Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · September 2012 — Apple Security Advisories
86 advisories 86 CVEs

Apple-vendor CVEs for 2012-09. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2012-3716

macOSPoC exploitCRITICAL2012-09-20

CoreText in Apple Mac OS X 10.7.x before 10.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write or read) via a crafted text glyph.

CVEs:CVE-2012-3716

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-3632

SafariEPSS <= 49%HIGH2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3632

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
Upstream advisory

CVE-2012-3606

SafariEPSS <= 49%HIGH2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3606

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
Upstream advisory

CVE-2012-3607

SafariEPSS <= 49%HIGH2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3607

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
Upstream advisory

CVE-2012-3621

SafariEPSS <= 49%HIGH2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3621

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
Upstream advisory

CVE-2012-3687

SafariEPSS <= 49%HIGH2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3687

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
Upstream advisory

CVE-2012-3701

SafariEPSS <= 49%HIGH2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3701

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
Upstream advisory

CVE-2012-3727

iOSEPSS <= 49%CRITICAL2012-09-20

Buffer overflow in the IPsec component in Apple iOS before 6 allows remote attackers to execute arbitrary code via a crafted racoon configuration file.

CVEs:CVE-2012-3727

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-0650

macOSEPSS <= 49%CRITICAL2012-09-20

Buffer overflow in the DirectoryService Proxy in DirectoryService in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

CVEs:CVE-2012-0650

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-3647

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3647

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3722

macOSEPSS <= 49%CRITICAL2012-09-20

The Sorenson codec in QuickTime in Apple Mac OS X before 10.7.5, and in CoreMedia in iOS before 6, accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a c...

CVEs:CVE-2012-3722

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-3660

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3660

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3673

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3673

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3601

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3601

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3602

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3602

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3612

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3612

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3613

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3613

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3614

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3614

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3648

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3648

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3672

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3672

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3677

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3677

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3684

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3684

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3708

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3708

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3710

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3710

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3658

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3658

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3659

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3659

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3598

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3598

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3651

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3651

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3652

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3652

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3703

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3703

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3622

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3622

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3623

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3623

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3643

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3643

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3649

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3649

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3657

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3657

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3675

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3675

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3685

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3685

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3692

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3692

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3699

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3699

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3700

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3700

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3705

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3705

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3707

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3707

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3709

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3709

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3711

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3711

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3712

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3712

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3616

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3616

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3654

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3654

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3688

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3688

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3702

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3702

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3745

iOSEPSS <= 49%CRITICAL2012-09-20

Off-by-one error in Telephony in Apple iOS before 6 allows remote attackers to cause a denial of service (buffer overflow and connectivity outage) via a crafted user-data header in an SMS message.

CVEs:CVE-2012-3745

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3617

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3617

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3624

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3624

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3676

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3676

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3704

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3704

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3706

SafariEPSS <= 49%CRITICAL2012-09-13

WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APP...

CVEs:CVE-2012-3706

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2012-3747

iOSEPSS <= 49%CRITICAL2012-09-20

WebKit, as used in Apple iOS before 6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

CVEs:CVE-2012-3747

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3726

iOSEPSS <= 49%CRITICAL2012-09-20

Double free vulnerability in ImageIO in Apple iOS before 6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image.

CVEs:CVE-2012-3726

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3743

iOSEPSS <= 49%HIGH2012-09-20

The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files.

CVEs:CVE-2012-3743

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3742

iOSEPSS <= 49%MEDIUM2012-09-20

Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock indicator, which allows remote attackers to spoof https connections by placing this character in the TITLE element of a...

CVEs:CVE-2012-3742

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3744

iOSEPSS <= 49%MEDIUM2012-09-20

Telephony in Apple iOS before 6 uses an SMS message's return address as the displayed sender address, which allows remote attackers to spoof text communication via a message in which the return address does not match the originating address.

CVEs:CVE-2012-3744

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3719

macOSEPSS <= 49%CRITICAL2012-09-20

Mail in Apple Mac OS X before 10.7.5 does not properly handle embedded web plugins, which allows remote attackers to execute arbitrary plugin code via an e-mail message that triggers the loading of a third-party plugin.

CVEs:CVE-2012-3719

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-3713

SafariEPSS <= 49%HIGH2012-09-20

Apple Safari before 6.0.1 does not properly handle the Quarantine attribute of HTML documents, which allows user-assisted remote attackers to read arbitrary files by leveraging the presence of a downloaded document.

CVEs:CVE-2012-3713

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2012-3715

SafariEPSS <= 49%HIGH2012-09-20

Apple Safari before 6.0.1 makes http requests for https URIs in certain circumstances involving a paste into the address bar, which allows user-assisted remote attackers to obtain sensitive information by sniffing the network.

CVEs:CVE-2012-3715

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2012-3730

iOSEPSS <= 49%MEDIUM2012-09-20

Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments via a header value that was also used in a previous e-mail message, as demonstrated by a message from a different ...

CVEs:CVE-2012-3730

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3721

macOSEPSS <= 49%MEDIUM2012-09-20

Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface, which allows attackers to enumerate managed devices via unspecified vectors.

CVEs:CVE-2012-3721

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2012-3720

macOSEPSS <= 49%MEDIUM2012-09-20

Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external accounts are not enabled, which might allow remote attackers to determine passwords via unspecified access to a mob...

CVEs:CVE-2012-3720

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2012-3732

iOSEPSS <= 49%MEDIUM2012-09-20

Mail in Apple iOS before 6 uses an S/MIME message's From address as the displayed sender address, which allows remote attackers to spoof signed content via an e-mail message in which the From field does not match the signer's identity.

CVEs:CVE-2012-3732

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-2889

OtherEPSS <= 49%CRITICAL2012-09-26

Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS (UXSS)."

CVEs:CVE-2012-2889

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3724

iOSEPSS <= 49%HIGH2012-09-20

CFNetwork in Apple iOS before 6 does not properly identify the host portion of a URL, which allows remote attackers to obtain sensitive information by leveraging the construction of an HTTP request with an incorrect hostname derived from a malformed URL.

CVEs:CVE-2012-3724

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3733

iOSEPSS <= 49%HIGH2012-09-20

Messages in Apple iOS before 6, when multiple iMessage e-mail addresses are configured, does not ensure that a reply's sender address matches the recipient address of the original message, which allows remote attackers to obtain potentially sensitive i...

CVEs:CVE-2012-3733

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3746

iOSEPSS <= 49%MEDIUM2012-09-20

UIWebView in UIKit in Apple iOS before 6 does not properly use the Data Protection feature, which allows context-dependent attackers to obtain cleartext file content by leveraging direct access to a device's filesystem.

CVEs:CVE-2012-3746

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3714

SafariEPSS <= 49%MEDIUM2012-09-20

The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill popover, which allows remote attackers to obtain the Me card from an Address Book via a crafted web site.

CVEs:CVE-2012-3714

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2012-3725

iOSEPSS <= 49%HIGH2012-09-20

The DNAv4 protocol implementation in the DHCP component in Apple iOS before 6 sends Wi-Fi packets containing a MAC address of a host on a previously used network, which might allow remote attackers to obtain sensitive information about previous device ...

CVEs:CVE-2012-3725

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3723

macOSEPSS <= 49%CRITICAL2012-09-20

Apple Mac OS X before 10.7.5 does not properly handle the bNbrPorts field of a USB hub descriptor, which allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) by attaching a US...

CVEs:CVE-2012-3723

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-3741

iOSEPSS <= 49%LOW2012-09-20

The Restrictions (aka Parental Controls) implementation in Apple iOS before 6 does not properly handle purchase attempts after a Disable Restrictions action, which allows local users to bypass an intended Apple ID authentication step via an app that pe...

CVEs:CVE-2012-3741

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3728

iOSEPSS <= 49%MEDIUM2012-09-20

The kernel in Apple iOS before 6 dereferences invalid pointers during the handling of packet-filter data structures, which allows local users to gain privileges via a crafted program that makes packet-filter ioctl calls.

CVEs:CVE-2012-3728

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3735

iOSEPSS <= 49%LOW2012-09-20

The Passcode Lock implementation in Apple iOS before 6 does not properly interact with the "Slide to Power Off" feature, which allows physically proximate attackers to see the most recently used third-party app by watching the device's screen.

CVEs:CVE-2012-3735

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3731

iOSEPSS <= 49%LOW2012-09-20

Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attachments, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors.

CVEs:CVE-2012-3731

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3737

iOSEPSS <= 49%LOW2012-09-20

The Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing, which allows physically proximate attackers to view arbitrary stored photos by spoofing a time value.

CVEs:CVE-2012-3737

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3738

iOSEPSS <= 49%LOW2012-09-20

The Emergency Dialer screen in the Passcode Lock implementation in Apple iOS before 6 does not properly limit the dialing methods, which allows physically proximate attackers to bypass intended access restrictions and make FaceTime calls through Voice ...

CVEs:CVE-2012-3738

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3739

iOSEPSS <= 49%LOW2012-09-20

The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via vectors involving use of the camera.

CVEs:CVE-2012-3739

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3740

iOSEPSS <= 49%LOW2012-09-20

The Passcode Lock implementation in Apple iOS before 6 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors.

CVEs:CVE-2012-3740

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3718

macOSEPSS <= 49%HIGH2012-09-20

Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 allows local users to read passwords entered into Login Window (aka LoginWindow) or Screen Saver Unlock by installing an input method that intercepts keystrokes.

CVEs:CVE-2012-3718

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-3736

iOSEPSS <= 49%MEDIUM2012-09-20

The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via vectors related to ending a FaceTime call.

CVEs:CVE-2012-3736

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3729

iOSEPSS <= 49%MEDIUM2012-09-20

The Berkeley Packet Filter (BPF) interpreter implementation in the kernel in Apple iOS before 6 accesses uninitialized memory locations, which allows local users to obtain sensitive information about the layout of kernel memory via a crafted program th...

CVEs:CVE-2012-3729

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-3734

iOSEPSS <= 49%LOW2012-09-20

Office Viewer in Apple iOS before 6 writes cleartext document data to a temporary file, which might allow local users to bypass a document's intended (1) Data Protection level or (2) encryption state by reading the temporary content.

CVEs:CVE-2012-3734

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console