVE-2017-2467HIGHCVSS 7.8≤ 10.2.12017-04-02

CVE-2017-2467 [HIGH] CWE-119 CVE-2017-2467: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a craft

nvd

CVE-2017-2459HIGHCVSS 8.8PoC≤ 10.2.12017-04-02

CVE-2017-2459 [HIGH] CWE-119 CVE-2017-2459: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

nvd

CVE-2017-2377HIGHCVSS 7.5≤ 10.2.12017-04-02

CVE-2017-2377 [HIGH] CWE-119 CVE-2017-2377: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state.

nvd

CVE-2017-2481HIGHCVSS 8.8≤ 10.2.12017-04-02

CVE-2017-2481 [HIGH] CWE-119 CVE-2017-2481: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

nvd

CVE-2017-2486MEDIUMCVSS 6.5≤ 10.2.12017-04-02

CVE-2017-2486 [MEDIUM] CWE-425 CVE-2017-2486: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof the address bar via a crafted web site.

nvd

CVE-2017-2414MEDIUMCVSS 5.3≤ 10.2.12017-04-02

CVE-2017-2414 [MEDIUM] CWE-20 CVE-2017-2414: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves t An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "DataAccess" component. It allows remote attackers to access Exchange traffic in opportunistic circumstances by leveraging a mistake in typing an e-mail address.

nvd

CVE-2017-2480MEDIUMCVSS 6.5PoC≤ 10.2.12017-04-02

CVE-2017-2480 [MEDIUM] CWE-200 CVE-2017-2480: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive in

nvd

CVE-2017-2452MEDIUMCVSS 4.6≤ 10.2.12017-04-02

CVE-2017-2452 [MEDIUM] CWE-200 CVE-2017-2452: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves t An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Siri" component. It allows physically proximate attackers to read text messages on the lock screen via unspecified vectors.

nvd

CVE-2017-2448MEDIUMCVSS 5.9≤ 10.2.12017-04-02

CVE-2017-2448 [MEDIUM] CWE-200 CVE-2017-2448: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. The issue involves the "Keychain" component. It allows man-in-the-middle attackers to bypass an iCloud Keychain secret protection mechanism by leveraging lack of authentication for OTR packets.

nvd

CVE-2017-2400MEDIUMCVSS 5.3≤ 10.2.12017-04-02

CVE-2017-2400 [MEDIUM] CWE-200 CVE-2017-2400: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves t An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "SafariViewController" component. It allows attackers to obtain sensitive information by leveraging the SafariViewController's incorrect synchronization of Safari cache clearing.

nvd

CVE-2017-2475MEDIUMCVSS 6.1fixed in 10.32017-04-02

CVE-2017-2475 [MEDIUM] CWE-79 CVE-2017-2475: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames on a web site.

nvd

CVE-2017-2393MEDIUMCVSS 6.1≤ 10.2.12017-04-02

CVE-2017-2393 [MEDIUM] CWE-79 CVE-2017-2393: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves t An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Safari Reader" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site.

nvd

CVE-2017-2386MEDIUMCVSS 6.5≤ 10.2.12017-04-02

CVE-2017-2386 [MEDIUM] CVE-2017-2386: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.

nvd

CVE-2017-2367MEDIUMCVSS 6.5PoC≤ 10.2.12017-04-02

CVE-2017-2367 [MEDIUM] CVE-2017-2367: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.

nvd

CVE-2017-2417MEDIUMCVSS 5.5≤ 10.2.12017-04-02

CVE-2017-2417 [MEDIUM] CWE-835 CVE-2017-2417: An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "CoreGraphics" component. It allows remote attackers to cause a denial of service (infinite recursion) via a crafted image.

nvd

CVE-2017-2424MEDIUMCVSS 6.5≤ 10.2.12017-04-02

CVE-2017-2424 [MEDIUM] CWE-200 CVE-2017-2424: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves mishandling of OpenGL shaders in the "WebKit" component. It allows remote attackers to obtain sensitive information from process memory via a crafted web site.

nvd

CVE-2017-2412MEDIUMCVSS 5.9≤ 10.2.12017-04-02

CVE-2017-2412 [MEDIUM] CWE-319 CVE-2017-2412: An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves t An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle attackers to modify the client-server data stream to iTunes sandbox web services by leveraging use of cleartext HTTP.

nvd

CVE-2017-2479MEDIUMCVSS 6.5PoCfixed in 10.32017-04-02

CVE-2017-2479 [MEDIUM] CWE-20 CVE-2017-2479: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive inf

nvd

← Previous136 / 197Next →