Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · July 2011 — Apple Security Advisories
34 advisories 34 CVEs 2 EXPLOITED

Apple-vendor CVEs for 2011-07. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 2 are already weaponised in the wild — see the Exploited section.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2011-0226

iOSExploitedVulnCheck KEV listedHIGH2011-07-05

Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory c...

CVEs:CVE-2011-0226

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2011-0227

iOSExploitedVulnCheck KEV listedHIGH2011-07-05

The queueing primitives in IOMobileFrameBuffer in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 do not properly perform type conversion, which allows local users to gain privileges via a crafted application.

CVEs:CVE-2011-0227

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2011-1774

SafariActive exploitation (sightings)CRITICAL2011-07-21

WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted web site. NOTE: this may overlap CVE-2011-1425.

CVEs:CVE-2011-1774

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0228

iOSPoC exploitHIGH2011-07-26

The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA...

CVEs:CVE-2011-0228

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2011-0216

SafariPoC exploitHIGH2011-07-21

Off-by-one error in libxml in Apple Safari before 5.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted web site.

CVEs:CVE-2011-0216

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2011-0215

SafariPoC exploitHIGH2011-07-21

ImageIO in Apple Safari before 5.0.6 on Windows does not properly address re-entrancy issues, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF file.

CVEs:CVE-2011-0215

Affected products

ProductStatusVendorPackageEcosystem
imageio affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-0234

SafariPoC exploitHIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0234

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0223

SafariPoC exploitHIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0223

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0237

SafariPoC exploitHIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0237

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0240

SafariPoC exploitHIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0240

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0253

SafariPoC exploitHIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0253

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2010-1383

SafariPoC exploitHIGH2011-07-21

CFNetwork in Apple Safari before 5.0.6 on Windows allows remote web servers to execute arbitrary code by replaying the NTLM credentials of a client user, related to a "credential reflection" issue.

CVEs:CVE-2010-1383

Affected products

ProductStatusVendorPackageEcosystem
cfnetwork affected apple — —
safari affected apple — —
Upstream advisory

CVE-2010-1420

SafariPoC exploitCRITICAL2011-07-21

Cross-site scripting (XSS) vulnerability in CFNetwork in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted text/plain file.

CVEs:CVE-2010-1420

Affected products

ProductStatusVendorPackageEcosystem
cfnetwork affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-0219

SafariPoC exploitMEDIUM2011-07-21

Apple Safari before 5.0.6 allows remote attackers to bypass the Same Origin Policy, and modify the rendering of text from arbitrary web sites, via a Java applet that loads fonts.

CVEs:CVE-2011-0219

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0244

SafariPoC exploitHIGH2011-07-21

WebKit in Apple Safari before 5.0.6 allows user-assisted remote attackers to read arbitrary files via vectors related to improper canonicalization of URLs within RSS feeds.

CVEs:CVE-2011-0244

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0217

SafariPoC exploitMEDIUM2011-07-21

Apple Safari before 5.0.6 provides AutoFill information to scripts that execute before HTML form submission, which allows remote attackers to obtain Address Book information via a crafted form, as demonstrated by a form that includes non-visible fields.

CVEs:CVE-2011-0217

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2011-0214

SafariPoC exploitMEDIUM2011-07-21

CFNetwork in Apple Safari before 5.0.6 on Windows does not properly handle an untrusted attribute of a system root certificate, which allows remote web servers to bypass intended SSL restrictions via a certificate signed by a blacklisted certification ...

CVEs:CVE-2011-0214

Affected products

ProductStatusVendorPackageEcosystem
cfnetwork affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-0222

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0222

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0241

SafariEPSS <= 49%HIGH2011-07-21

Heap-based buffer overflow in ImageIO in Apple Safari before 5.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with CCITT Group 4 encoding.

CVEs:CVE-2011-0241

Affected products

ProductStatusVendorPackageEcosystem
imageio affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-1797

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-1797

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0218

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0218

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0221

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0221

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0225

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0225

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0232

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0232

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0233

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0233

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0235

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0235

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0238

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0238

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0254

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0254

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0255

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-0255

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-1288

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-1288

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-1453

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-1453

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-1457

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-1457

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-1462

SafariEPSS <= 49%HIGH2011-07-21

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in AP...

CVEs:CVE-2011-1462

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

CVE-2011-0242

SafariEPSS <= 49%CRITICAL2011-07-21

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors involving a URL that contains a username.

CVEs:CVE-2011-0242

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
webkit affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console