About the security content of iOS 11 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2017-9050libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c
• CVE-2017-9049libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c
• CVE-2017-7376Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects
• CVE-2016-9840inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
• CVE-2016-9841inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
• CVE-2017-9233Affected product: Improper Restriction of XML External Entity Reference
• CVE-2016-9063An integer overflow during the parsing of XML using the Expat library
• CVE-2016-9842The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers
• CVE-2017-5130n/a Google Chrome prior to 62.0.3202.62: Integer Overflow or Wraparound
• CVE-2017-6211Qualcomm, Inc. Android for MSM, Firefox OS for MSM, QRD Android: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-9843The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation
• CVE-2017-1000373The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times
• CVE-2017-13877It allows attackers to determine whether arbitrary files exist via a crafted app
• CVE-2017-13829It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13863It allows man-in-the-middle attackers to track users by leveraging the transmission of client certificates
• CVE-2017-13854It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13806It does not enforce the configuration profile's settings for whether pairings are allowed
• CVE-2017-13833It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13822It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13815Versions before 5.31 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact
• CVE-2017-13821It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13830It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13814It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted image file
• CVE-2017-13831It allows remote attackers to obtain sensitive information or cause a denial of service via a crafted image
• CVE-2017-13825It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a crafted font file
• CVE-2017-13843It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13818It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13816It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file
• CVE-2017-13873It allows attackers to obtain sensitive network-activity information about arbitrary apps via a crafted app
• CVE-2017-13840It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13836It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13813It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file
• CVE-2017-13842It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13841It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13834It allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted mach binary
• CVE-2017-13832It allows attackers to have an unspecified impact by leveraging TLS 1.0 support
• CVE-2017-13828It allows remote attackers to spoof the user interface via crafted text
• CVE-2017-13817It allows local users to bypass intended memory-read restrictions
• CVE-2017-13812It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted archive file
• CVE-2017-11120n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2017-11121n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2017-11122On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 router advertisement offloading
• CVE-2017-11103n/a: Insufficient Verification of Data Authenticity
• CVE-2017-10989n/a: Out-of-bounds Read
• CVE-2017-7142It allows attackers to bypass the Safari Private Browsing protection mechanism, and consequently obtain sensitive information about visited web sites
• CVE-2017-7145An issue was discovered in certain Apple products
• CVE-2017-7144It allows remote attackers to track Safari Private Browsing users by leveraging cookie mishandling
• CVE-2017-7148It allows attackers to obtain sensitive location information via a crafted app that reads the location variable
• CVE-2017-7146It allows attackers to track users across installs via a crafted app that leverages Keychain data mishandling
• CVE-2017-7139It allows attackers to obtain sensitive information by leveraging a timing bug to read a secure-content screenshot that occurred during a locking action

Source and provenance

Original title: About the security content of iOS 11 - Apple Support. Captured 17 Oct 2026, 02:04 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.