About the security content of iOS 9 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2013-3951n/a: Improper Input Validation
• CVE-2014-8611n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-8146n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-8147n/a: security vulnerability
• CVE-2015-5876dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2015-5921WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecified vectors
• CVE-2015-5912The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hosts via crafted responses
• CVE-2015-5916The Apple Pay component in Apple iOS before 9 allows remote terminals to obtain sensitive recent-transaction information during payments by leveraging the transaction-log feature
• CVE-2015-5899libpthread in the kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors
• CVE-2015-5903n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5862The Audio component in Apple iOS before 9 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted audio file
• CVE-2015-5860n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5874CoreText in Apple iOS before 9 and iTunes before 12.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file
• CVE-2015-5922Unspecified vulnerability in International Components for Unicode (ICU) before 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2, has unknown impact and attack vectors
• CVE-2015-5861SpringBoard in Apple iOS before 9 allows physically proximate attackers to bypass a lock-screen preview-disabled setting, and reply to an audio message, via unspecified vectors
• CVE-2015-5905Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site
• CVE-2015-5885The CFNetwork Cookies component in Apple iOS before 9 allows remote attackers to track users via vectors involving a cookie for a top-level domain
• CVE-2015-5904Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted web site
• CVE-2015-5882n/a: Improper Access Control
• CVE-2015-5879n/a: Improper Input Validation
• CVE-2015-5896n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5907n/a: security vulnerability
• CVE-2015-5898n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5906n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5880CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app
• CVE-2015-5867IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2015-5892n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5869n/a: Improper Input Validation
• CVE-2015-5841n/a: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• CVE-2015-5857Mail in Apple iOS before 9 allows remote attackers to use an address-book contact as a spoofed e-mail sender address via unspecified vectors
• CVE-2015-5863n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5851n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5840The checkint division routines in removefile in Apple iOS before 9 allow attackers to cause a denial of service (overflow fault and app crash) via crafted data
• CVE-2015-5850AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup
• CVE-2015-5859n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5858The CFNetwork HTTPProtocol component in Apple iOS before 9 allows remote attackers to bypass the HSTS protection mechanism, and consequently obtain sensitive information, via a crafted URL
• CVE-2015-5846n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5868n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5839dyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an app that places a crafted signature in an executable file
• CVE-2015-5856The Application Store component in Apple iOS before 9 allows remote attackers to cause a denial of service to an enterprise-signed app via a crafted ITMS URL
• CVE-2015-5855Apple iOS before 9 allows attackers to discover the e-mail address of a player via a crafted Game Center app
• CVE-2015-5848IOAcceleratorFamily in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors
• CVE-2015-5847The Disk Images component in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors
• CVE-2015-5843IOMobileFrameBuffer in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors
• CVE-2015-5845n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5835Apple iOS before 9 allows attackers to obtain sensitive information about inter-app communication via a crafted app that conducts an interception attack involving an unspecified URL scheme
• CVE-2015-5844n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5842n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5834IOAcceleratorFamily in Apple iOS before 9 allows attackers to obtain sensitive kernel memory-layout information via a crafted app
• CVE-2015-5837PluginKit in Apple iOS before 9 allows attackers to bypass an intended app-trust requirement and install arbitrary extensions via a crafted enterprise app

Source and provenance

Original title: About the security content of iOS 9 - Apple Support. Captured 17 Oct 2026, 20:01 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.