U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:o:apple:iphone_os:4.3.2:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 2,659 matching records.
Displaying matches 2,601 through 2,620.
Vuln ID Summary CVSS Severity
CVE-2011-3427

The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.

Published: October 14, 2011; 6:55:10 AM -0400
V3.x:(not available)
V2.0: 2.6 LOW
CVE-2011-3426

Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header.

Published: October 14, 2011; 6:55:10 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2011-3261

Double free vulnerability in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Excel spreadsheet.

Published: October 14, 2011; 6:55:10 AM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2011-3260

Buffer overflow in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word document.

Published: October 14, 2011; 6:55:10 AM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2011-3259

The kernel in Apple iOS before 5 and Apple TV before 4.4 does not properly recover memory allocated for incomplete TCP connections, which allows remote attackers to cause a denial of service (resource consumption) by making many connection attempts.

Published: October 14, 2011; 6:55:10 AM -0400
V3.x:(not available)
V2.0: 5.0 MEDIUM
CVE-2011-3257

The Data Access component in Apple iOS before 5 does not properly handle the existence of multiple user accounts on the same mail server, which allows local users to bypass intended access restrictions in opportunistic circumstances by leveraging a different account's cookie.

Published: October 14, 2011; 6:55:10 AM -0400
V3.x:(not available)
V2.0: 2.1 LOW
CVE-2011-3256

FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226.

Published: October 14, 2011; 6:55:10 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2011-3255

CFNetwork in Apple iOS before 5 stores AppleID credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application.

Published: October 14, 2011; 6:55:09 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2011-3254

Cross-site scripting (XSS) vulnerability in Calendar in Apple iOS before 5 allows remote attackers to inject arbitrary web script or HTML via an invitation note.

Published: October 14, 2011; 6:55:09 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2011-3253

CalDAV in Apple iOS before 5 does not validate X.509 certificates for SSL sessions, which allows man-in-the-middle attackers to spoof calendar servers and obtain sensitive information via an arbitrary certificate.

Published: October 14, 2011; 6:55:09 AM -0400
V3.x:(not available)
V2.0: 2.6 LOW
CVE-2011-3246

CFNetwork in Apple iOS before 5.0.1 and Mac OS X 10.7 before 10.7.2 does not properly parse URLs, which allows remote attackers to trigger visits to unintended web sites, and transmission of cookies to unintended web sites, via a crafted (1) http or (2) https URL.

Published: October 14, 2011; 6:55:09 AM -0400
V3.x:(not available)
V2.0: 5.0 MEDIUM
CVE-2011-3245

The Keyboards component in Apple iOS before 5 displays the final character of an entered password during a subsequent use of a keyboard, which allows physically proximate attackers to obtain sensitive information by reading this character.

Published: October 14, 2011; 6:55:09 AM -0400
V3.x:(not available)
V2.0: 2.1 LOW
CVE-2011-3243

Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows.

Published: October 14, 2011; 6:55:09 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2011-2877

Google Chrome before 14.0.835.202 does not properly handle SVG text, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale font."

Published: October 04, 2011; 4:55:01 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2011-3234

Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

Published: September 19, 2011; 8:02:56 AM -0400
V3.x:(not available)
V2.0: 5.0 MEDIUM
CVE-2011-2860

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to table styles.

Published: September 19, 2011; 8:02:56 AM -0400
V3.x:(not available)
V2.0: 7.5 HIGH
CVE-2011-2857

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the focus controller.

Published: September 19, 2011; 8:02:56 AM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2011-2855

Google Chrome before 14.0.835.163 does not properly handle Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."

Published: September 19, 2011; 8:02:56 AM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2011-2854

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "ruby / table style handing."

Published: September 19, 2011; 8:02:56 AM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2011-2847

Use-after-free vulnerability in the document loader in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.

Published: September 19, 2011; 8:02:55 AM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM