About the security content of watchOS 4 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2017-9050libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c
• CVE-2017-9049libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c
• CVE-2017-7376Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects
• CVE-2016-9840inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
• CVE-2016-9841inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
• CVE-2017-9233Affected product: Improper Restriction of XML External Entity Reference
• CVE-2016-9063An integer overflow during the parsing of XML using the Expat library
• CVE-2016-9842The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers
• CVE-2017-5130n/a Google Chrome prior to 62.0.3202.62: Integer Overflow or Wraparound
• CVE-2016-9843The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation
• CVE-2017-1000373The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times
• CVE-2017-13829It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13854It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13833It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13815Versions before 5.31 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact
• CVE-2017-13821It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13830It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13814It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted image file
• CVE-2017-13831It allows remote attackers to obtain sensitive information or cause a denial of service via a crafted image
• CVE-2017-13825It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a crafted font file
• CVE-2017-13843It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13818It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13816It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file
• CVE-2017-13873It allows attackers to obtain sensitive network-activity information about arbitrary apps via a crafted app
• CVE-2017-13840It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13836It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13813It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file
• CVE-2017-13842It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13841It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13834It allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted mach binary
• CVE-2017-13832It allows attackers to have an unspecified impact by leveraging TLS 1.0 support
• CVE-2017-13828It allows remote attackers to spoof the user interface via crafted text
• CVE-2017-13817It allows local users to bypass intended memory-read restrictions
• CVE-2017-13812It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted archive file
• CVE-2017-13782It allows attackers to bypass intended memory-read restrictions via a /dev/dtracehelper attack involving the dtrace_dif_variable and dtrace_getarg functions
• CVE-2017-10989n/a: Out-of-bounds Read
• CVE-2017-7128Versions before 3.19.3 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact
• CVE-2017-7080It allows remote attackers to bypass intended certificate-trust restrictions via a revoked X.509 certificate
• CVE-2017-7116It might allow remote attackers to read data from kernel memory locations via crafted Wi-Fi traffic
• CVE-2017-7127It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-7129Versions before 3.19.3 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact
• CVE-2017-7110It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic
• CVE-2017-7112It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic
• CVE-2017-7103It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic
• CVE-2017-7108It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic
• CVE-2017-7105It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via crafted Wi-Fi traffic
• CVE-2017-7114It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-7083It allows remote attackers to cause a denial of service
• CVE-2017-7130Versions before 3.19.3 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact
• CVE-2017-7086It allows remote attackers to cause a denial of service (resource consumption) via a crafted string that is mishandled by the glob function

Source and provenance

Original title: About the security content of watchOS 4 - Apple Support. Captured 17 Oct 2026, 02:04 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.