ByteOS

Product

tvOS

Versions

Affected

From unspecified before 16.6 (custom)

Vendor

Product

iOS and iPadOS

Versions

Affected

From unspecified before 16.6 (custom)

Vendor

Product

macOS

Versions

Affected

From unspecified before 13.5 (custom)

Vendor

Product

watchOS

Versions

Affected

From unspecified before 9.6 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Processing web content may lead to arbitrary code execution

Type: N/A

CWE ID: N/A

Description: Processing web content may lead to arbitrary code execution

References

Hyperlink	Resource
https://support.apple.com/en-us/HT213846	N/A
https://support.apple.com/en-us/HT213841	N/A
https://support.apple.com/en-us/HT213843	N/A
https://support.apple.com/en-us/HT213848	N/A
http://www.openwall.com/lists/oss-security/2023/08/02/1	N/A
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/	N/A
https://www.debian.org/security/2023/dsa-5468	N/A
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/	N/A
https://security.gentoo.org/glsa/202401-04	N/A

Hyperlink: https://support.apple.com/en-us/HT213846

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213841

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213843

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213848

Resource: N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2023/08/02/1

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/

Resource: N/A

Hyperlink: https://www.debian.org/security/2023/dsa-5468

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/

Resource: N/A

Hyperlink: https://security.gentoo.org/glsa/202401-04

Resource: N/A

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://support.apple.com/en-us/HT213846	x_transferred
https://support.apple.com/en-us/HT213841	x_transferred
https://support.apple.com/en-us/HT213843	x_transferred
https://support.apple.com/en-us/HT213848	x_transferred
http://www.openwall.com/lists/oss-security/2023/08/02/1	x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/	x_transferred
https://www.debian.org/security/2023/dsa-5468	x_transferred
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/	x_transferred
https://security.gentoo.org/glsa/202401-04	x_transferred

Hyperlink: https://support.apple.com/en-us/HT213846

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213841

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213843

Resource:

x_transferred

Hyperlink: https://support.apple.com/en-us/HT213848

Resource:

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2023/08/02/1

Resource:

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/

Resource:

x_transferred

Hyperlink: https://www.debian.org/security/2023/dsa-5468

Resource:

x_transferred

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/

Resource:

x_transferred

Hyperlink: https://security.gentoo.org/glsa/202401-04

Resource:

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:28 Jul, 2023 | 05:15

Updated At:05 Jan, 2024 | 14:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CPE Matches

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>ipados>>Versions from 16.0(inclusive) to 16.6(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions from 16.0(inclusive) to 16.6(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>Versions from 13.0(inclusive) to 13.5(exclusive)

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

>>tvos>>Versions before 16.6(exclusive)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

>>watchos>>Versions before 9.6(exclusive)

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.openwall.com/lists/oss-security/2023/08/02/1	product-security@apple.com	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/	product-security@apple.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/	product-security@apple.com	N/A
https://security.gentoo.org/glsa/202401-04	product-security@apple.com	N/A
https://support.apple.com/en-us/HT213841	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT213843	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT213846	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT213848	product-security@apple.com	Vendor Advisory
https://www.debian.org/security/2023/dsa-5468	product-security@apple.com	N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2023/08/02/1

Source: product-security@apple.com

Resource:

Third Party Advisory

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://security.gentoo.org/glsa/202401-04

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/HT213841

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213843

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213846

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT213848

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://www.debian.org/security/2023/dsa-5468

Source: product-security@apple.com

Resource: N/A

Similar CVEs

750Records found

CVE-2017-2991

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-1.39% / 80.08%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 codec (related to decompression). Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2998

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-2.29% / 84.44%

7 Day CHG~0.00%

Published-14 Mar, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timeline interactions. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.221 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3003

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-1.30% / 79.49%

7 Day CHG~0.00%

Published-14 Mar, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability related to an interaction between the privacy user interface and the ActionScript 2 Camera object. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.221 and earlier.

CWE ID-CWE-416

Use After Free

CVE-2017-2994

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-2.86% / 86.01%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-416

Use After Free

CVE-2017-2982

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-1.91% / 83.01%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in a routine related to player shutdown. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-416

Use After Free

CVE-2017-3069

Matching Score-8

Matching Score-8

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-2.02% / 83.49%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BlendMode class. Successful exploitation could lead to arbitrary code execution.

Product-enterprise_linux_desktop chrome_os enterprise_linux_workstation linux_kernel flash_player_desktop_runtime windows_8.1 windows enterprise_linux windows_10 flash_player mac_os_x Adobe Flash Player 25.0.0.148 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2936

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-2.65% / 85.51%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-416

Use After Free

CVE-2017-3073

Matching Score-8

Matching Score-8

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-1.81% / 82.57%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.

CWE ID-CWE-416

Use After Free

CVE-2017-2937

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-2.03% / 83.52%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class, when using class inheritance. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-416

Use After Free

CVE-2020-16022

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-0.18% / 39.22%

7 Day CHG~0.00%

Published-08 Jan, 2021 | 17:51

Updated-04 Aug, 2024 | 13:37

Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page.

Vendor-Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-fuchsia linux_kernel chrome android chrome_os windows macos Chrome

CVE-2017-2985

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-52.42% / 97.87%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-416

Use After Free

CVE-2017-2997

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-5.53% / 90.08%

7 Day CHG~0.00%

Published-14 Mar, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable buffer overflow / underflow vulnerability in the Primetime TVSDK that supports customizing ad information. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.221 and earlier.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-2934

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-69.09% / 98.60%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Texture Format files. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2926

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-1.65% / 81.73%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-25071

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.3||MEDIUM

EPSS-0.73% / 72.23%

7 Day CHG~0.00%

Published-25 Jun, 2022 | 06:10

Updated-30 May, 2025 | 16:45

Apple iOS Siri Self privileges management

A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been disclosed to the public. The existence and implications of this vulnerability are doubted by Apple even though multiple public videos demonstrating the attack exist. Upgrading to version 13.0 migt be able to address this issue. It is recommended to upgrade affected devices. NOTE: Apple claims, that after examining the report they do not see any actual security implications.

Vendor-Apple Inc.

Product-iphone_os iOS

CWE ID-CWE-269

Improper Privilege Management

CVE-2017-2990

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-2.26% / 84.35%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 decompression routine. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2931

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-67.94% / 98.55%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3099

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-1.17% / 78.37%

7 Day CHG~0.00%

Published-14 Jul, 2017 | 05:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 26.0.0.131 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2933

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-69.09% / 98.60%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3074

Matching Score-8

Matching Score-8

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-2.02% / 83.49%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Graphics class. Successful exploitation could lead to arbitrary code execution.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2984

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-8.51% / 92.20%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the h264 decoder routine. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2986

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-38.11% / 97.13%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2999

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-2.29% / 84.44%

7 Day CHG~0.00%

Published-14 Mar, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.221 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2988

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-60.86% / 98.26%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2928

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-3.25% / 86.90%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2927

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-5.84% / 90.37%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing Adobe Texture Format files. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-2930

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-81.97% / 99.18%

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-mac_os_x chrome_os linux_kernel windows_8.1 windows_10 flash_player windows Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3070

Matching Score-8

Matching Score-8

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

CVSS Score-8.8||HIGH

EPSS-2.02% / 83.49%

7 Day CHG~0.00%

Published-09 May, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the ConvolutionFilter class. Successful exploitation could lead to arbitrary code execution.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-5217

Matching Score-8

Assigner-Chrome

Vendor-webmproject Debian GNU/Linux Google LLC Microsoft Corporation Apple Inc.Mozilla Corporation Red Hat, Inc.Fedora Project

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-3.52% / 87.42%

7 Day CHG~0.00%

Published-28 Sep, 2023 | 15:23

Updated-24 Oct, 2025 | 14:07

Known KEV||Action Due Date - 2023-10-23||Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Product-libvpx enterprise_linux iphone_os debian_linux edge_chromium fedora ipados firefox edge thunderbird chrome libvpx Chrome Chromium libvpx

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-38590

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.62% / 81.58%

7 Day CHG~0.00%

Published-28 Jul, 2023 | 04:30

Updated-13 Feb, 2025 | 17:01

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados macos iOS and iPadOS macOS tvOS watchOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2023-37450

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.02% / 5.74%

7 Day CHG-0.03%

Published-26 Jul, 2023 | 23:21

Updated-23 Oct, 2025 | 18:48

Known KEV||Action Due Date - 2023-08-03||Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor-webkitgtk Apple Inc.

Product-tvos watchos ipados webkitgtk\+macos safari iphone_os Safari iOS and iPadOS tvOS watchOS macOS Multiple Products

CVE-2020-12427

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.15% / 34.90%

7 Day CHG~0.00%

Published-13 May, 2020 | 14:28

Updated-04 Aug, 2024 | 11:56

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space.

Vendor-n/a Apple Inc.Western Digital Corp.Microsoft Corporation

Product-windows wd_discovery macos n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2008-2934

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-8.8||HIGH

EPSS-5.58% / 90.12%

7 Day CHG~0.00%

Published-18 Jul, 2008 | 16:00

Updated-07 Aug, 2024 | 09:21

Mozilla Firefox 3 before 3.0.1 on Mac OS X allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file that triggers a free of an uninitialized pointer.

Vendor-n/a Canonical Ltd.Mozilla Corporation Apple Inc.

Product-firefox ubuntu_linux mac_os_x n/a

CWE ID-CWE-908

Use of Uninitialized Resource

CVE-2023-32393

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.24% / 46.56%

7 Day CHG~0.00%

Published-27 Jul, 2023 | 00:30

Updated-13 Feb, 2025 | 16:50

The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. Processing web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados macos iOS and iPadOS macOS tvOS watchOS

CVE-2023-32439

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.99% / 76.53%

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-23 Oct, 2025 | 18:47

Known KEV||Action Due Date - 2023-07-14||Apply updates per vendor instructions.

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor-webkitgtk Apple Inc.

Product-ipados webkitgtk\+macos safari iphone_os Safari iOS and iPadOS macOS Multiple Products

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2023-32435

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.41% / 61.22%

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-23 Oct, 2025 | 18:48

Known KEV||Action Due Date - 2023-07-14||Apply updates per vendor instructions.

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

Vendor-Apple Inc.

Product-ipados safari iphone_os macos Safari macOS iOS and iPadOS Multiple Products

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-32358

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.12% / 30.61%

7 Day CHG~0.00%

Published-14 Aug, 2023 | 22:40

Updated-09 Oct, 2024 | 14:08

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os macos ipados macOS iOS and iPadOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2023-3079

Matching Score-8

Assigner-Chrome

Vendor-Debian GNU/Linux Couchbase, Inc.Google LLC Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Fedora Project

Matching Score-8

Assigner-Chrome

CVSS Score-8.8||HIGH

EPSS-1.56% / 81.19%

7 Day CHG~0.00%

Published-05 Jun, 2023 | 21:40

Updated-24 Oct, 2025 | 14:07

Known KEV||Action Due Date - 2023-06-28||Apply updates per vendor instructions.

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Product-couchbase_server debian_linux windows fedora linux_kernel macos chrome Chrome Chromium V8

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-7879

Matching Score-8

Matching Score-8

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

CVSS Score-8.8||HIGH

EPSS-3.79% / 87.85%

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

CWE ID-CWE-416

Use After Free

CVE-2023-28205

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.11% / 29.81%

7 Day CHG+0.04%

Published-10 Apr, 2023 | 00:00

Updated-23 Oct, 2025 | 17:50

Known KEV||Action Due Date - 2023-05-01||Apply updates per vendor instructions.

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor-Apple Inc.

Product-ipados safari iphone_os macos Safari iOS and iPadOS macOS Multiple Products

CWE ID-CWE-416

Use After Free

CVE-2023-28198

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.06% / 17.13%

7 Day CHG~0.00%

Published-14 Aug, 2023 | 22:40

Updated-13 Feb, 2025 | 16:48

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution.

Vendor-webkitgtk wpewebkit Apple Inc.

Product-iphone_os ipados webkitgtk macos wpe_webkit iOS and iPadOS macOS

CWE ID-CWE-416

Use After Free

CVE-2008-3637

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-12.48% / 93.77%

7 Day CHG~0.00%

Published-26 Sep, 2008 | 16:00

Updated-07 Aug, 2024 | 09:45

The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variable, which allows remote attackers to execute arbitrary code via a crafted applet, related to an "error checking issue."

Vendor-n/a Apple Inc.

Product-mac_os_x_server mac_os_x n/a

CWE ID-CWE-665

Improper Initialization

CVE-2016-4764

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.96% / 76.13%

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 10 is affected. Safari before 10 is affected. iTunes before 12.5.1 is affected. tvOS before 10 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Vendor-n/a Apple Inc.

Product-iphone_os itunes tvos safari n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8689

Matching Score-8

Assigner-Apple Inc.

Product-enterprise_linux_server itunes iphone_os watchos tvos safari enterprise_linux_workstation mac_os_x enterprise_linux_desktop icloud iCloud for Windows (Microsoft Store)iTunes for Windows watchOS Safari macOS iCloud for Windows iOS tvOS

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-33.86% / 96.86%

7 Day CHG-1.56%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Red Hat, Inc.Apple Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8503

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.86% / 74.76%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:17

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS tvOS

CWE ID-CWE-20

Improper Input Validation

CVE-2023-23517

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.18% / 38.92%

7 Day CHG~0.00%

Published-27 Feb, 2023 | 00:00

Updated-11 Mar, 2025 | 16:15

The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-tvos macos iphone_os safari ipados watchos Safari watchOS macOS tvOS iOS and iPadOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8722

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.60% / 69.08%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-20

Improper Input Validation

CVE-2019-8175

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-3.97% / 88.16%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:16

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8622

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-27.09% / 96.27%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari mac_os_x icloud iTunes for Windows watchOS Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-8766

Matching Score-8

Assigner-Apple Inc.