Hello list! There are multiple vulnerabilities in Mobile Safari. There are Denial of Service and Cross-Site Scripting vulnerabilities. In the middle of December I checked all exploits for different browsers, which I published and non-published since 2006, in Mobile Safari for iOS 6.0.1 and 8.4.1. This is the first part of vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are Mobile Safari 6.0.1 and 8.4.1 for iOS and previous versions. ---------- Details: ---------- Denial of Service (WASC-10): Crash or freezing (with further crash) of the browser. http://websecurity.com.ua/uploads/2006/Mozilla_Firefox_IE_DoS_Exploit.html - in 6.0.1, and in 8.4.1 without crash, only consuming 60% CPU. http://websecurity.com.ua/uploads/2008/Firefox%203%20DoS%20Exploit.html - in 6.0.1. http://websecurity.com.ua/uploads/2008/Firefox%20DoS%20Exploit3.html - in 6.0.1, and in 8.4.1 without crash, only consuming 60% CPU. http://websecurity.com.ua/uploads/2008/Firefox%20DoS%20Exploit4.html - in 6.0.1, and in 8.4.1 without crash, only consuming 60% CPU. http://websecurity.com.ua/uploads/2008/Firefox,%20IE,%20Opera%20&%20Chrome%20DoS%20Exploit.html - in 6.0.1. Made exploit for Mobile Safari, which is similar to 2008's exploit for Firefox: http://websecurity.com.ua/uploads/2015/Safari%20DoS%20Exploit.html Cross-Site Scripting (WASC-08): Bypass XSS filters in Mobile Safari 6.0.1 and 8.4.1. The attack is possible with using the next characters: 9 (0x09), 10 (0x0a), 12 (0x0c), 13 (0x0d), 32 (0x20), 47 (0x2f). About it read my article Bypassing filters for conducting XSS attacks http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-February/008727.html. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/8090/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua