Vulnerabilities > Apple

DATE CVE VULNERABILITY TITLE RISK
2016-06-09 CVE-2016-4447 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.
network
low complexity
hp canonical debian oracle apple xmlsoft mcafee CWE-119
7.5
2016-05-26 CVE-2016-0718 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
9.8
2016-05-20 CVE-2016-4073 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted mb_strcut call.
network
low complexity
php apple CWE-119
critical
9.8
2016-05-20 CVE-2016-4072 Improper Input Validation vulnerability in multiple products
The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c.
network
low complexity
php apple CWE-20
critical
9.8
2016-05-20 CVE-2016-4071 Improper Input Validation vulnerability in multiple products
Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.
network
low complexity
php apple CWE-20
critical
9.8
2016-05-20 CVE-2016-1859 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
network
low complexity
apple webkitgtk CWE-119
8.8
2016-05-20 CVE-2016-1858 Information Exposure vulnerability in multiple products
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, improperly tracks taint attributes, which allows remote attackers to obtain sensitive information via a crafted web site.
network
low complexity
apple webkitgtk CWE-200
6.5
2016-05-20 CVE-2016-1857 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856.
network
low complexity
apple webkitgtk CWE-119
8.8
2016-05-20 CVE-2016-1856 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857.
network
low complexity
apple webkitgtk CWE-119
8.8
2016-05-20 CVE-2016-1855 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Iphone OS
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1856, and CVE-2016-1857.
network
low complexity
apple CWE-119
8.8