Apple Ipod Touch vulnerabilities

18 CVEs affecting Apple Ipod Touch, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2009-2206, published 2009-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-1698, published 2009-06-10. High severity, CVSS 9.3. EPSS: 8.5% chance of exploitation in the next 30 days. WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr…
CVE-2009-1701, published 2009-06-10. High severity, CVSS 9.3. EPSS: 7.7% chance of exploitation in the next 30 days. Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote…
CVE-2008-3950, published 2008-09-16. Medium severity, CVSS 5.0. EPSS: 7.1% chance of exploitation in the next 30 days. Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to…
CVE-2009-0961, published 2009-06-19. Medium severity, CVSS 5.0. EPSS: 6.4% chance of exploitation in the next 30 days. The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog when another alert appears, which might allow remote…
CVE-2009-1724, published 2009-07-09. Medium severity, CVSS 4.3. EPSS: 6.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers…
CVE-2009-1725, published 2009-07-09. High severity, CVSS 9.3. EPSS: 6.2% chance of exploitation in the next 30 days. WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly…
CVE-2008-3632, published 2008-09-11. High severity, CVSS 9.3. EPSS: 6% chance of exploitation in the next 30 days. Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone 1.0 through 2.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (application…
CVE-2009-2206, published 2009-09-10. Medium severity, CVSS 6.8. EPSS: 4.6% chance of exploitation in the next 30 days. Multiple heap-based buffer overflows in the AudioCodecs library in the CoreAudio component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, allow remote attackers to execute…
CVE-2009-1692, published 2009-06-19. High severity, CVSS 7.1. EPSS: 4.2% chance of exploitation in the next 30 days. WebKit before r41741, as used in Apple iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Safari, and other software, allows remote attackers to cause a denial of service…
CVE-2009-1683, published 2009-06-19. High severity, CVSS 7.8. EPSS: 2.8% chance of exploitation in the next 30 days. The Telephony component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted ICMP echo…

Latest

CVE-2009-1680, published 2009-06-19. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Safari in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly clear the search history when it is cleared from the Settings application, which allows…
CVE-2009-1679, published 2009-06-19. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration profile, can replace the password policy from Exchange…
CVE-2009-0960, published 2009-06-19. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not provide an option to disable remote image loading in HTML email, which allows remote…
CVE-2009-0959, published 2009-06-19. High severity, CVSS 7.1. EPSS: 2.5% chance of exploitation in the next 30 days. The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4…