Design/Logic Flaw

Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows by leveraging an unattended workstation...

Information disclosure

Mail in Apple OS X before 10.10 does not properly recognize the removal of a recipient address from a message, which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading a message intended exclusively for other recipients...

Design/Logic Flaw

LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application that specifies a crafted handler for the Content-Type field of an object...

CVE-2014-4436

IOHIDFamily in Apple macOS OS X before 10.10 is vulnerable to an out-of-bounds read in its handling of key-mapping properties, allowing a crafted application to trigger denial of service. The CVE entry CVE-2014-4436 explicitly documents this IOHIDFamily issue and is listed among multiple related ...

CVE-2014-4437

LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application that specifies a crafted handler for the Content-Type field of an object...

CVE-2014-4434

CVE-2014-4434 affects the Apple OS X kernel prior to 10.10. A physically proximate attacker can cause a denial of service by crafting a filename on an HFS filesystem, leading to a NULL pointer dereference and system crash. The provided connected sources reiterate this description but do not offer...

CVE-2014-4425

CFPreferences in Apple OS X before 10.10 does not properly enforce the "require password after sleep or screen saver begins" setting, which makes it easier for physically proximate attackers to obtain access by leveraging an unattended workstation...

CVE-2014-4433

Affected software: Apple OS X versions prior to 10.10. The issue is a heap-based buffer overflow in the kernel triggered by crafted resource forks in an HFS filesystem, allowing physically proximate attackers to execute arbitrary code. Root cause: heap overflow in kernel code when handling resour...

CVE-2014-4438

Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by leveraging an unattended workstation on which screen locking had been attempted...

CVE-2014-4441

NetFS Client Framework in Apple OS X before 10.10 does not ensure that the disabling of File Sharing is always possible, which allows remote attackers to read or write to files by leveraging a state in which File Sharing is permanently enabled...

CVE-2014-4438

CVE-2014-4438: In Apple OS X before 10.10, a race condition in LoginWindow could let a physically proximate attacker gain access on an unattended workstation after screen locking was attempted. The issue was addressed by changing the order of operations in LoginWindow (remediation). The connected...

CVE-2014-4435

The CVE-2014-4435 entry concerns iCloud Find My Mac on macOS prior to 10.10, where rate limiting on the Lost Mode PIN was not properly enforced, enabling brute‑force access via a series of reboots for users in proximity. Connected sources corroborate that the issue affects macOS OS X pre-10.10 an...

CVE-2014-4434

The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service NULL pointer dereference and system crash via a crafted filename on an HFS filesystem...

CVE-2014-4437

CVE-2014-4437 affects Apple OS X LaunchServices (pre-10.10). The flaw allows a sandboxed application to bypass restrictions by registering a crafted Content-Type handler for an object. Root cause: the LaunchServices interface allowed sandboxed apps to set content-type handlers, enabling sandbox b...

CVE-2014-4447

CVE-2014-4447 affects Apple OS X Server

CVE-2014-4417

Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service universal Push Notification outage via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafted Push Notification...

CVE-2014-4351

Buffer overflow in QuickTime in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a denial of service application crash via crafted audio samples in an m4a file...

CVE-2014-4435

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

CVE-2014-4432

fdesetup in Apple OS X before 10.10 does not properly display the encryption status in between a setting-update action and a reboot action, which might make it easier for physically proximate attackers to obtain cleartext data by leveraging ignorance of the reboot requirement...

CVE-2014-4440

CVE-2014-4440 affects Apple OS X (pre-10.10) MCX Desktop Config Profiles. The vulnerability arises because web-proxy settings from mobile configuration profiles remain after uninstallation, allowing a remote attacker with access to an unintended proxy server to obtain sensitive information. The i...