About Apple security updates
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.
For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.
Apple security documents reference vulnerabilities by CVE-ID when possible.
iOS 10.1
Released October 24, 2016
AppleMobileFileIntegrity
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: A signed executable may substitute code with the same team ID
Description: A validation issue existed in the handling of code signatures. This issue was addressed through additional validation.
CVE-2016-7584: Mark Mentovai and Boris Vidolov of Google Inc.
Entry added December 6, 2016
CFNetwork Proxies
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: A phishing issue existed in the handling of proxy credentials. This issue was addressed by removing unsolicited proxy password authentication prompts.
CVE-2016-7579: Jerry Decime
Contacts
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An application may be able to maintain access to the Address Book after access is revoked in Settings
Description: An access control issue in the Address Book was addressed through improved file-link validation.
CVE-2016-4686: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt)
CoreGraphics
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved memory handling.
CVE-2016-4673: Marco Grassi (@marcograss) of KeenLab (@keen_lab), Tencent
FaceTime
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An attacker in a privileged network position may be able to cause a relayed call to continue transmitting audio while appearing as if the call terminated
Description: User interface inconsistencies existed in the handling of relayed calls. These issues were addressed through improved protocol logic.
CVE-2016-7577: Martin Vigo (@martin_vigo) of salesforce.com
Entry added October 27, 2016
FontParser
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: Parsing a maliciously crafted font may disclose sensitive user information
Description: An out-of-bounds read was addressed through improved bounds checking.
CVE-2016-4660: Ke Liu of Tencent's Xuanwu Lab
FontParser
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking.
CVE-2016-4688: Simon Huang of Alipay company, thelongestusernameofall@gmail.com
Entry added November 27, 2016
IDS - Connectivity
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An attacker in a privileged network position may be able to trick a user on a multi-party call into believing they are talking to the other party
Description: An impersonation issue existed in the handling of call switching. This issue was addressed through improved handling of "switch caller" notifications.
CVE-2016-4721: Martin Vigo (@martin_vigo) of salesforce.com
Entry added October 27, 2016
iTunes Backup
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An attacker with access to an encrypted iTunes backup may be able to determine the backup password
Description: A password hashing weakness existed in the handling of encrypted iTunes backups. This issue was addressed by removing the weak hash.
CVE-2016-4685: Elcomsoft
Entry added November 14, 2016
Kernel
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel
Description: Multiple input validation issues existed in MIG generated code. These issues were addressed through improved validation.
CVE-2016-4669: Ian Beer of Google Project Zero
Entry updated November 2, 2016
Kernel
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An application may be able to disclose kernel memory
Description: A validation issue was addressed through improved input sanitization.
CVE-2016-4680: Max Bazaliy of Lookout and in7egral
Kernel
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: A local application may be able to execute arbitrary code with root privileges
Description: Multiple object lifetime issues existed when spawning new processes. These were addressed through improved validation.
CVE-2016-7613: Ian Beer of Google Project Zero
Entry added November 1, 2016
libarchive
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: A malicious archive may be able to overwrite arbitrary files
Description: An issue existed within the path validation logic for symlinks. This issue was addressed through improved path sanitization.
CVE-2016-4679: Omer Medan of enSilo Ltd
libxpc
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An application may be able to execute arbitrary code with root privileges
Description: A logic issue was addressed through additional restrictions.
CVE-2016-4675: Ian Beer of Google Project Zero
Safari
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: A malicious website may be able to cause a denial-of-service
Description: A denial of service issue was addressed through improved URL handling.
CVE-2016-7581: Sabri Haddouche (@pwnsdx)
Entry updated December 1, 2016
Sandbox Profiles
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An application may be able to retrieve metadata of photo directories
Description: An access issue was addressed through additional sandbox restrictions on third party applications.
CVE-2016-4664: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt)
Sandbox Profiles
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An application may be able to retrieve metadata of audio recording directories
Description: An access issue was addressed through additional sandbox restrictions on third party applications.
CVE-2016-4665: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt)
Security
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: A local attacker can observe the length of a login password when a user logs in
Description: A logging issue existed in the handling of passwords. This issue was addressed by removing password length logging.
CVE-2016-4670: Daniel Jalkut of Red Sweater Software
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-2016-4666: Apple
CVE-2016-4677: An anonymous researcher working with Trend Micro’s Zero Day Initiative
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed through improved memory handling.
CVE-2016-7578: Apple
Entry added October 27, 2016