Apple iOS vulnerabilities
4,426 known vulnerabilities affecting apple/iphone_os.
Total CVEs
4,426
CISA KEV
93
actively exploited
Public exploits
278
Exploited in wild
142
Severity breakdown
CRITICAL347HIGH1764MEDIUM2008LOW307
Vulnerabilities
Page 144 of 222
CVE-2012-1521P4MEDIUMCVSS 6.8fixed in 6.02012-05-01
CVE-2012-1521 [MEDIUM] CWE-416 CVE-2012-1521: Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote a
Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
nvd
CVE-2011-3078P4MEDIUMCVSS 6.8fixed in 6.02012-05-01
CVE-2011-3078 [MEDIUM] CWE-416 CVE-2011-3078: Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause
Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3081.
nvd
CVE-2011-3050P4MEDIUMCVSS 6.8fixed in 6.02012-03-22
CVE-2011-3050 [MEDIUM] CWE-416 CVE-2011-3050: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome bef
Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.
nvd
CVE-2011-3076P4MEDIUMCVSS 6.8fixed in 6.02012-04-05
CVE-2011-3076 [MEDIUM] CWE-416 CVE-2011-3076: Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause
Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to focus handling.
nvd
CVE-2011-3068P4MEDIUMCVSS 6.8fixed in 6.02012-04-05
CVE-2011-3068 [MEDIUM] CWE-416 CVE-2011-3068: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome bef
Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to run-in boxes.
nvd
CVE-2011-3032P4MEDIUMCVSS 6.8fixed in 6.02012-03-05
CVE-2011-3032 [MEDIUM] CWE-416 CVE-2011-3032: Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a
Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG values.
nvd
CVE-2016-4743P4HIGHCVSS 7.1≤ 10.1.12017-02-20
CVE-2016-4743 [HIGH] CWE-119 CVE-2016-4743: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption and ap
nvd
CVE-2011-3041P4MEDIUMCVSS 6.8fixed in 6.02012-03-05
CVE-2011-3041 [MEDIUM] CWE-416 CVE-2011-3041: Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a
Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of class attributes.
nvd
CVE-2015-8242P4MEDIUMCVSS 5.8≤ 9.2.12015-12-15
CVE-2015-8242 [MEDIUM] CWE-119 CVE-2015-8242: The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.
The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
nvd
CVE-2016-4773P4HIGHCVSS 7.1fixed in 10.02016-09-25
CVE-2016-4773 [HIGH] CWE-125 CVE-2016-4773: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows at
The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4774 and CVE-2016-4776.
nvd
CVE-2016-4776P4HIGHCVSS 7.1fixed in 10.02016-09-25
CVE-2016-4776 [HIGH] CVE-2016-4776: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows at
The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4773 and CVE-2016-4774.
nvd
CVE-2016-4774P4HIGHCVSS 7.1fixed in 10.02016-09-25
CVE-2016-4774 [HIGH] CVE-2016-4774: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows at
The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4773 and CVE-2016-4776.
nvd
CVE-2011-1449P4MEDIUMCVSS 6.8fixed in 5.02011-05-03
CVE-2011-1449 [MEDIUM] CWE-416 CVE-2011-1449: Use-after-free vulnerability in the WebSockets implementation in Google Chrome before 11.0.696.57 al
Use-after-free vulnerability in the WebSockets implementation in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
nvd
CVE-2011-2790P4MEDIUMCVSS 6.8fixed in 5.02011-08-03
CVE-2011-2790 [MEDIUM] CWE-416 CVE-2011-2790: Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a
Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving floating styles.
nvd
CVE-2011-3016P4MEDIUMCVSS 6.8fixed in 6.02012-02-16
CVE-2011-3016 [MEDIUM] CWE-416 CVE-2011-3016: Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a
Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving counter nodes, related to a "read-after-free" issue.
nvd
CVE-2011-3969P4MEDIUMCVSS 6.8fixed in 6.02012-02-09
CVE-2011-3969 [MEDIUM] CWE-416 CVE-2011-3969: Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a
Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout of SVG documents.
nvd
CVE-2017-7151P4HIGHCVSS 7.0fixed in 11.22019-04-03
CVE-2017-7151 [HIGH] CWE-362 CVE-2017-7151: A race condition was addressed with additional validation. This issue affected versions prior to iOS
A race condition was addressed with additional validation. This issue affected versions prior to iOS 11.2, macOS High Sierra 10.13.2, tvOS 11.2, watchOS 4.2, iTunes 12.7.2 for Windows, macOS High Sierra 10.13.4.
nvd
CVE-2013-0968P4MEDIUMCVSS 6.8≤ 6.0.2v6.0+1 more2013-01-29
CVE-2013-0968 [MEDIUM] CWE-119 CVE-2013-0968: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
nvd
CVE-2011-2788P4MEDIUMCVSS 6.8fixed in 5.02011-08-03
CVE-2011-2788 [MEDIUM] CWE-120 CVE-2011-2788: Buffer overflow in the inspector serialization functionality in Google Chrome before 13.0.782.107 al
Buffer overflow in the inspector serialization functionality in Google Chrome before 13.0.782.107 allows user-assisted remote attackers to have an unspecified impact via unknown vectors.
nvd
CVE-2015-3800P4HIGHCVSS 7.2≤ 8.42015-08-17
CVE-2015-3800 [HIGH] CWE-119 CVE-2015-3800: The DiskImages component in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gai
The DiskImages component in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via a malformed DMG image.
nvd