zlib in the Compression component in Apple iOS before 9.2 OS X before 10.11.2 tvOS before 9.1 and watchOS before 2.1 does not initialize memory for an unspecified data structure which allows remote attackers to execute arbitrary code via a crafted web site.