Product:

Iphone_os

(Apple)
Repositories • https://github.com/madler/zlib
• https://github.com/file/file
• https://github.com/WebKit/webkit
• https://github.com/vadz/libtiff
#Vulnerabilities 3370
Date Id Summary Products Score Patch Annotated
2014-11-18 CVE-2014-4457 The Sandbox Profiles subsystem in Apple iOS before 8.1.1 does not properly implement the debugserver sandbox, which allows attackers to bypass intended binary-execution restrictions via a crafted application that is run during a time period when debugging is not enabled. Iphone_os N/A
2014-11-18 CVE-2014-4455 dyld in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly handle overlapping segments in Mach-O executable files, which allows local users to bypass intended code-signing restrictions via a crafted file. Iphone_os, Tvos N/A
2014-11-18 CVE-2014-4453 Apple iOS before 8.1.1 and OS X before 10.10.1 include location data during establishment of a Spotlight Suggestions server connection by Spotlight or Safari, which might allow remote attackers to obtain sensitive information via unspecified vectors. Iphone_os, Mac_os_x N/A
2014-11-18 CVE-2014-4451 Apple iOS before 8.1.1 does not properly enforce the failed-passcode limit, which makes it easier for physically proximate attackers to bypass the lock-screen protection mechanism via a series of guesses. Iphone_os N/A
2014-10-22 CVE-2014-4450 The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields with an off autocomplete attribute, which makes it easier for attackers to discover credentials by reading credential values within unintended DOM input elements. Iphone_os N/A
2014-10-22 CVE-2014-4449 iCloud Data Access in Apple iOS before 8.1 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Iphone_os N/A
2014-10-22 CVE-2014-4448 House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID. Iphone_os N/A
2014-09-18 CVE-2014-4423 The Accounts subsystem in Apple iOS before 8 allows attackers to bypass a sandbox protection mechanism and obtain an active iCloud account's Apple ID and metadata via a crafted application. Iphone_os N/A
2014-09-18 CVE-2014-4422 The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot process, which allows attackers to bypass certain kernel-hardening protection mechanisms by using a user-space process to observe data related to the random numbers. Iphone_os, Tvos 8.1
2014-09-18 CVE-2014-4421 The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize memory, which allows attackers to obtain sensitive memory-content and memory-layout information via a crafted application, a different vulnerability than CVE-2014-4371, CVE-2014-4419, and CVE-2014-4420. Iphone_os, Mac_os_x, Tvos N/A