Apple tvOS vulnerabilities

2,227 known vulnerabilities affecting apple/tvos.

Total CVEs

2,227

CISA KEV

actively exploited

Public exploits

199

Exploited in wild

Severity breakdown

CRITICAL148HIGH1222MEDIUM795LOW59UNKNOWN3

Vulnerabilities

Page 111 of 112

CVE-2014-1267MEDIUMCVSS 5.8≤ 6.0.2v6.0+1 more2014-03-14

CVE-2014-1267 [MEDIUM] CWE-20 CVE-2014-1267: The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not proper The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed.

nvd

CVE-2014-1282MEDIUMCVSS 5.8≤ 6.0.2v6.0+1 more2014-03-14

CVE-2014-1282 [MEDIUM] CWE-264 CVE-2014-1282: The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass in The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name.

nvd

CVE-2014-1289MEDIUMCVSS 6.8≤ 6.0.2v6.0+1 more2014-03-14

CVE-2014-1289 [MEDIUM] CWE-119 CVE-2014-1289: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, and CVE-2014-1294.

nvd

CVE-2014-1293MEDIUMCVSS 6.8≤ 6.0.2v6.0+1 more2014-03-14

CVE-2014-1293 [MEDIUM] CVE-2014-1293: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294.

nvd

CVE-2014-1279LOWCVSS 2.1≤ 6.0.2v6.0+1 more2014-03-14

CVE-2014-1279 [LOW] CWE-264 CVE-2014-1279: Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive Apple TV before 6.1 does not properly restrict logging, which allows local users to obtain sensitive information by reading log data.

nvd

CVE-2014-1266HIGHCVSS 7.4≥ 6.0, < 6.0.22014-02-22

CVE-2014-1266 [HIGH] CWE-295 CVE-2014-1266: The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-m

nvd

CVE-2013-0340MEDIUMCVSS 6.8fixed in 15.02014-01-21

CVE-2013-0340 [MEDIUM] CWE-611 CVE-2013-0340: expat before version 2.4.0 does not properly handle entities expansion unless an application develop expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE

nvdapple

CVE-2013-5196MEDIUMCVSS 6.8≤ 6.0.22013-12-18

CVE-2013-5196 [MEDIUM] CWE-119 CVE-2013-5196: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.

nvd

CVE-2013-5199MEDIUMCVSS 6.8≤ 6.0.22013-12-18

CVE-2013-5199 [MEDIUM] CWE-119 CVE-2013-5199: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.

nvd

CVE-2013-5198MEDIUMCVSS 6.8≤ 6.0.22013-12-18

CVE-2013-5198 [MEDIUM] CWE-119 CVE-2013-5198: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.

nvd

CVE-2013-5197MEDIUMCVSS 6.8≤ 6.0.22013-12-18

CVE-2013-5197 [MEDIUM] CWE-119 CVE-2013-5197: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.

nvd

CVE-2013-5228MEDIUMCVSS 6.8≤ 6.0.22013-12-18

CVE-2013-5228 [MEDIUM] CWE-119 CVE-2013-5228: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.

nvd

CVE-2013-5225MEDIUMCVSS 6.8≤ 6.0.22013-12-18

CVE-2013-5225 [MEDIUM] CWE-119 CVE-2013-5225: WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execut WebKit, as used in Apple Safari before 6.1.1 and 7.x before 7.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-12-16-1.

nvd

CVE-2013-0981HIGHCVSS 7.2≤ 5.2.0v1.0.0+27 more2013-03-20

CVE-2013-0981 [HIGH] CVE-2013-0981: The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and A The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe object pointers that originated in userspace, which allows local users to gain privileges via crafted code.

nvd

CVE-2013-0977MEDIUMCVSS 4.6≤ 5.2.0v1.0.0+27 more2013-03-20

CVE-2013-0977 [MEDIUM] CVE-2013-0977: dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, which allows local users to bypass intended code-signing requirements via a file that contains overlapping segments.

nvd

CVE-2013-0978LOWCVSS 2.1≤ 5.2.0v1.0.0+27 more2013-03-20

CVE-2013-0978 [LOW] CWE-200 CVE-2013-0978: The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 doe The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.

nvd

CVE-2013-0964LOWCVSS 3.6≤ 5.1.1v1.0.0+26 more2013-01-29

CVE-2013-0964 [LOW] CWE-20 CVE-2013-0964: The kernel in Apple iOS before 6.1 and Apple TV before 5.2 does not properly validate copyin and cop The kernel in Apple iOS before 6.1 and Apple TV before 5.2 does not properly validate copyin and copyout arguments, which allows local users to bypass intended pointer restrictions and access locations in the first kernel-memory page by specifying a length of less than one page.

nvd

CVE-2011-0162HIGHCVSS 7.8≤ 3.0.2v1.0.0+5 more2011-03-11

CVE-2011-0162 [HIGH] CWE-20 CVE-2011-0162: Wi-Fi in Apple iOS before 4.3 and Apple TV before 4.2 does not properly perform bounds checking for Wi-Fi in Apple iOS before 4.3 and Apple TV before 4.2 does not properly perform bounds checking for Wi-Fi frames, which allows remote attackers to cause a denial of service (device reset) via unspecified traffic on the local wireless network.

nvd

CVE-2011-1418MEDIUMCVSS 5.0≤ 3.0.2v1.0.0+5 more2011-03-11

CVE-2011-1418 [MEDIUM] CWE-200 CVE-2011-1418: The stateless address autoconfiguration (aka SLAAC) functionality in the IPv6 networking implementat The stateless address autoconfiguration (aka SLAAC) functionality in the IPv6 networking implementation in Apple iOS before 4.3 and Apple TV before 4.2 places the MAC address into the IPv6 address, which makes it easier for remote IPv6 servers to track users by logging source IPv6 addresses.

nvd

CVE-2010-2807MEDIUMCVSS 6.8fixed in 4.1.02010-08-19

CVE-2010-2807 [MEDIUM] CWE-681 CVE-2010-2807: FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

nvd

← Previous111 / 112Next →