CVE-2014-4443

CVE-2014-4443 affects Apple macOS X prior to 10.10. The vulnerability is a remote denial of service via a NULL pointer dereference when handling crafted ASN.1 data. The issue is rooted in how ASN.1 data is processed, allowing an attacker to induce a crash without requiring user interaction. Impac...

CVE-2014-4447

Profile Manager in Apple OS X Server before 4.0 allows local users to discover cleartext passwords by reading a file after a 1 profile setup or 2 profile edit occurs...

CVE-2014-4443

Apple OS X before 10.10 allows remote attackers to cause a denial of service NULL pointer dereference via crafted ASN.1 data...

CVE-2014-4436

IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service out-of-bounds read operation via a crafted application...

CVE-2014-4446

Mail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service restart, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a change made by an administrator...

CVE-2014-4430

CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, which makes it easier for physically proximate attackers to obtain cleartext data via a remount...

CVE-2014-4446

CVE-2014-4446 affects Mail Service on Apple OS X Server prior to 4.0. The SACL changes are cached and not enforced until the Mail service restarts, enabling remote authenticated users to bypass access restrictions in opportunistic circumstances. No explicit remediation details are provided in the...

CVE-2014-4426

AFP File Server in Apple OS X before 10.10 allows remote attackers to discover the network addresses of all interfaces via an unspecified command to one interface...

CVE-2014-4391

Apple OS X before 10.10 is affected by CVE-2014-4391. The issue is in Code Signing where incomplete resource envelopes in signed bundles can bypass app-author restrictions by omitting an execution-related resource, enabling potential execution of tampered code. The vulnerability arises from how t...

CVE-2014-4431

Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows by leveraging an unattended workstation...

CVE-2014-4427

App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API...

CVE-2014-4444

SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local users to gain privileges in opportunistic circumstances by leveraging a Fast User Switching login...

CVE-2014-4439

CVE-2014-4439 affects Apple Mail on OS X versions prior to 10.10. The issue arises when the removal of a recipient address from a message is not properly recognized, enabling potential information disclosure by reading a message intended for others. Affected: macOS OS X before 10.10. Remediation ...

CVE-2014-4442

The kernel in Apple OS X before 10.10 allows local users to cause a denial of service panic via a message to a system control socket...

CVE-2014-4444

CVE-2014-4444 affects SecurityAgent in Apple OS X before 10.10. The vulnerability occurs because the Kerberos ticket is not guaranteed to be cached for the correct user during Fast User Switching, allowing a local user to gain privileges in opportunistic circumstances. Root cause: improper handli...

CVE-2014-4391

The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows remote attackers to bypass intended app-author restrictions by omitting an execution-related resource...

Apple OS X / OS X Server multiple security vulnerabilities

62 vulnerabilities in different system components...

CVE-2014-7861

The IOHIDSecurePromptClient function in Apple OS X does not properly validate pointer values, which allows remote attackers to execute arbitrary code or cause a denial of service system crash via a crafted web site...

(0Day) Apple OS X IOHIDSecurePromptClient Denial Of Service Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of calls...

CVE-2014-4406

Cross-site scripting XSS vulnerability in Xcode Server in CoreCollaboration in Apple OS X Server before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...