Product:

Iphone_os

(Apple)
Repositories • https://github.com/madler/zlib
• https://github.com/file/file
• https://github.com/WebKit/webkit
• https://github.com/vadz/libtiff
#Vulnerabilities 3637
Date Id Summary Products Score Patch Annotated
2011-10-14 CVE-2011-3254 Cross-site scripting (XSS) vulnerability in Calendar in Apple iOS before 5 allows remote attackers to inject arbitrary web script or HTML via an invitation note. Iphone_os N/A
2011-10-14 CVE-2011-3253 CalDAV in Apple iOS before 5 does not validate X.509 certificates for SSL sessions, which allows man-in-the-middle attackers to spoof calendar servers and obtain sensitive information via an arbitrary certificate. Iphone_os N/A
2011-10-14 CVE-2011-3246 CFNetwork in Apple iOS before 5.0.1 and Mac OS X 10.7 before 10.7.2 does not properly parse URLs, which allows remote attackers to trigger visits to unintended web sites, and transmission of cookies to unintended web sites, via a crafted (1) http or (2) https URL. Iphone_os, Mac_os_x, Mac_os_x_server N/A
2011-10-14 CVE-2011-3245 The Keyboards component in Apple iOS before 5 displays the final character of an entered password during a subsequent use of a keyboard, which allows physically proximate attackers to obtain sensitive information by reading this character. Iphone_os N/A
2011-10-14 CVE-2011-3243 Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows. Iphone_os, Safari N/A
2012-05-15 CVE-2011-3102 Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors. Iphone_os, Chrome N/A
2012-03-30 CVE-2011-3058 Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. Iphone_os, Chrome N/A
2013-09-19 CVE-2011-2391 The IPv6 implementation in the kernel in Apple iOS before 7 allows remote attackers to cause a denial of service (CPU consumption) via crafted ICMPv6 packets. Iphone_os, Itunes, Mac_os_x N/A
2011-03-11 CVE-2011-1418 The stateless address autoconfiguration (aka SLAAC) functionality in the IPv6 networking implementation in Apple iOS before 4.3 and Apple TV before 4.2 places the MAC address into the IPv6 address, which makes it easier for remote IPv6 servers to track users by logging source IPv6 addresses. Apple_tv, Iphone_os, Tvos N/A
2011-03-11 CVE-2011-1417 Integer overflow in QuickLook, as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a Microsoft Office document with a crafted size field in the OfficeArtMetafileHeader, related to OfficeArtBlip, as demonstrated on the iPhone by Charlie Miller and Dion Blazakis during a Pwn2Own competition at CanSecWest 2011. Iphone_os, Mac_os_x, Mac_os_x_server N/A