CVE-2010-1177 | ByteOS Network

Vulnerability Details :

CVE-2010-1177

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-29 Mar, 2010 | 19:00

Updated At-16 Sep, 2024 | 19:56

Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:29 Mar, 2010 | 19:00

Updated At:16 Sep, 2024 | 19:56

▼CVE Numbering Authority (CNA)

Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://nishantdaspatnaik.yolasite.com/ipodpoc2.php	x_refsource_MISC
http://www.securityfocus.com/bid/38994	vdb-entry x_refsource_BID

Hyperlink: http://nishantdaspatnaik.yolasite.com/ipodpoc2.php

Resource:

x_refsource_MISC

Hyperlink: http://www.securityfocus.com/bid/38994

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://nishantdaspatnaik.yolasite.com/ipodpoc2.php	x_refsource_MISC x_transferred
http://www.securityfocus.com/bid/38994	vdb-entry x_refsource_BID x_transferred

Hyperlink: http://nishantdaspatnaik.yolasite.com/ipodpoc2.php

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://www.securityfocus.com/bid/38994

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

Source:cve@mitre.org

Published At:29 Mar, 2010 | 19:30

Updated At:29 Apr, 2026 | 01:13

Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

>>iphone_os>>3.1.3

cpe:2.3:o:apple:iphone_os:3.1.3:*:*:*:*:*:*:*

>>iphone_os>>3.1.3

cpe:2.3:o:apple:iphone_os:3.1.3:-:ipodtouch:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-94	Primary	nvd@nist.gov

CWE ID: CWE-94

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://nishantdaspatnaik.yolasite.com/ipodpoc2.php	cve@mitre.org	Exploit
http://www.securityfocus.com/bid/38994	cve@mitre.org	Exploit
http://nishantdaspatnaik.yolasite.com/ipodpoc2.php	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://www.securityfocus.com/bid/38994	af854a3a-2127-422b-91ae-364da2661108	Exploit

Hyperlink: http://nishantdaspatnaik.yolasite.com/ipodpoc2.php

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: http://www.securityfocus.com/bid/38994

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: http://nishantdaspatnaik.yolasite.com/ipodpoc2.php

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Hyperlink: http://www.securityfocus.com/bid/38994

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Similar CVEs

2479Records found

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-39.32% / 97.32%

||

7 Day CHG~0.00%

Published-06 Apr, 2020 | 20:03

Updated-04 Aug, 2024 | 11:35

An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, allows a man-in-the-middle attacker to perform OS command injection attacks (against a client) via shell metacharacters to the doCustomRemediateInstructions method, because Runtime.getRuntime().exec() is used.

Vendor-n/a Apple Inc.Oracle Corporation Pulse Secure Linux Kernel Organization, Inc

Product-solaris linux_kernel pulse_connect_secure pulse_policy_secure macos n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.50% / 66.00%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 36.50%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "Disk Images" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os watchos mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.25% / 48.32%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "IOHIDFamily" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os watchos mac_os_x n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.50% / 87.69%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 36.50%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os watchos mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-8.08% / 92.19%

||

7 Day CHG~0.00%

Published-08 Nov, 2016 | 17:45

Updated-06 May, 2026 | 22:30

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation Adobe Inc.

Product-windows_10 flash_player_for_linux mac_os_x windows_8.1 enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows flash_player windows_server_2016 linux_kernel windows_rt_8.1 chrome_os windows_server_2012 Adobe Flash Player 23.0.0.205 and earlier, 11.2.202.643 and earlier

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-3.63% / 87.91%

||

7 Day CHG~0.00%

Published-24 May, 2013 | 10:00

Updated-29 Apr, 2026 | 01:13

Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-quicktime windows_7 windows_vista windows_xp iphone_os n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.50% / 87.69%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, and CVE-2016-6990.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-8.08% / 92.19%

||

7 Day CHG~0.00%

Published-08 Nov, 2016 | 17:45

Updated-06 May, 2026 | 22:30

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation Adobe Inc.

Product-windows_10 flash_player_for_linux mac_os_x windows_8.1 enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows flash_player windows_server_2016 linux_kernel windows_rt_8.1 chrome_os windows_server_2012 Adobe Flash Player 23.0.0.205 and earlier, 11.2.202.643 and earlier

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.50% / 87.69%

||

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4273, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 37.82%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-1.42% / 80.72%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (type confusion) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-704

Incorrect Type Conversion or Cast

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.15% / 34.58%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages object-lifetime mishandling during process spawning.

Vendor-n/a Apple Inc.

Product-iphone_os watchos mac_os_x safari n/a

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.31% / 87.34%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, and CVE-2016-6924.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.31% / 87.34%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, and CVE-2016-6922.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 windows_8.1 mac_os_x windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.87% / 86.37%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, and CVE-2016-6931.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.87% / 86.37%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6931, and CVE-2016-6932.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-2.87% / 86.37%

||

7 Day CHG~0.00%

Published-14 Sep, 2016 | 18:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, and CVE-2016-6932.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel flash_player_desktop_runtime chrome_os n/a

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.15% / 34.88%

||

7 Day CHG~0.00%

Published-22 Jul, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Login Window in Apple OS X before 10.11.6 allows attackers to gain privileges via a crafted app that leverages a "type confusion."

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.36%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.22% / 44.84%

||

7 Day CHG~0.00%

Published-18 Aug, 2016 | 19:00

Updated-06 May, 2026 | 22:30

IOMobileFrameBuffer in Apple iOS before 9.3.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.19% / 40.44%

||

7 Day CHG~0.00%

Published-22 Jul, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context, obtain sensitive user information, or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 43.76%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-476

NULL Pointer Dereference

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.39%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x n/a

CWE ID-CWE-476

NULL Pointer Dereference

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 43.76%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.55% / 67.92%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 mishandle signed disk images, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-tvos iphone_os mac_os_x watchos n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.33% / 80.09%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4729.

Vendor-n/a Apple Inc.

Product-iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 43.76%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.25% / 47.94%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

S2 Camera in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.83% / 83.03%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735.

Vendor-n/a Apple Inc.

Product-tvos iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.33% / 80.09%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4731.

Vendor-n/a Apple Inc.

Product-iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-2.04% / 83.95%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

WebKit in Apple iOS before 10, Safari before 10, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

Vendor-n/a Apple Inc.

Product-tvos iphone_os safari watchos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.38% / 59.16%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "Thunderbolt" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-476

NULL Pointer Dereference

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-66.74% / 98.56%

||

7 Day CHG~0.00%

Published-25 Aug, 2016 | 21:00

Updated-21 Apr, 2026 | 16:22

Known KEV||Action Due Date - 2022-06-14||Apply updates per vendor instructions.

The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os n/a iOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.51% / 66.51%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-tvos iphone_os mac_os_x watchos n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-4.94% / 89.70%

||

7 Day CHG~0.00%

Published-24 May, 2013 | 10:00

Updated-29 Apr, 2026 | 01:13

Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG data in a movie file.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_vista quicktime windows_7 windows_xp n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 46.26%

||

7 Day CHG~0.00%

Published-02 Apr, 2021 | 17:26

Updated-04 Aug, 2024 | 10:50

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos mac_os_x macOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.36%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4700.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 43.76%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Apple HSSPI Support in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 37.82%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "AppleGraphicsControl" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.36%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4699.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-1.01% / 77.23%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) via a crafted PDF file.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.22% / 44.07%

||

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "libxpc" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os tvos watchos mac_os_x n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.91% / 75.89%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4734, and CVE-2016-4735.

Vendor-n/a Apple Inc.

Product-tvos iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.83% / 83.03%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4734.

Vendor-n/a Apple Inc.

Product-tvos iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.3||HIGH

EPSS-0.19% / 40.76%

||

7 Day CHG~0.00%

Published-22 Jul, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a "type confusion."

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.6||CRITICAL

EPSS-8.40% / 92.37%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4735.

Vendor-n/a Apple Inc.

Product-tvos iphone_os safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.25% / 47.81%

||

7 Day CHG~0.00%

Published-08 Dec, 2020 | 20:01

Updated-04 Aug, 2024 | 10:50

A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.0, iOS 14.0 and iPadOS 14.0. An application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-iphone_os tvos mac_os_x ipados tvOS iOS and iPadOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.51% / 66.55%

||

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-06 May, 2026 | 22:30

The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (invalid pointer dereference) via a crafted app.

Vendor-n/a Apple Inc.

Product-tvos iphone_os mac_os_x watchos n/a

CWE ID-CWE-476

NULL Pointer Dereference