Product:

Iphone_os

(Apple)
Repositories • https://github.com/madler/zlib
• https://github.com/file/file
• https://github.com/WebKit/webkit
• https://github.com/vadz/libtiff
#Vulnerabilities 3370
Date Id Summary Products Score Patch Annotated
2015-01-30 CVE-2014-4493 The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obtain control of the local app container by leveraging access to an enterprise distribution certificate for signing a crafted app. Iphone_os N/A
2015-01-30 CVE-2014-4492 libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type. Iphone_os, Mac_os_x, Tvos N/A
2015-01-30 CVE-2014-4491 The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence of addresses within an OSBundleMachOHeaders key in a response, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app. Iphone_os, Mac_os_x, Tvos N/A
2015-01-30 CVE-2014-4489 IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app. Iphone_os, Mac_os_x, Tvos N/A
2015-01-30 CVE-2014-4488 IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app. Iphone_os, Mac_os_x, Tvos N/A
2015-01-30 CVE-2014-4487 Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context via a crafted app. Iphone_os, Mac_os_x, Tvos N/A
2015-01-30 CVE-2014-4486 IOAcceleratorFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly handle resource lists and IOService userclient types, which allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted app. Iphone_os, Mac_os_x, Tvos N/A
2015-01-30 CVE-2014-4485 Buffer overflow in the XML parser in Foundation in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XML document. Iphone_os, Mac_os_x, Tvos N/A
2015-01-30 CVE-2014-4484 FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .dfont file. Iphone_os, Mac_os_x, Tvos N/A
2015-01-30 CVE-2014-4483 Buffer overflow in FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font file in a PDF document. Iphone_os, Mac_os_x, Tvos N/A