Apple Safari vulnerabilities

1,654 known vulnerabilities affecting apple/safari.

Total CVEs

1,654

CISA KEV

actively exploited

Public exploits

168

Exploited in wild

Severity breakdown

CRITICAL211HIGH626MEDIUM796LOW20UNKNOWN1

Vulnerabilities

SortPage 33 of 83

CVE-2010-1414P3CRITICALCVSS 9.3≤ 4.0.5v4.0+5 more2010-06-11

CVE-2010-1414 [CRITICAL] CWE-399 CVE-2010-1414: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the removeChild DOM method.

nvd

CVE-2010-1412P3CRITICALCVSS 9.3≤ 4.0.5v4.0+5 more2010-06-11

CVE-2010-1412 [CRITICAL] CWE-399 CVE-2010-1412: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to hover events.

nvd

CVE-2018-4210P3HIGHCVSS 8.8fixed in 11.12019-01-11

CVE-2018-4210 [HIGH] CWE-129 CVE-2018-4210: In iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 f In iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, an array indexing issue existed in the handling of a function in javascript core. This issue was addressed with improved checks.

nvdapple

CVE-2009-1711P3CRITICALCVSS 9.3≤ 4.0_betav0.8+24 more2009-06-10

CVE-2009-1711 [CRITICAL] CWE-399 CVE-2009-1711: WebKit in Apple Safari before 4.0 does not properly initialize memory for Attr DOM objects, which al WebKit in Apple Safari before 4.0 does not properly initialize memory for Attr DOM objects, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.

nvd

CVE-2010-1417P3CRITICALCVSS 9.3≤ 4.0.5v4.0+5 more2010-06-11

CVE-2010-1417 [CRITICAL] CWE-119 CVE-2010-1417: The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10. The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via HTML content that contains multiple :after pseudo-selectors.

nvd

CVE-2007-3944P3CRITICALCVSS 9.3v3.02007-07-23

CVE-2007-3944 [CRITICAL] CWE-119 CVE-2007-3944: Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in th Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSaf

nvd

CVE-2009-1725P3CRITICALCVSS 9.3≤ 4.0.1v2.0+25 more2009-07-09

CVE-2009-1725 [CRITICAL] CWE-189 CVE-2009-1725: WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPo WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (me

nvd

CVE-2018-4376P3HIGHCVSS 8.8fixed in 12.0.12019-04-03

CVE-2018-4376 [HIGH] CWE-119 CVE-2018-4376: Multiple memory corruption issues were addressed with improved memory handling. This issue affected Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.

nvdapple

CVE-2018-4375P3HIGHCVSS 8.8fixed in 12.0.12019-04-03

CVE-2018-4375 [HIGH] CWE-119 CVE-2018-4375: Multiple memory corruption issues were addressed with improved memory handling. This issue affected Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.

nvdapple

CVE-2010-1791P3CRITICALCVSS 9.3≤ 5.0v4.0+7 more2010-07-30

CVE-2010-1791 [CRITICAL] CWE-189 CVE-2010-1791: Integer signedness error in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Wi Integer signedness error in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving a JavaScript array index.

nvd

CVE-2010-1788P3CRITICALCVSS 9.3≤ 5.0v4.0+7 more2010-07-30

CVE-2010-1788 [CRITICAL] CWE-119 CVE-2010-1788: WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on M WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a use element in an SVG document.

nvd

CVE-2010-3116P3CRITICALCVSS 10.0fixed in 4.1.3≥ 5.0, < 5.0.32010-08-24

CVE-2010-3116 [CRITICAL] CWE-416 CVE-2010-3116: Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x be Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to improper handling of MIME types by plug-ins.

nvd

CVE-2022-22637P3HIGHCVSS 8.8fixed in 15.4≥ unspecified, < 15.42022-09-23

CVE-2022-22637 [HIGH] CWE-346 CVE-2022-22637: A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12 A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. A malicious website may cause unexpected cross-origin behavior.

nvdapple

CVE-2018-4269P3HIGHCVSS 8.6fixed in 11.1.22019-04-03

CVE-2018-4269 [HIGH] CWE-119 CVE-2018-4269: A memory corruption issue was addressed with improved input validation. This issue affected versions A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, watchOS 4.3.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.

nvd

CVE-2011-0215P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-0215 [CRITICAL] CWE-20 CVE-2011-0215: ImageIO in Apple Safari before 5.0.6 on Windows does not properly address re-entrancy issues, which ImageIO in Apple Safari before 5.0.6 on Windows does not properly address re-entrancy issues, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF file.

nvd

CVE-2010-3817P3CRITICALCVSS 9.3≤ 5.0.2v5.0+51 more2010-11-22

CVE-2010-3817 [CRITICAL] CVE-2010-3817: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on M WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of Cascading Style Sheets (CSS) 3D transforms, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted w

nvd

CVE-2010-3809P3CRITICALCVSS 9.3≤ 5.0.2v5.0+51 more2010-11-22

CVE-2010-3809 [CRITICAL] CWE-94 CVE-2010-3809: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on M WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of inline styling, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.

nvd

CVE-2010-3819P3CRITICALCVSS 9.3≤ 5.0.2v5.0+51 more2010-11-22

CVE-2010-3819 [CRITICAL] CWE-94 CVE-2010-3819: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on M WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly perform a cast of an unspecified variable during processing of Cascading Style Sheets (CSS) boxes, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted we

nvd

CVE-2010-3821P3CRITICALCVSS 9.3≤ 5.0.2v5.0+51 more2010-11-22

CVE-2010-3821 [CRITICAL] CWE-119 CVE-2010-3821: WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on M WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly handle the :first-letter pseudo-element in a Cascading Style Sheets (CSS) token sequence, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) vi

nvd

CVE-2020-9862P3HIGHCVSS 7.8fixed in 13.1.2≥ unspecified, < Safari 13.1.22020-10-16

CVE-2020-9862 [HIGH] CWE-77 CVE-2020-9862: A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection.

nvdapple

← Previous33 / 83Next →