Apple iPhone vulnerabilities

9 CVEs affecting Apple iPhone, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22592, published 2022-03-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-3950, published 2008-09-16. Medium severity, CVSS 5.0. EPSS: 7.1% chance of exploitation in the next 30 days. Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to…
CVE-2008-3632, published 2008-09-11. High severity, CVSS 9.3. EPSS: 6% chance of exploitation in the next 30 days. Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone 1.0 through 2.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (application…
CVE-2007-3753, published 2007-09-27. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to cause a denial of service (application termination) and execute arbitrary code via crafted Service Discovery…
CVE-2007-3755, published 2007-09-27. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user to make calls to arbitrary telephone numbers via a "tel:" link, which does not prompt the user before dialing…
CVE-2007-3754, published 2007-09-27. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote attackers to steal credentials and read email via a…
CVE-2022-22592, published 2022-03-18. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted…
CVE-2008-3876, published 2008-09-02. Low severity, CVSS 1.9. EPSS: 0.5% chance of exploitation in the next 30 days. Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensitive information or make arbitrary use of the device, via an…
CVE-2008-0034, published 2008-01-16. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. Unspecified vulnerability in Passcode Lock in Apple iPhone 1.0 through 1.1.2 allows users with physical access to execute applications without entering the passcode via vectors related to emergency…
CVE-2008-4593, published 2008-10-17. Low severity, CVSS 1.2. EPSS: 0.3% chance of exploitation in the next 30 days. Apple iPhone 2.1 with firmware 5F136, when Require Passcode is enabled and Show SMS Preview is disabled, allows physically proximate attackers to obtain sensitive information by performing an…