Product:

Iphone_os

(Apple)
Repositories • https://github.com/madler/zlib
• https://github.com/file/file
• https://github.com/WebKit/webkit
• https://github.com/vadz/libtiff
#Vulnerabilities 3370
Date Id Summary Products Score Patch Annotated
2015-10-23 CVE-2015-7006 Directory traversal vulnerability in the BOM (aka Bill of Materials) component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code via a crafted CPIO archive. Iphone_os, Mac_os_x, Watchos N/A
2015-10-23 CVE-2015-7005 WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1. Iphone_os N/A
2015-10-23 CVE-2015-7004 The kernel in Apple iOS before 9.1 allows attackers to cause a denial of service via a crafted app. Iphone_os N/A
2015-10-23 CVE-2015-7002 WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5. Iphone_os, Itunes, Safari N/A
2015-12-11 CVE-2015-7001 AppSandbox in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 mishandles hard links, which allows attackers to bypass Contacts access revocation via a crafted app. Iphone_os, Mac_os_x, Tvos, Watchos N/A
2015-10-23 CVE-2015-7000 Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, which allows physically proximate attackers to obtain sensitive information by looking for a (1) Phone or (2) Messages notification on the lock screen soon after a setting was disabled. Iphone_os N/A
2015-10-23 CVE-2015-6999 The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certificate. Iphone_os N/A
2015-10-23 CVE-2015-6997 The X.509 certificate-trust implementation in Apple iOS before 9.1 does not recognize that the kSecRevocationRequirePositiveResponse flag implies a revocation-checking requirement, which makes it easier for man-in-the-middle attackers to spoof endpoints by leveraging access to a revoked certificate. Iphone_os, Watchos N/A
2015-10-23 CVE-2015-6996 IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app. Iphone_os, Mac_os_x, Watchos N/A
2015-10-23 CVE-2015-6995 The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app. Iphone_os, Mac_os_x N/A