ID CVE-2016-4727 Type cve Reporter cve@mitre.org Modified 2017-07-30T01:29:00
Description
IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
{"zdi": [{"lastseen": "2020-06-22T11:41:38", "bulletinFamily": "info", "cvelist": ["CVE-2016-4727"], "edition": 3, "description": "This vulnerability allows local attackers to escalate privileges on vulnerable installations of Apple OS X. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the IOThunderboltFamily kext. The issue lies in the failure to properly initialize memory prior to accessing it. An attacker can leverage this vulnerability to escalate privileges under the context of the kernel.", "modified": "2016-06-22T00:00:00", "published": "2016-09-20T00:00:00", "href": "https://www.zerodayinitiative.com/advisories/ZDI-16-522/", "id": "ZDI-16-522", "title": "Apple OS X IOThunderboltFamily Uninitialized Memory Privilege Escalation Vulnerability", "type": "zdi", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2019-05-29T18:35:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-4727", "CVE-2016-5771", "CVE-2016-6288", "CVE-2016-6290", "CVE-2016-4713", "CVE-2016-4750", "CVE-2016-4716", "CVE-2016-4703", "CVE-2016-5772", "CVE-2016-4722", "CVE-2016-4753", "CVE-2016-4752", "CVE-2016-4773", "CVE-2016-4694", "CVE-2016-4696", "CVE-2016-4701", "CVE-2016-0755", "CVE-2016-4715", "CVE-2016-4712", "CVE-2016-4708", "CVE-2016-4709", "CVE-2016-4748", "CVE-2016-4755", "CVE-2016-5770", "CVE-2016-5768", "CVE-2016-4717", "CVE-2016-4710", "CVE-2016-4745", "CVE-2016-4776", "CVE-2016-6174", "CVE-2016-4711", "CVE-2016-4699", "CVE-2016-6295", "CVE-2016-4697", "CVE-2016-6297", "CVE-2016-4739", "CVE-2016-6292", "CVE-2016-4698", "CVE-2016-4736", "CVE-2016-4707", "CVE-2016-5131", "CVE-2016-6289", "CVE-2016-4718", "CVE-2016-4777", "CVE-2016-4738", "CVE-2016-4723", "CVE-2016-4724", "CVE-2016-5769", "CVE-2016-6294", "CVE-2016-4725", "CVE-2016-4742", "CVE-2016-4706", "CVE-2016-5773", "CVE-2016-4772", "CVE-2016-4779", "CVE-2016-4771", "CVE-2016-4726", "CVE-2016-4658", "CVE-2016-4700", "CVE-2016-4775", "CVE-2016-6291", "CVE-2016-4774", "CVE-2016-4778", "CVE-2016-4702", "CVE-2016-6296"], "description": "This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.", "modified": "2019-05-03T00:00:00", "published": "2016-09-28T00:00:00", "id": "OPENVAS:1361412562310807888", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310807888", "type": "openvas", "title": "Apple Mac OS X Multiple Vulnerabilities-01 September-2016", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Apple Mac OS X Multiple Vulnerabilities-01 September-2016\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.807888\");\n script_version(\"2019-05-03T08:55:39+0000\");\n script_cve_id(\"CVE-2016-4694\", \"CVE-2016-5768\", \"CVE-2016-5769\", \"CVE-2016-5770\",\n \"CVE-2016-5771\", \"CVE-2016-5772\", \"CVE-2016-5773\", \"CVE-2016-6174\",\n \"CVE-2016-6288\", \"CVE-2016-6289\", \"CVE-2016-6290\", \"CVE-2016-6291\",\n \"CVE-2016-6292\", \"CVE-2016-6294\", \"CVE-2016-6295\", \"CVE-2016-6296\",\n \"CVE-2016-6297\", \"CVE-2016-4697\", \"CVE-2016-4696\", \"CVE-2016-4698\",\n \"CVE-2016-4699\", \"CVE-2016-4700\", \"CVE-2016-4701\", \"CVE-2016-4779\",\n \"CVE-2016-4702\", \"CVE-2016-4703\", \"CVE-2016-4706\", \"CVE-2016-4707\",\n \"CVE-2016-4708\", \"CVE-2016-4711\", \"CVE-2016-4712\", \"CVE-2016-4713\",\n \"CVE-2016-0755\", \"CVE-2016-4715\", \"CVE-2016-4716\", \"CVE-2016-4717\",\n \"CVE-2016-4718\", \"CVE-2016-4722\", \"CVE-2016-4723\", \"CVE-2016-4724\",\n \"CVE-2016-4725\", \"CVE-2016-4726\", \"CVE-2016-4727\", \"CVE-2016-4745\",\n \"CVE-2016-4771\", \"CVE-2016-4772\", \"CVE-2016-4773\", \"CVE-2016-4774\",\n \"CVE-2016-4776\", \"CVE-2016-4775\", \"CVE-2016-4777\", \"CVE-2016-4778\",\n \"CVE-2016-4736\", \"CVE-2016-4658\", \"CVE-2016-5131\", \"CVE-2016-4738\",\n \"CVE-2016-4739\", \"CVE-2016-4742\", \"CVE-2016-4748\", \"CVE-2016-4750\",\n \"CVE-2016-4752\", \"CVE-2016-4753\", \"CVE-2016-4755\", \"CVE-2016-4709\",\n \"CVE-2016-4710\");\n script_bugtraq_id(93063, 91396, 92074, 92073, 93054, 93055, 92095, 92094, 92097,\n 93059, 92078, 92053, 91732, 91399, 91398, 91397, 92099, 82307,\n 92111, 91403, 92115, 91401, 93060, 93056);\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-03 08:55:39 +0000 (Fri, 03 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2016-09-28 12:22:55 +0530 (Wed, 28 Sep 2016)\");\n script_name(\"Apple Mac OS X Multiple Vulnerabilities-01 September-2016\");\n\n script_tag(name:\"summary\", value:\"This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists. For details\n refer the reference links.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker\n to execute arbitrary code or cause a denial of service (memory corruption),\n gain access to potentially sensitive information, bypass certain protection\n mechanism and have other impacts.\");\n\n script_tag(name:\"affected\", value:\"Apple Mac OS X versions 10.7.5 through 10.11.x\n prior to 10.12\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple Mac OS X version\n 10.12 or later. Please see the references for more information.\n\n Note: According to the vendor an upgrade to version 10.12 is required to\n mitigate this vulnerabilities. Please see the advisory (HT207170) for more info.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT207170\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\", re:\"ssh/login/osx_version=^10\\.([7-9]|1[01])\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName)\n exit(0);\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer)\n exit(0);\n\nif(\"Mac OS X\" >< osName && osVer =~ \"^10\\.([7-9]|1[01])\"){\n if(version_in_range(version:osVer, test_version: \"10.7.5\", test_version2:\"10.11.6\")){\n report = report_fixed_ver(installed_version:osVer, fixed_version:\"According to the vendor an upgrade to version 10.12 is required to mitigate this vulnerabilities. Please see the advisory (HT207170) for more info.\");\n security_message(port:0, data:report);\n exit(0);\n }\n}\n\nexit(99);", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2021-04-01T03:35:34", "description": "The remote host is running a version of Mac OS X that is prior to\n10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is,\ntherefore, affected by multiple vulnerabilities in the following\ncomponents :\n\n - apache\n - apache_mod_php\n - Apple HSSPI Support\n - AppleEFIRuntime\n - AppleMobileFileIntegrity\n - AppleUCC\n - Application Firewall\n - ATS\n - Audio\n - Bluetooth\n - cd9660\n - CFNetwork\n - CommonCrypto\n - CoreCrypto\n - CoreDisplay\n - curl\n - Date & Time Pref Pane\n - DiskArbitration\n - File Bookmark\n - FontParser\n - IDS - Connectivity\n - ImageIO\n - Intel Graphics Driver\n - IOAcceleratorFamily\n - IOThunderboltFamily\n - Kerberos v5 PAM module\n - Kernel\n - libarchive\n - libxml2\n - libxpc\n - libxslt\n - mDNSResponder\n - NSSecureTextField\n - Perl\n - S2 Camera\n - Security\n - Terminal\n - WindowServer\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.", "edition": 32, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2016-09-23T00:00:00", "title": "macOS < 10.12 Multiple Vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2016-4727", "CVE-2016-5771", "CVE-2016-6288", "CVE-2016-6290", "CVE-2016-4713", "CVE-2016-4750", "CVE-2016-4716", "CVE-2016-4703", "CVE-2016-5772", "CVE-2016-4722", "CVE-2016-4753", "CVE-2016-4752", "CVE-2016-4773", "CVE-2016-4694", "CVE-2016-4696", "CVE-2016-4701", "CVE-2016-0755", "CVE-2016-4715", "CVE-2016-4712", "CVE-2016-4708", "CVE-2016-4709", "CVE-2016-4748", "CVE-2016-4617", "CVE-2016-4755", "CVE-2016-5770", "CVE-2016-5768", "CVE-2016-7582", "CVE-2016-4717", "CVE-2016-4710", "CVE-2016-4745", "CVE-2016-4776", "CVE-2016-6174", "CVE-2016-4711", "CVE-2016-4699", "CVE-2016-6295", "CVE-2016-7580", "CVE-2016-4697", "CVE-2016-6297", "CVE-2016-4739", "CVE-2016-6292", "CVE-2016-4698", "CVE-2016-4736", "CVE-2016-4682", "CVE-2016-4707", "CVE-2016-5131", "CVE-2016-6289", "CVE-2016-4718", "CVE-2016-4777", "CVE-2016-4738", "CVE-2016-4723", "CVE-2016-4724", "CVE-2016-5769", "CVE-2016-6294", "CVE-2016-4725", "CVE-2016-4742", "CVE-2016-4706", "CVE-2016-5773", "CVE-2016-4772", "CVE-2016-4779", "CVE-2016-4771", "CVE-2016-4726", "CVE-2016-4658", "CVE-2016-4700", "CVE-2016-4775", "CVE-2016-6291", "CVE-2016-4774", "CVE-2016-4778", "CVE-2016-4702", "CVE-2016-6296"], "modified": "2021-04-02T00:00:00", "cpe": ["cpe:/o:apple:macos", "cpe:/o:apple:mac_os_x"], "id": "MACOS_10_12.NASL", "href": "https://www.tenable.com/plugins/nessus/93685", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(93685);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2019/06/19 15:17:43\");\n\n script_cve_id(\n \"CVE-2016-0755\",\n \"CVE-2016-4617\",\n \"CVE-2016-4658\",\n \"CVE-2016-4682\",\n \"CVE-2016-4694\",\n \"CVE-2016-4696\",\n \"CVE-2016-4697\",\n \"CVE-2016-4698\",\n \"CVE-2016-4699\",\n \"CVE-2016-4700\",\n \"CVE-2016-4701\",\n \"CVE-2016-4702\",\n \"CVE-2016-4703\",\n \"CVE-2016-4706\",\n \"CVE-2016-4707\",\n \"CVE-2016-4708\",\n \"CVE-2016-4709\",\n \"CVE-2016-4710\",\n \"CVE-2016-4711\",\n \"CVE-2016-4712\",\n \"CVE-2016-4713\",\n \"CVE-2016-4715\",\n \"CVE-2016-4716\",\n \"CVE-2016-4717\",\n \"CVE-2016-4718\",\n \"CVE-2016-4722\",\n \"CVE-2016-4723\",\n \"CVE-2016-4724\",\n \"CVE-2016-4725\",\n \"CVE-2016-4726\",\n \"CVE-2016-4727\",\n \"CVE-2016-4736\",\n \"CVE-2016-4738\",\n \"CVE-2016-4739\",\n \"CVE-2016-4742\",\n \"CVE-2016-4745\",\n \"CVE-2016-4748\",\n \"CVE-2016-4750\",\n \"CVE-2016-4752\",\n \"CVE-2016-4753\",\n \"CVE-2016-4755\",\n \"CVE-2016-4771\",\n \"CVE-2016-4772\",\n \"CVE-2016-4773\",\n \"CVE-2016-4774\",\n \"CVE-2016-4775\",\n \"CVE-2016-4776\",\n \"CVE-2016-4777\",\n \"CVE-2016-4778\",\n \"CVE-2016-4779\",\n \"CVE-2016-5131\",\n \"CVE-2016-5768\",\n \"CVE-2016-5769\",\n \"CVE-2016-5770\",\n \"CVE-2016-5771\",\n \"CVE-2016-5772\",\n \"CVE-2016-5773\",\n \"CVE-2016-6174\",\n \"CVE-2016-6288\",\n \"CVE-2016-6289\",\n \"CVE-2016-6290\",\n \"CVE-2016-6291\",\n \"CVE-2016-6292\",\n \"CVE-2016-6294\",\n \"CVE-2016-6295\",\n \"CVE-2016-6296\",\n \"CVE-2016-6297\",\n \"CVE-2016-7580\",\n \"CVE-2016-7582\"\n );\n script_bugtraq_id(\n 82307,\n 91396,\n 91397,\n 91398,\n 91399,\n 91401,\n 91403,\n 91732,\n 92053,\n 92073,\n 92074,\n 92078,\n 92094,\n 92095,\n 92097,\n 92099,\n 92111,\n 92115,\n 93054,\n 93055,\n 93056,\n 93059,\n 93060,\n 93063,\n 93852,\n 94434,\n 94435,\n 96329\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2016-09-20\");\n\n script_name(english:\"macOS < 10.12 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of Mac OS X / macOS.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is missing a macOS update that fixes multiple security\nvulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X that is prior to\n10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is,\ntherefore, affected by multiple vulnerabilities in the following\ncomponents :\n\n - apache\n - apache_mod_php\n - Apple HSSPI Support\n - AppleEFIRuntime\n - AppleMobileFileIntegrity\n - AppleUCC\n - Application Firewall\n - ATS\n - Audio\n - Bluetooth\n - cd9660\n - CFNetwork\n - CommonCrypto\n - CoreCrypto\n - CoreDisplay\n - curl\n - Date & Time Pref Pane\n - DiskArbitration\n - File Bookmark\n - FontParser\n - IDS - Connectivity\n - ImageIO\n - Intel Graphics Driver\n - IOAcceleratorFamily\n - IOThunderboltFamily\n - Kerberos v5 PAM module\n - Kernel\n - libarchive\n - libxml2\n - libxpc\n - libxslt\n - mDNSResponder\n - NSSecureTextField\n - Perl\n - S2 Camera\n - Security\n - Terminal\n - WindowServer\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT207170\");\n # https://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?c49c769b\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to macOS version 10.12 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-4658\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"d2_elliot_name\", value:\"IPS Community Suite RCE\");\n script_set_attribute(attribute:\"exploit_framework_d2_elliot\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/09/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/23\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:macos\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"os_fingerprint.nasl\");\n script_require_ports(\"Host/MacOSX/Version\", \"Host/OS\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nos = get_kb_item(\"Host/MacOSX/Version\");\nif (!os)\n{\n os = get_kb_item_or_exit(\"Host/OS\");\n if (\"Mac OS X\" >!< os) audit(AUDIT_OS_NOT, \"macOS / Mac OS X\");\n\n c = get_kb_item(\"Host/OS/Confidence\");\n if (c <= 70) exit(1, \"Can't determine the host's OS with sufficient confidence.\");\n}\nif (!os) audit(AUDIT_OS_NOT, \"macOS / Mac OS X\");\n\nmatches = pregmatch(pattern:\"Mac OS X ([0-9]+(\\.[0-9]+)+)\", string:os);\nif (isnull(matches)) exit(1, \"Failed to parse the macOS / Mac OS X version ('\" + os + \"').\");\n\nversion = matches[1];\nfixed_version = \"10.12\";\n\n# Patches exist for OS X Yosemite v10.10.5 and OS X El Capitan v10.11.6\n# https://support.apple.com/en-us/HT207275\n# Do NOT mark them as vuln\nif (\n # No 10.x patch below 10.10.5\n ver_compare(ver:version, fix:'10.10.5', strict:FALSE) == -1\n ||\n # No 10.11.x patch below 10.11.6\n (\n version =~\"^10\\.11($|[^0-9])\"\n &&\n ver_compare(ver:version, fix:'10.11.6', strict:FALSE) == -1\n )\n)\n{\n security_report_v4(\n port:0,\n severity:SECURITY_HOLE,\n extra:\n '\\n Installed version : ' + version +\n '\\n Fixed version : ' + fixed_version +\n '\\n'\n );\n}\nelse audit(AUDIT_INST_VER_NOT_VULN, \"macOS / Mac OS X\", version);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "apple": [{"lastseen": "2020-12-24T20:41:42", "bulletinFamily": "software", "cvelist": ["CVE-2016-4727", "CVE-2016-5771", "CVE-2016-6288", "CVE-2016-6290", "CVE-2016-4713", "CVE-2016-4750", "CVE-2016-4716", "CVE-2016-4703", "CVE-2016-5772", "CVE-2016-4722", "CVE-2016-4753", "CVE-2016-4752", "CVE-2016-4773", "CVE-2016-4694", "CVE-2016-4696", "CVE-2016-4701", "CVE-2016-0755", "CVE-2016-4715", "CVE-2016-4712", "CVE-2016-4708", "CVE-2016-4709", "CVE-2016-4748", "CVE-2016-4617", "CVE-2016-4755", "CVE-2016-5770", "CVE-2016-5768", "CVE-2016-7582", "CVE-2016-4717", "CVE-2016-4710", "CVE-2016-4745", "CVE-2016-4776", "CVE-2016-6174", "CVE-2016-4711", "CVE-2016-4699", "CVE-2016-6295", "CVE-2016-7580", "CVE-2016-4697", "CVE-2016-6297", "CVE-2016-4739", "CVE-2016-6292", "CVE-2016-4698", "CVE-2016-4736", "CVE-2016-4682", "CVE-2016-4707", "CVE-2016-5131", "CVE-2016-6289", "CVE-2016-4718", "CVE-2016-4777", "CVE-2016-4738", "CVE-2016-4723", "CVE-2016-4724", "CVE-2016-5769", "CVE-2016-6294", "CVE-2016-4725", "CVE-2016-4742", "CVE-2016-4706", "CVE-2016-5773", "CVE-2016-4772", "CVE-2016-4779", "CVE-2016-4771", "CVE-2016-4726", "CVE-2016-4658", "CVE-2016-4700", "CVE-2016-4775", "CVE-2016-6291", "CVE-2016-4774", "CVE-2016-4778", "CVE-2016-4702", "CVE-2016-6296"], "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://www.apple.com/support/security/>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## macOS Sierra 10.12\n\nReleased September 20, 2016\n\n**apache**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A remote attacker may be able to proxy traffic through an arbitrary server\n\nDescription: An issue existed in the handling of the HTTP_PROXY environment variable. This issue was addressed by not setting the HTTP_PROXY environment variable from CGI.\n\nCVE-2016-4694: Dominic Scheirlinck and Scott Geary of Vend\n\n**apache_mod_php**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Multiple issues in PHP, the most significant of which may lead to unexpected application termination or arbitrary code execution.\n\nDescription: Multiple issues in PHP were addressed by updating PHP to version 5.6.24.\n\nCVE-2016-5768\n\nCVE-2016-5769\n\nCVE-2016-5770\n\nCVE-2016-5771\n\nCVE-2016-5772\n\nCVE-2016-5773\n\nCVE-2016-6174\n\nCVE-2016-6288\n\nCVE-2016-6289\n\nCVE-2016-6290\n\nCVE-2016-6291\n\nCVE-2016-6292\n\nCVE-2016-6294\n\nCVE-2016-6295\n\nCVE-2016-6296\n\nCVE-2016-6297\n\n**Apple HSSPI Support**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed through improved memory handling.\n\nCVE-2016-4697: Qidan He (@flanker_hqd) from KeenLab working with Trend Micro's Zero Day Initiative\n\n**AppleEFIRuntime**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A null pointer dereference was addressed through improved input validation.\n\nCVE-2016-4696: Shrek_wzw of Qihoo 360 Nirvan Team\n\n**AppleMobileFileIntegrity**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local application may be able to execute arbitrary code with system privileges\n\nDescription: A validation issue existed in the task port inheritance policy. This issue was addressed through improved validation of the process entitlement and Team ID.\n\nCVE-2016-4698: Pedro Vila\u00e7a\n\n**AppleUUC**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: Multiple memory corruption issues were addressed through improved input validation.\n\nCVE-2016-4699: Jack Tang (@jacktang310) and Moony Li of Trend Micro working with Trend Micro's Zero Day Initiative\n\nCVE-2016-4700: Jack Tang (@jacktang310) and Moony Li of Trend Micro working with Trend Micro\u2019s Zero Day Initiative\n\n**Application Firewall**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local user may be able to cause a denial of service\n\nDescription: A validation issue existed in the handling of firewall prompts. This issue was addressed through improved validation of SO_EXECPATH.\n\nCVE-2016-4701: Meder Kydyraliev Google Security Team\n\n**ATS**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Processing a maliciously crafted font file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed through improved memory handling.\n\nCVE-2016-4779: riusksk of Tencent Security Platform Department\n\n**Audio**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A remote attacker may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed through improved memory handling.\n\nCVE-2016-4702: YoungJin Yoon, MinSik Shin, HoJae Han, Sunghyun Park, and Taekyoung Kwon of Information Security Lab, Yonsei University.\n\n**Bluetooth**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed through improved input validation.\n\nCVE-2016-4703: Juwei Lin (@fuzzerDOTcn) of Trend Micro\n\n**cd9660**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local user may be able to cause a system denial of service\n\nDescription: An input validation issue was addressed through improved memory handling.\n\nCVE-2016-4706: Recurity Labs on behalf of BSI (German Federal Office for Information Security)\n\n**CFNetwork**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local user may be able to discover websites a user has visited\n\nDescription: An issue existed in Local Storage deletion. This issue was addressed through improved Local Storage cleanup.\n\nCVE-2016-4707: an anonymous researcher\n\n**CFNetwork**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Processing maliciously crafted web content may compromise user information\n\nDescription: An input validation issue existed in the parsing of the set-cookie header. This issue was addressed through improved validation checking.\n\nCVE-2016-4708: Dawid Czagan of Silesia Security Lab\n\n**CommonCrypto**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application using CCrypt may disclose sensitive plaintext if the output and input buffer are the same\n\nDescription: An input validation issue existed in corecrypto. This issue was addressed through improved input validation.\n\nCVE-2016-4711: Max Lohrmann\n\n**CoreCrypto**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code\n\nDescription: An out-of-bounds write issue was addressed by removing the vulnerable code.\n\nCVE-2016-4712: Gergo Koteles\n\n**CoreDisplay**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A user with screen sharing access may be able to view another user's screen\n\nDescription: A session management issue existed in the handling of screen sharing sessions. This issue was addressed through improved session tracking.\n\nCVE-2016-4713: Ruggero Alberti\n\n**curl**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Multiple issues in curl\n\nDescription: Multiple security issues existed in curl prior to version 7.49.1. These issues were addressed by updating curl to version 7.49.1.\n\nCVE-2016-0755: Isaac Boukris\n\n**Date & Time Pref Pane**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A malicious application may be able to determine a user's current location\n\nDescription: An issue existed in the handling of the .GlobalPreferences file. This was addressed though improved validation.\n\nCVE-2016-4715: Taiki (@Taiki__San) at ESIEA (Paris)\n\n**DiskArbitration**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local user may be able to execute arbitrary code with system privileges\n\nDescription: An access issue existed in diskutil. This issue was addressed through improved permissions checking.\n\nCVE-2016-4716: Alexander Allen of The North Carolina School of Science and Mathematics\n\n**File Bookmark**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local application may be able to cause a denial of service\n\nDescription: A resource management issue existed in the handling of scoped bookmarks. This issue was addressed through improved file descriptor handling.\n\nCVE-2016-4717: Tom Bradley of 71Squared Ltd\n\n**FontParser**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Processing a maliciously crafted font may result in the disclosure of process memory\n\nDescription: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking.\n\nCVE-2016-4718: Apple\n\n**IDS - Connectivity**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An attacker in a privileged network position may be able to cause a denial of service\n\nDescription: A spoofing issue existed in the handling of Call Relay. This issue was addressed through improved input validation.\n\nCVE-2016-4722: Martin Vigo (@martin_vigo) of salesforce.com\n\n**ImageIO**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Processing maliciously crafted image may result in the disclosure of process memory\n\nDescription: An out-of-bounds read issue existed in the SGI image parsing. This issue was addressed through improved bounds checking.\n\nCVE-2016-4682: Ke Liu of Tencent's Xuanwu Lab\n\nEntry added October 24, 2016\n\n**Intel Graphics Driver**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2016-4723: daybreaker of Minionz\n\n**Intel Graphics Driver**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A use after free issue was addressed through improved memory management.\n\nCVE-2016-7582: Liang Chen of Tencent KeenLab\n\nEntry added November 14, 2016\n\n**IOAcceleratorFamily**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A null pointer dereference was addressed through improved input validation.\n\nCVE-2016-4724: Cererdlong, Eakerqiu of Team OverSky\n\n**IOAcceleratorFamily**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Processing maliciously crafted web content may result in the disclosure of process memory\n\nDescription: A memory corruption issue was addressed through improved input validation.\n\nCVE-2016-4725: Rodger Combs of Plex, Inc\n\n**IOAcceleratorFamily**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed through improved memory handling.\n\nCVE-2016-4726: an anonymous researcher\n\n**IOThunderboltFamily**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed through improved memory handling.\n\nCVE-2016-4727: wmin working with Trend Micros Zero Day Initiative\n\n**Kerberos v5 PAM module**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A remote attacker may determine the existence of user accounts\n\nDescription: A timing side channel allowed an attacker to determine the existence of user accounts on a system. This issue was addressed by introducing constant time checks.\n\nCVE-2016-4745: an anonymous researcher\n\n**Kernel**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local application may be able to access restricted files\n\nDescription: A parsing issue in the handling of directory paths was addressed through improved path validation.\n\nCVE-2016-4771: Balazs Bucsay, Research Director of MRG Effitas\n\n**Kernel**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A remote attacker may be able to cause a denial of service\n\nDescription: A lock handling issue was addressed through improved lock handling.\n\nCVE-2016-4772: Marc Heuse of mh-sec\n\n**Kernel**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to determine kernel memory layout\n\nDescription: Multiple out-of-bounds read issues existed that led to the disclosure of kernel memory. These were addressed through improved input validation.\n\nCVE-2016-4773: Brandon Azad\n\nCVE-2016-4774: Brandon Azad\n\nCVE-2016-4776: Brandon Azad\n\n**Kernel**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local user may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed through improved memory handling.\n\nCVE-2016-4775: Brandon Azad\n\n**Kernel**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: An untrusted pointer dereference was addressed by removing the affected code.\n\nCVE-2016-4777: Lufeng Li of Qihoo 360 Vulcan Team\n\n**Kernel**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2016-4778: CESG\n\n**libarchive**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Multiple issues in libarchive\n\nDescription: Multiple memory corruption issues existed in libarchive. These issues were addressed through improved input validation.\n\nCVE-2016-4736: Proteas of Qihoo 360 Nirvan Team\n\n**libxml2**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Multiple issues in libxml2, the most significant of which may lead to unexpected application termination or arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2016-4658: Nick Wellnhofer\n\nCVE-2016-5131: Nick Wellnhofer\n\n**libxpc**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to break out of its sandbox\n\nDescription: Multiple weaknesses existed with spawning new processes using launchctl. These issues were addressed through improved policy enforcement.\n\nCVE-2016-4617: Gregor Kopf of Recurity Labs on behalf of BSI (German Federal Office for Information Security)\n\nEntry added October 24, 2016\n\n**libxslt**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed through improved memory handling.\n\nCVE-2016-4738: Nick Wellnhofer\n\n**Mail**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A malicious website may be able to cause a denial-of-service\n\nDescription: A denial of service issue was addressed through improved URL handling.\n\nCVE-2016-7580: Sabri Haddouche (@pwnsdx)\n\nEntry added December 1, 2016\n\n**mDNSResponder**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A remote attacker may be able to view sensitive information\n\nDescription: Applications using VMnet.framework enabled a DNS proxy listening on all network interfaces. This issue was addressed by restricting DNS query responses to local interfaces.\n\nCVE-2016-4739: Magnus Skjegstad, David Scott and Anil Madhavapeddy from Docker, Inc.\n\n**NSSecureTextField**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A malicious application may be able to leak a user's credentials\n\nDescription: A state management issue existed in NSSecureTextField, which failed to enable Secure Input. This issue was addressed through improved window management.\n\nCVE-2016-4742: Rick Fillion of AgileBits, Daniel Jalkut of Red Sweater Software\n\n**Perl**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local user may be able to bypass the taint protection mechanism\n\nDescription: An issue existed in the parsing of environment variables. This issue was addressed through improved validation of environment variables.\n\nCVE-2016-4748: Stephane Chazelas\n\n**S2 Camera**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed through improved memory handling.\n\nCVE-2016-4750: Jack Tang (@jacktang310) and Moony Li of Trend Micro working with Trend Micro\u2019s Zero Day Initiative\n\n**Security**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: An application using SecKeyDeriveFromPassword may leak memory\n\nDescription: A resource management issue existed in the handling of key derivation. This issue was addressed by adding CF_RETURNS_RETAINED to SecKeyDeriveFromPassword.\n\nCVE-2016-4752: Mark Rogers of PowerMapper Software\n\n**Security**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A malicious application may be able to execute arbitrary code with system privileges\n\nDescription: A validation issue existed in signed disk images. This issue was addressed through improved size validation.\n\nCVE-2016-4753: Mark Mentovai of Google Inc.\n\n**Terminal**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local user may be able to leak sensitive user information\n\nDescription: A permissions issue existed in .bash_history and .bash_session. This issue was addressed through improved access restrictions.\n\nCVE-2016-4755: Axel Luttgens\n\n**WindowServer**\n\nAvailable for: OS X Lion v10.7.5 and later\n\nImpact: A local user may be able to gain root privileges\n\nDescription: A type confusion issue was addressed through improved memory handling.\n\nCVE-2016-4709: an anonymous researcher working with Trend Micro's Zero Day Initiative\n\nCVE-2016-4710: an anonymous researcher working with Trend Micro's Zero Day Initiative\n\nEntry updated November 15, 2016\n\nmacOS Sierra 10.12 includes the security content of [Safari 10](<https://support.apple.com/kb/HT207157>).\n", "edition": 2, "modified": "2017-01-23T05:36:06", "published": "2017-01-23T05:36:06", "id": "APPLE:HT207170", "href": "https://support.apple.com/kb/HT207170", "title": "About the security content of macOS Sierra 10.12 - Apple Support", "type": "apple", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}
