About the security content of iOS 9.3 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2016-1762The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document
• CVE-2015-8659The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug
• CVE-2015-8242n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-8035n/a: security vulnerability
• CVE-2015-7942n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-7500n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-7499n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5312n/a: security vulnerability
• CVE-2015-1819The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack
• CVE-2016-1950n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1788n/a: security vulnerability
• CVE-2016-1864n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1780n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1785n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1784n/a: Uncontrolled Resource Consumption
• CVE-2016-1756n/a: security vulnerability
• CVE-2016-1751n/a: security vulnerability
• CVE-2016-1779WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request
• CVE-2016-1778WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
• CVE-2016-1786n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1761n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1754n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1783n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1781WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors
• CVE-2016-1766The Profiles component in Apple iOS before 9.3 does not properly validate certificates, which allows attackers to spoof an MDM profile trust relationship via unspecified vectors
• CVE-2016-1775n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1752The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to cause a denial of service via a crafted app
• CVE-2016-1782n/a: Improper Access Control
• CVE-2016-1753n/a: Integer Overflow or Wraparound
• CVE-2016-1757Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app
• CVE-2016-1758The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app
• CVE-2016-1750n/a: Use After Free
• CVE-2016-1763n/a: Improper Input Validation
• CVE-2016-1760The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an arbitrary app's events via a crafted app
• CVE-2016-1748IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app
• CVE-2016-1755n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1740n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1734n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-0802n/a: Improper Input Validation
• CVE-2016-0801n/a: Improper Input Validation

Source and provenance

Original title: About the security content of iOS 9.3 - Apple Support. Captured 17 Oct 2026, 14:11 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.