About the security content of iOS 9.3.3 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2015-8317n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-7576In iOS before 9.3.3, a memory corruption issue existed in the kernel
• CVE-2016-6559The BSD libc library's link_ntoa() function may be vulnerable to a classic buffer overflow
• CVE-2016-4643In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a validation issue existed in the parsing of 407 responses
• CVE-2016-4653n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4651n/a: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CVE-2016-4642n/a: security vulnerability
• CVE-2016-4635n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-4644In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication credentials saved in Keychain
• CVE-2016-4637n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4632n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4626n/a: NULL Pointer Dereference
• CVE-2016-4628n/a: Out-of-bounds Read
• CVE-2016-4622n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4631n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4614n/a: Out-of-bounds Write
• CVE-2016-4607n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4623n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4624n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4605Calendar in Apple iOS before 9.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a crafted invitation
• CVE-2016-4627n/a: NULL Pointer Dereference
• CVE-2016-4594n/a: Improper Input Validation
• CVE-2016-4591n/a: Improper Access Control
• CVE-2016-4615n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4608n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4603n/a: security vulnerability
• CVE-2016-4610n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4582n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4583n/a: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• CVE-2016-4604Safari in Apple iOS before 9.3.3 allows remote attackers to spoof the displayed URL via an HTTP response specifying redirection to an invalid TCP port number
• CVE-2016-4616n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4584n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4590WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site
• CVE-2016-4609n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4592WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted web site
• CVE-2016-4587WebKit in Apple iOS before 9.3.3 and tvOS before 9.2.2 allows remote attackers to obtain sensitive information from uninitialized process memory via a crafted web site
• CVE-2016-4585n/a: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CVE-2016-4593The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors
• CVE-2016-4589n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4483n/a: Deserialization of Untrusted Data
• CVE-2016-4449n/a: Improper Input Validation
• CVE-2016-4447n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4448Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors
• CVE-2016-1836n/a: Use After Free
• CVE-2016-1863n/a: Use After Free
• CVE-2016-1865n/a: NULL Pointer Dereference
• CVE-2016-1683n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1684n/a: security vulnerability

Source and provenance

Original title: About the security content of iOS 9.3.3 - Apple Support. Captured 17 Oct 2026, 14:11 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.