Apple iDevices running iOS 11.0 through 12.4 (excluding 12.3, 12.3.1 and iOS 13.0) are affected by a use-after-free vulnerability. Affected devices are not only capable of being jailbroken, but can also be exploited by attackers.

The version of Apple iOS running on the mobile device is prior to 12.3. It is, therefore, affected by multiple vulnerabilities as described in the HT210118 security advisory.

 - Multiple elevation of privilege vulnerabilities exist due to improper memory handling. An application can exploit this to gain elevated privileges. (CVE-2019-8593, CVE-2019-8605, CVE-2019-8574)

 -Multiple unspecified command execution vulnerabilities exist that allow an attacker to execute arbitrary commands, sometimes with kernel privileges. (CVE-2019-8585, CVE-2019-8613,CVE-2019-8600, CVE-2019-6237, CVE-2019-8571, CVE-2019-8583, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595, CVE-2019-8596, CVE-2019-8597, CVE-2019-8601, CVE-2019-8608, CVE-2019-8609, CVE-2019-8610, CVE-2019-8611, CVE-2019-8615, CVE-2019-8619, CVE-2019-8622, CVE-2019-8623, CVE-2019-8628)

 -An unspecified denial of service (DoS) vulnerability exists in the Kernel that allows an an attacker in a privileged position to perform a denial of service attack. (CVE-2019-8626)

The version of Apple iOS running on the mobile device is prior to 12.2. It is, therefore, affected by multiple vulnerabilities:

 - An unspecified memory corruption issue could allow an attacker to execute code with kernel privileges. (CVE-2019-8529)

 - An unspecified buffer overflow issues was addressed that could address an attacker to cause unexpected system termination or corrupt kernel memory. (CVE-2019-8527)

 - An unspecified memory corruption issue in an SMS Link could allow an attacker arbitrary execute code. (CVE-2019-8553)

The version of Apple iOS running on the mobile device is prior to 12.1.4. It is, therefore, affected by multiple vulnerabilities:

 - A logic issue in the handling of Group FaceTime calls could allow the initiator to cause the recipient to answer. (CVE-2019-6223)

 - An unspecified memory corruption issue in Foundation could lead to an application gaining elevated privileges. (CVE-2019-7286)

 - An unspecified memory corruption issue in IOKit could lead to an application executing arbitrary code with kernel privileges.
 (CVE-2019-7287)

 - An unspecified issue with Live Photos in FaceTime.
 (CVE-2019-7288)

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

 - Multiple unspecified vulnerabilities in WebKit can lead to arbitrary code execution if a user is enticed to visit a malicious web page. (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

 - A maliciously crafted SQL query could lead to arbitrary code execution. (CVE-2018-20346, CVE-2018-20505, CVE-2018-20506)

 - A malicious application could lead to arbitrary code execution with kernel privileges. (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

The version of Apple iOS running on the mobile device is prior to 12.1.1. It is, therefore, affected by multiple vulnerabilities. The highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

The version of Apple iOS running on the mobile device is prior to 12.1. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 12.0.1. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 12.0. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 11.4.1. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 11.4. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 11.3.1. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 11.3. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 11.2.6. It is, therefore, affected by a memory corruption vulnerability as referenced in the HT208534 advisory.

The version of Apple iOS running on the mobile device is prior to 11.2.5. It is, therefore, affected by multiple vulnerabilities as referenced in the HT208463 advisory.

The version of Apple iOS running on the mobile device is prior to 11.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the HT208401 advisory.

The version of Apple iOS running on the mobile device is prior to 11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the HT208334 advisory.

The version of Apple iOS running on the mobile device is prior to 11.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HT208222 advisory.

The version of Apple iOS running on the mobile device is prior to 11.0.1. It is, therefore, affected by multiple vulnerabilities as described in the HT208143 security advisory.

The version of Apple iOS running on the mobile device is prior to 11. It is, therefore, affected by multiple vulnerabilities as described in the HT208112 security advisory.

The version of iOS running on the mobile device is prior to 10.3.3, and is affected by multiple vulnerabilities :

 - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)
 - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)
 - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)
 - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)
 - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7009)
 - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013)
 - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)
 - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)
 - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)
 - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input. An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)
 - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)
 - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)
 - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory. (CVE-2017-7028, CVE-2017-7029)
 - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)
 - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7047)
 - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)
 - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs. An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)
 - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)
 - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)
 - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)
 - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)
 - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)
 - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)

The version of iOS running on the mobile device is prior to 10.3.2, and is affected by multiple vulnerabilities :

 - A use-after-free error exists in the handling of RenderElement objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderLayer objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of RenderInline objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists related to the certificate trust policy that is triggered when handling trust acceptance. This may allow a context-dependent attacker to potentially cause untrusted certificates to be treated as trusted.
 - An unspecified flaw exists in the Safari history menu. With a specially crafted web page, a context-dependent attacker can cause an application denial of service.
 - A logic flaw exists that allows a universal cross-site scripting (UXSS) attack. The issue is triggered when handling WebKit Editor commands. This may allow a context-dependent attacker to create a specially crafted web page that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and any website.
 - A type confusion flaw exists in SQLite that is triggered as certain input related to 'snippet' is not properly validated. With specially crafted web content, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.

This product is also affected by vulnerabilities found in the following components:

 - AVEVideoEncoder
 - CoreAudio
 - CoreFoundation
 - Foundation
 - iBooks 
 - IOSurface
 - Kernel
 - TextInput
 - Notifications
 - SQLite
 - WebKit
 - Web Inspector

The version of iOS running on the mobile device is prior to 10.3.1, and is affected by an overflow condition that exists in the Wi-Fi HardMAC SoCs. The issue is triggered as input is not properly validated when handling FT-IEs in 802.11r Fast BSS Transition Authentication Responses. This may allow an proximate attacker to cause a stack-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

The version of iOS running on the mobile device is prior to 10.3, and is affected by multiple vulnerabilities :

 - An unspecified state management flaw exists that may allow a context-dependent attacker to spoof the address bar. No further details have been provided. (CVE-2017-2376)
 - An unspecified flaw exists in the handling of HTTP authentication. This may allow a context-dependent attacker to display authentication sheets on arbitrary web sites and cause a denial of service. (CVE-2017-2389)
 - A flaw exists in the password-protected PDF export feature that is triggered as a weak encryption algorithm is used. This may allow an attacker with access to a password-protected document to potentially disclose the document content. (CVE-2017-2391)
 - A flaw exists in the 'SecKeyRawVerify()' function that is triggered as parameters are not properly validated during the handling of cryptographic API calls. This may allow a remote attacker to have an empty signature be accepted as valid. (CVE-2017-2423)

Additional flaws exist in the following components :

 - Carbon (CVE-2017-2379)
 - CoreGraphics (CVE-2017-2417)
 - DataAccess (CVE-2017-2414)
 - FontParser (CVE-2017-2406, CVE-2017-2407)
 - iCloud (CVE-2017-2397)
 - ImageIO (CVE-2017-2416)
 - iTunes Store (CVE-2017-2412)
 - Kernel (CVE-2017-2398, CVE-2017-2401, CVE-2017-2490)
 - libarchive (CVE-2017-2390)
 - Pasteboard (CVE-2017-2399)
 - Quick Look (CVE-2017-2404)
 - Safari (CVE-2017-2384, CVE-2017-2393, CVE-2017-2400)
 - Webkit (CVE-2017-2367, CVE-2017-2378, CVE-2017-2386, CVE-2017-2394, CVE-2017-2395, CVE-2017-2396, CVE-2017-2405, CVE-2017-2415, CVE-2017-2419, CVE-2017-2424, CVE-2017-2433, CVE-2017-2442, CVE-2017-2445, CVE-2017-2446, CVE-2017-2447, CVE-2017-2454, CVE-2017-2455, CVE-2017-2459, CVE-2017-2460, CVE-2017-2464, CVE-2017-2465, CVE-2017-2466, CVE-2017-2468, CVE-2017-2469, CVE-2017-2470, CVE-2017-2471, CVE-2017-2476, CVE-2017-2481)

The version of iOS running on the mobile device is prior to 10.2.1, and is affected by multiple vulnerabilities :

 - A prototype access flaw exists that is triggered when handling exceptions. With specially crafted web content, a context-dependent attacker may exfiltrate cross-origin data. (CVE-2017-2350)
 - A flaw exists in WiFi that is triggered when handling user input. This may allow a physically present attacker to bypass the lock and briefly access the home screen. (CVE-2017-2351)
 - A logic flaw exists related to state management in Auto Unlock. This may allow a physically present attacker to potentially unlock a watch when it is off the user's wrist. (CVE-2017-2352)
 - A type confusion flaw exists that is triggered as input is not properly validated when handling 'SearchInputType' objects. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2017-2354)
 - An unspecified memory initialization flaw exists that may allow a context-dependent attacker to potentially execute arbitrary code. No further details have been provided. (CVE-2017-2355)
 - A flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2017-2356, CVE-2017-2362, CVE-2017-2366, CVE-2017-2369, CVE-2017-2373)
 - A use-after-free error exists in the 'host_self_trap' mach trap. This may allow a local attacker to dereference already freed memory and gain elevated privileges. (CVE-2017-2360)
 - A flaw exists that is triggered as input is not properly validated when handling page loading. This may allow a context-dependent attacker to exfiltrate cross-origin data. (CVE-2017-2363, CVE-2017-2364)
 - A flaw exists that is triggered as input is not properly validated when handling variables. This may allow a context-dependent attacker to exfiltrate cross-origin data. (CVE-2017-2365)
 - A flaw exists in Contacts that is triggered as input is not properly validated during the handling of a specially crafted contact card. This may allow a context-dependent attacker to crash the system. (CVE-2017-2368)
 - An overflow condition exists in the 'mach_voucher_extract_attr_recipe_trap()' function that is triggered as certain input is not properly validated. This may allow a local attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2017-2370)
 - An unspecified flaw exists that may allow a context-dependent attacker to bypass popup restrictions via a specially crafted website. No further details have been provided. (CVE-2017-2371)

The version of iOS running on the mobile device is prior to 10.2, and is affected by multiple vulnerabilities in the following components :

 - 3DES
 - Accessibility 
 - Accounts
 - Audio
 - Certificates
 - Clipboard
 - CoreFoundation
 - CoreGraphics
 - CoreMedia External Displays
 - CoreMedia Playback
 - CoreText 
 - Find My iPhone
 - FontParser
 - Graphics Driver
 - ICU
 - Image Capture
 - ImageIO
 - IOHDIXController
 - IOHIDFamily
 - IOKit 152301)
 - kernel
 - libarchive
 - Local Authentication
 - MIG
 - Media Player
 - OCSP
 - Power Management
 - Profiles
 - S/MIME
 - SpringBoard
 - syslog
 - WebKit 
 - WebSheet

The version of Google Chrome for Android on the remote mobile host is prior to 54.0.2840.85, and affected by multiple vulnerabilities :

 - An unspecified flaw exists that may allow a context-dependent attacker to gain access to cross-origin data. No further details have been provided. (CVE-2016-5196)
 - A flaw exists that is due to the program failing to validate (e.g. via a whitelist) content intents sent when the user taps on an address, email address, or phone number. This may allow a context-dependent attacker to open arbitrary intent schemes. (CVE-2016-5197)

The version of iOS running on the mobile device is prior to 10.1, and is affected by multiple vulnerabilities in the following components :

 - CFNetwork Proxies (CVE-2016-7579)
 - Contacts (CVE-2016-4686)
 - CoreGraphics (CVE-2016-4673)
 - FaceTime (CVE-2016-7577)
 - FontParser (CVE-2016-4660, CVE-2016-4688)
 - IDS - Connectivity (CVE-2016-4721)
 - iTunes (CVE-2016-4685)
 - Kernel (CVE-2016-4669, CVE-2016-4680, CVE-2016-7613)
 - libarchive (CVE-2016-4679)
 - libxpc (CVE-2016-4675)
 - Safari (CVE-2016-7581)
 - Sandbox Profiles (CVE-2016-4664, CVE-2016-4665)
 - Security (CVE-2016-4670)
 - WebKit (CVE-2016-4666, CVE-2016-4677, CVE-2016-7578)

The version of iOS running on the mobile device is prior to 10.0.1, and is affected by an information disclosure vulnerability in the Kernel component. (CVE-2016-4655)

The version of iOS running on the mobile device is prior to 10.0, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-4698)
 - Assets (CVE-2016-4741)
 - Audio (CVE-2016-4702)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711, CVE-2016-4712)
 - FontParser (CVE-2016-4718)
 - GeoServices (CVE-2016-4719)
 - IDS - Connectivity (CVE-2016-4722)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - Keyboards (CVE-2016-4746)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxslt (CVE-2016-4738)
 - Mail (CVE-2016-4747)
 - Messages (CVE-2016-4740)
 - Printing UIKit (CVE-2016-4749)
 - S2 Camera (CVE-2016-4750)
 - Safari Reader (CVE-2016-4618)
 - Sandbox Profiles (CVE-2016-4620)
 - Security (CVE-2016-4753)
 - Springboard (CVE-2016-7759)
 - WebKit (CVE-2016-4728, CVE-2016-4758, CVE-2016-4611, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4759, CVE-2016-4762, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4760, CVE-2016-4733, CVE-2016-4765, CVE-2016-4763)

The version of iOS running on the mobile device is prior to 9.3.5, and is affected by multiple vulnerabilities. These vulnerablilities are contained within the Kernel subcomponent.

The version of iOS running on the mobile device is prior to 9.3.4, and the following components contain vulnerabilities :

 - IOMobile Frame Buffer
 - Kernel

The remote host is running a version of iOS 9.3.x prior to version 9.3.3, and the following components contain vulnerabilities :

 - CFNetwork
 - libxml2
 - WebKit
 - CoreGraphics
 - FaceTime
 - ImageIO
 - IOHIDFamily
 - Sandbox
 - Kernel
 - libxslt
 - Calender
 - IOAcceleratorFamily
 - Safari
 - Siri Contacts
 - Web Media

The remote host is running a version of iOS 9.3.x prior to version 9.3.2 and the following components contain vulnerabilities :

 - libxml2
 - WebKit

The remote host is running a version of iOS 9.x prior to version 9.3 and the following components contain vulnerabilities :

 - libxml2

The remote host is running a version of iOS 9.x prior to version 9.1 and the following components contain vulnerabilities :

 - mDNSResponder

The version of Google Chrome for Android on the remote mobile host is prior to 50.0.2661.102 and thus unpatched for a flaw in the 'FileURLToFilePath()' function in 'net/base/filename_util.cc' that allows traversing outside of a restricted path.  The issue is due to the program not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the file scheme.  This may allow an attacker to have an unspecified impact.

The version of Google Chrome for Android on the remote mobile host is prior to 50.0.2661.75 and thus is unpatched for a flaw that is triggered as the names of downloaded files from the content disposition are not properly sanitized.  This may allow a context-dependent attacker to bypass file path restrictions.

The remote host is running a version of iOS that is prior to version 9.3.2 and the following components contain vulnerabilities :

 - Accessibility
 - CFNetwork Proxies
 - CommonCrypto
 - CoreCapture
 - Disk Images
 - ImageIO
 - IOAcceleratorFamily
 - IOHIDFamily
 - Kernel
 - libc
 - libxml2
 - libxslt
 - MapKit
 - OpenGL
 - Safari
 - Siri
 - WebKit
 - WebKit Canvas

The remote host is running a version of iOS that is prior to version 9.3 and the following components contain vulnerabilities :

 - AppleUSBNetworking
 - FontParser
 - HTTPProtocol
 - IOHIDFamily
 - Kernel
 - LaunchServices
 - libxml2
 - Messages
 - Profiles
 - Security
 - TrueTypeScaler
 - WebKit
 - Wi-Fi

The remote host is running a version of iOS that is prior to version 9.2.1 and the following components contain vulnerabilities :

 - Disk Images
 - IOHIDFamily
 - IOKit
 - Kernel
 - libxslt
 - syslog
 - WebKit
 - WebKit CSS
 - WebSheet

The remote host is running a version of iOS that is prior to version 9.2 and the following components contain vulnerabilities :

 - AppleMobileFileIntegrity
 - AppSandbox
 - CFNetwork HTTPProtocol
 - Compression
 - CoreGraphics
 - CoreMedia Playback
 - dyld
 - GPUTools Framework
 - iBooks
 - ImageIO
 - IOHIDFamily
 - IOKit SCSI
 - Kernel
 - LaunchServices
 - libarchive
 - libc
 - libxml2
 - MobileStorageMounter
 - OpenGL
 - Photos
 - QuickLook
 - Safari
 - Sandbox
 - Security
 - Siri
 - WebKit

The remote host is running a version of iOS that is prior to version 9.1 and the following components contain vulnerabilities :

 - Accelerate Framework (CVE-2015-5940)
 - Bom CVE-2015-7006)
 - CFNetwork (CVE-2015-7023)
 - configd (CVE-2015-7015)
 - CoreGraphics (CVE-2015-5925, CVE-2015-5926)
 - CoreText (CVE-2015-6975, CVE-2015-6992, CVE-2015-7017)
 - Disk Images (CVE-2015-6995)
 - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)
 - GasGauge (CVE-2015-6979)
 - Grand Central Dispatch (CVE-2015-6989)
 - Graphics Driver (CVE-2015-6986)
 - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937, CVE-2015-5939)
 - IOAcceleratorFamily (CVE-2015-6996)
 - IOHIDFamily (CVE-2015-6974)
 - Kernel (CVE-2015-7004, CVE-2015-6988, CVE-2015-6994)
 - Notification Center (CVE-2015-7000)
 - OpenGL (CVE-2015-5924)
 - Security (CVE-2015-6983, CVE-2015-6999, CVE-2015-6997)
 - Telephony (CVE-2015-7022)
 - WebKit (CVE-2015-5928, CVE-2015-5929, CVE-2015-5930, CVE-2015-6981, CVE-2015-6982, CVE-2015-7002, CVE-2015-7005, CVE-2015-7012, CVE-2015-7014)

The remote host was detected to be using Tumblr while signed-in. Tumblr is a network service which allows for sharing of blog posts, images, and videos.

The remote host was detected to be using the Rhapsody mobile app. Rhapsody is an online music subscription service that can be accessed through a browser or smartphone application.

The remote mobile device is using the iHeartRadio application to stream music, radio, or any available broadcast.

The remote mobile device is using the TuneIn Radio application to stream music, radio, or any available broadcast.

Versions of Mozilla Firefox for Android earlier than 42.0 are affected by multiple vulnerabilities.  These include : 

 - A flaw exists in 'mobile/android/chrome/content/browser.js' that is triggered when the device exits fullscreen mode. This allows a context-dependent attacker to spoof the address bar. (CVE-2015-7185)
 - A flaw exists in 'mobile/android/components/HelperAppDialog.js' that is triggered when handling the 'file://' URI scheme. This may allow a context-dependent attacker to download arbitrary files or open cached profile data without the user knowing. (CVE-2015-7186)
 - A flaw exists in 'mobile/android/search/java/org/mozilla/search/PostSearchFragment.java' related to the crash reporter. The issue is triggered when a registered search engine uses an Android intent to launch the program. This may allow a malicious app to gain access to local log files that may contain sensitive information or local HTML files through file: URIs. (CVE-2015-7190)
 - A flaw exists in the 'IntentHelper::openNoHandler()' function in 'mobile/android/base/IntentHelper.java.' The issue is triggered when handling 'intent://' URLs during Fallback navigation. This may allow a context-dependent attacker to execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server (i.e. conduct UXSS attacks). (CVE-2015-7191)

Versions of Mozilla Firefox for Android earlier than 41.0 are affected by a flaw in 'mobile/android/base/IntentHelper.java' that is triggered when loading a URI with a custom scheme. This may allow a context-dependent attacker to spoof content to the address bar. (CVE-2015-4476)

NNM has observed the remote mobile host utilizing an app to browse Reddit. Reddit (styled reddit) is an entertainment, social networking, and news website where registered community members can submit content, such as text posts or direct links, making it essentially an online bulletin board system.

ID	Name	Severity
701155	Apple iOS < 12.4.1 Use-After-Free (SockPuppet)	Medium
700713	Apple iOS < 12.3 Multiple Vulnerabilities	Medium
700558	Apple iOS < 12.2 Multiple Vulnerabilities (APPLE-SA-2019-3-25-1)	Medium
700557	Apple iOS < 12.1.4 Multiple Vulnerabilities (APPLE-SA-2019-2-07-1)	Medium
700556	Apple iOS < 12.1.3 Multiple Vulnerabilities (APPLE-SA-2019-1-22-1)	Medium
700555	Apple iOS < 12.1.1 Multiple Vulnerabilities (APPLE-SA-2018-12-05-1)	Medium
700554	Apple iOS < 12.1 Multiple Vulnerabilities	Medium
700553	Apple iOS < 12.0.1 Multiple Vulnerabilities	Low
700552	Apple iOS < 12.0 Multiple Vulnerabilities (EFAIL, APPLE-SA-2018-9-24-4 and APPLE-SA-2018-10-30-8)	Medium
700551	Apple iOS < 11.4.1 Multiple Vulnerabilities	High
700550	Apple iOS < 11.4 Multiple Vulnerabilities (EFAIL)	Medium
700549	Apple iOS < 11.3.1 Multiple Vulnerabilities	High
700548	Apple iOS < 11.3 Multiple Vulnerabilities	High
700547	Apple iOS < 11.2.6 Telugu Character Handling Remote Memory Corruption Vulnerability (APPLE-SA-2018-02-19-1)	High
700546	Apple iOS < 11.2.5 Multiple Vulnerabilities (APPLE-SA-2018-1-23-1)	High
700545	Apple iOS < 11.2.2 Multiple Vulnerabilities (Spectre, APPLE-SA-2018-1-8-1)	Low
700544	Apple iOS < 11.2 Multiple Vulnerabilities (APPLE-SA-2017-12-13-6)	High
700543	Apple iOS < 11.1 Multiple Vulnerabilities	Medium
700542	Apple iOS < 11.0.1 Multiple Vulnerabilities	High
700541	Apple iOS < 11.0 Multiple Vulnerabilities (APPLE-SA:APPLE-SA-2017-09-19-1)	Critical
700167	Apple iOS < 10.3.3 Multiple Vulnerabilities	Critical
700116	Apple iOS < 10.3.2 Multiple Vulnerabilities	Critical
700115	Apple iOS < 10.3.1 RCE	High
700034	Apple iOS < 10.3 Multiple Vulnerabilities	High
9929	Apple iOS < 10.2.1 Multiple Vulnerabilities	High
9847	Apple iOS < 10.2 Multiple Vulnerabilities	High
9791	Google Chrome for Android < 54.0.2840.85 Multiple Vulnerabilities	Medium
9756	Apple iOS < 10.1 Multiple Vulnerabilities	High
9622	Apple iOS < 10.0.1 Information Disclosure	High
9619	Apple iOS < 10.0 Multiple Vulnerabilities	Critical
9548	Apple iOS 9.3.x < 9.3.5 Multiple Vulnerabilities	High
9481	Apple iOS 9.3.x < 9.3.4 Multiple Vulnerabilities	Medium
9445	Apple iOS 9.3.x < 9.3.3 Multiple Vulnerabilities	High
9444	Apple iOS 9.3.x < 9.3.2 Multiple Vulnerabilities	Medium
9443	Apple iOS 9.x < 9.3 RCE	Critical
9442	Apple iOS 9.x < 9.1 Multiple Vulnerabilities	High
9375	Google Chrome for Android < 50.0.2661.102 Directory Traversal	Medium
9374	Google Chrome for Android < 50.0.2661.75 Directory Traversal	Medium
9332	Apple iOS < 9.3.2 Multiple Vulnerabilities	High
9331	Apple iOS < 9.3 Multiple Vulnerabilities	High
9330	Apple iOS < 9.2.1 Multiple Vulnerabilities	High
9329	Apple iOS < 9.2 Multiple Vulnerabilities	High
9328	Apple iOS < 9.1 Multiple Vulnerabilities	High
9251	Tumblr Detection via HTTP	Info
9224	Rhapsody Music Application Detection	Info
9170	iHeartRadio Streaming Detection	Info
9169	TuneIn Radio Application Detection	Info
9019	Mozilla Firefox for Android < 42.0 Multiple Vulnerabilities	Medium
9017	Mozilla Firefox for Android < 41.0 Unknown Protocol Pasted URL Handling Spoofing	Medium
9807	Reddit Detection for Android	Info

Mobile Devices Family for Nessus Network Monitor