CVE-2016-4755

Terminal in Apple OS X before 10.12 uses weak permissions for the .bashhistory and .bashsession files, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2016-4742

NSSecureTextField in Apple OS X before 10.12 does not enable Secure Input, which allows attackers to discover credentials via a crafted app...

CVE-2016-4775

The kernel in Apple OS X before 10.12, tvOS before 10, and watchOS before 3 allows local users to gain privileges or cause a denial of service memory corruption via unspecified vectors...

CVE-2016-4755

CVE-2016-4755 : In macOS before 10.12, Terminal uses weak permissions on .bash_history and .bash_session, allowing a local attacker to disclose sensitive information. The related Apple security content confirms inclusion of this CVE in macOS Sierra 10.12 security updates. Affected product: OS X/m...

CVE-2016-4713

CoreDisplay in Apple OS X before 10.12 allows attackers to view arbitrary users' screens by leveraging screen-sharing access...

CVE-2016-4779

Apple Type Services ATS in Apple OS X before 10.12 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted font file...

CVE-2016-4703

Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-4701

CVE-2016-4701 concerns the macOS OS X Application Firewall prior to 10.12. The vulnerability allows a local user to cause a denial of service via a crafted SO_EXECPATH environment variable, affecting the Application Firewall component. The Apple security content (macOS Sierra 10.12) lists the iss...

CVE-2016-4699

AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app, a different vulnerability than CVE-2016-4700...

CVE-2016-4696

AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service NULL pointer dereference via a crafted app...

CVE-2016-4709

WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4710...

CVE-2016-4727

IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-4703

CVE-2016-4703 : In Apple OS X prior to 10.12, Bluetooth contains a memory corruption vulnerability. A crafted app could allow an attacker to execute arbitrary code in a privileged (kernel) context or cause a denial of service. The NVD entry and Apple advisory confirm the vulnerability and the ker...

CVE-2016-4701

Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SOEXECPATH environment variable...

CVE-2016-4709

CVE-2016-4709 is a local privilege-escalation vulnerability in WindowServer on Apple OS X/macOS prior to 10.12. The root cause is a type-confusion issue in CoreGraphics handling that allows a local attacker to obtain root privileges. Connected advisories (ZDI-16-608/16-609) describe the same Wind...

CVE-2016-4723

Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-4742

CVE-2016-4742 describes a vulnerability in NSSecureTextField on Apple OS X prior to 10.12: Secure Input was not enabled due to a state management issue, potentially allowing a crafted application to reveal credentials. The issue is listed in the macOS Sierra 10.12 security content, with fixes des...

CVE-2016-4694

CVE-2016-4694 (httpoxy) affects Apache httpd on Apple OS X prior to 10.12/OS X Server prior to 5.2, where untrusted CGI client data in the HTTP_PROXY environment variable could redirect outbound traffic to an arbitrary proxy via a crafted Proxy header. The connected Apple security content shows A...

CVE-2016-4745

The CVE-2016-4745 entry concerns the Kerberos 5 PAM module in Apple OS X prior to 10.12. The issue is that the PAM module does not use constant-time operations when determining username validity, enabling a timing side-channel that remote attackers could exploit to enumerate user accounts. The as...

CVE-2016-4752

CVE-2016-4752 affects Apple OS X pre-10.12. The issue is in the SecKeyDeriveFromPassword function, where the CF_RETURNS_RETAINED keyword was not used, enabling memory handling that may allow memory content to be leaked or exposed during key derivation. The connected Apple security content confirm...