Apple iOS vulnerabilities

CVE-2016-4747 [LOW] CWE-200 CVE-2016-4747: Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle att Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors.

CVE-2014-1353 [LOW] CWE-264 CVE-2014-1353: Lock Screen in Apple iOS before 7.1.2 does not properly manage the telephony state in Airplane Mode, Lock Screen in Apple iOS before 7.1.2 does not properly manage the telephony state in Airplane Mode, which allows physically proximate attackers to bypass the lock protection mechanism, and access a certain foreground application, via unspecified vectors.

CVE-2012-3750 [LOW] CWE-264 CVE-2012-3750: The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors.

CVE-2008-4228 [LOW] CWE-264 CVE-2008-4228: The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 throug The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allows physically proximate attackers to leverage the emergency-call ability of locked devices to make a phone call to an arbitrary number.

CVE-2015-3778 [LOW] CWE-200 CVE-2015-3778: bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentiall bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentially sensitive information about MAC addresses seen in previous Wi-Fi sessions by sniffing an 802.11 network for DNAv4 broadcast traffic.

CVE-2013-5138 [MEDIUM] CVE-2013-5138: IOCatalogue in IOKitUser in Apple iOS before 7 allows attackers to cause a denial of service (NULL p IOCatalogue in IOKitUser in Apple iOS before 7 allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted application.

CVE-2008-0034 [MEDIUM] CVE-2008-0034: Unspecified vulnerability in Passcode Lock in Apple iPhone 1.0 through 1.1.2 allows users with physi Unspecified vulnerability in Passcode Lock in Apple iPhone 1.0 through 1.1.2 allows users with physical access to execute applications without entering the passcode via vectors related to emergency calls.

CVE-2010-1775 [LOW] CWE-362 CVE-2010-1775: Race condition in Passcode Lock in Apple iOS before 4 on the iPhone and iPod touch allows physically Race condition in Passcode Lock in Apple iOS before 4 on the iPhone and iPod touch allows physically proximate attackers to bypass intended passcode requirements, and pair a locked device with a computer and access arbitrary data, via vectors involving the initial boot.

CVE-2014-1351 [LOW] CWE-264 CVE-2014-1351: Siri in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended lock-scre Siri in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended lock-screen passcode requirement, and read a contact list, via a Siri request that refers to a contact ambiguously.

CVE-2014-4372 [LOW] CWE-59 CVE-2014-4372: syslogd in the syslog subsystem in Apple iOS before 8 and Apple TV before 7 allows local users to ch syslogd in the syslog subsystem in Apple iOS before 8 and Apple TV before 7 allows local users to change the permissions of arbitrary files via a symlink attack on an unspecified file.

CVE-2012-0645 [LOW] CWE-264 CVE-2012-0645: Siri in Apple iOS before 5.1 does not properly restrict the ability of Mail.app to handle voice comm Siri in Apple iOS before 5.1 does not properly restrict the ability of Mail.app to handle voice commands, which allows physically proximate attackers to bypass the locked state via a command that forwards an active e-mail message to an arbitrary recipient.

CVE-2014-4407 [LOW] CWE-200 CVE-2014-4407: IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to obtain sensitive memory-content information via an application that makes crafted IOKit function calls.

CVE-2016-1748 [LOW] CWE-200 CVE-2016-1748: IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 al IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.

CVE-2023-23543 [LOW] CVE-2023-23543: The issue was addressed with additional restrictions on the observability of app states. This issue The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. A sandboxed app may be able to determine which app is currently using the camera.

CVE-2020-3894 [LOW] CWE-362 CVE-2020-3894: A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadO A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.

CVE-2024-23257 [LOW] CWE-119 CVE-2024-23257: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.6 and iPadOS The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, visionOS 1.1. Processing an image may result in disclosure of process memory.

CVE-2016-4670 [LOW] CWE-255 CVE-2016-4670: An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "Security" component. It allows local users to discover lengths of arbitrary passwords by reading a log.

CVE-2024-40778 [LOW] CWE-287 CVE-2024-40778: An authentication issue was addressed with improved state management. This issue is fixed in iOS 16. An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Photos in the Hidden Photos Album may be viewed without authentication.

CVE-2025-43531 [LOW] CWE-362 CVE-2025-43531: A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-20671 [LOW] CWE-77 CVE-2026-20671: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7. A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker in a privileged network position may be able to intercept network traffic.