CVE-2013-3952

The fillpipeinfo function in bsd/kern/syspipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protection mechanism via the PROCPIDFDPIPEINFO option to the procinfo system call for a kernel pipe handle...

Design/Logic Flaw

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of the POSIXSPAWNDISABLEASLR and POSIXSPAWNALLOWDATAEXEC flags for setuid and setgid programs, which allows local users to bypass intended access restrictions via a wrapper program that calls the...

Memory corruption

The getxattrinfo function in the XNU kernel in Apple iOS 5.x and 6.x through 6.1.3 on iPad devices does not properly validate the header of an AppleDouble file, which might allow local users to cause a denial of service memory corruption or have unspecified other impact via an invalid file on an...

Design/Logic Flaw

The machportspaceinfo function in osfmk/ipc/machdebug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted call...

Design/Logic Flaw

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions, which allows local users to 1 cause a denial of service panic via a size value that is inconsistent with a header count field, or 2 obtain sensitive...

CVE-2013-3949

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of the POSIXSPAWNDISABLEASLR and POSIXSPAWNALLOWDATAEXEC flags for setuid and setgid programs, which allows local users to bypass intended access restrictions via a wrapper program that calls the...

CVE-2013-3954

CVE-2013-3954 affects Apple OS X/macOS kernels (e.g., OS X 10.8.x) where the posix_spawn API arguments to file/port actions are not properly validated. The underlying cause is insufficient bounds checking on data for file actions and port actions, enabling a local attacker to trigger a panic (DoS...

CVE-2013-3953

The machportspaceinfo function in osfmk/ipc/machdebug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted call...

CVE-2013-3952

The CVE affects Apple Mac OS X 10.8.x, specifically the XNU kernel’s fill_pipeinfo in bsd/kern/sys_pipe.c. The vulnerability allows local users to defeat KASLR by abusing the PROC_PIDFDPIPEINFO option to the proc_info system call on a kernel pipe handle. Potential impact is exposure of kernel add...

CVE-2013-3955

The CVE-2013-3955 issue affects Apple iOS XNU kernel (iOS 5.x–6.x up to 6.1.3 on iPad). It stems from get_xattrinfo failing to validate the AppleDouble file header, enabling a local attacker to trigger memory corruption (DoS) or other impact via an invalid AppleDouble file on msdosfs. The vulnera...

CVE-2013-3952

The fillpipeinfo function in bsd/kern/syspipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protection mechanism via the PROCPIDFDPIPEINFO option to the procinfo system call for a kernel pipe handle...

CVE-2013-3955

The getxattrinfo function in the XNU kernel in Apple iOS 5.x and 6.x through 6.1.3 on iPad devices does not properly validate the header of an AppleDouble file, which might allow local users to cause a denial of service memory corruption or have unspecified other impact via an invalid file on an...

CVE-2013-3949

The CVE-2013-3949 entry concerns the XNU kernel used in Apple Mac OS X 10.8.x. The issue arises in the posix_spawn system call, which does not prevent the use of _POSIX_SPAWN_DISABLE_ASLR and _POSIX_SPAWN_ALLOW_DATA_EXEC flags for setuid/setgid programs. This enables local users to bypass intende...

CVE-2013-3953

CVE-2013-3953 concerns the XNU kernel on macOS, where the mach_port_space_info API in osfmk/ipc/mach_debug.c does not initialize a structure member. This causes information disclosure from kernel heap memory via a crafted call on affected systems (OS X 10.8.x). Connected documents confirm the ker...

Apple Mac OS X IPv6 PIM Denial of Service Vulnerability

This vulnerability allows remote attackers to denial of service the IPv6 stack of an installation of Apple Mac OSX. No authentication or user interaction is required in order to exploit this vulnerability. The specific flaw exists within OSX's IPv6 stack. A NULL pointer dereference vulnerability...

iDefense Security Advisory 05.14.09: Apple Mac OS X xnu Kernel workqueue_additem/workqueue_removeitem Index Validation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 05.12.09 http://labs.idefense.com/intelligence/vulnerabilities/ May 12, 2009 I. BACKGROUND Mac OS X is a computer operating systems available from Apple Inc. OS X is the tenth major version of Apple's operating system for...

Design/Logic Flaw

Array index error in the xnu Mach kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service system shutdown via unspecified vectors related to workqueues...

CVE-2008-1517

Array index error in the xnu Mach kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service system shutdown via unspecified vectors related to workqueues...

CVE-2008-1517

CVE-2008-1517 affects Mac OS X 10.5.x (xnu/Mach kernel) where an unchecked index in the workqueue handling can be exploited locally to obtain privileges or trigger a denial of service (system shutdown). The issue is described as an index validation vulnerability in the kernel’s workqueues, with t...

CVE-2007-6359

The csvalidatepage function in bsd/kern/ubcsubr.c in the xnu kernel 1228.0 and earlier in Apple Mac OS X 10.5.1 allows local users to cause a denial of service failed assertion and system crash via a crafted signed Mach-O binary that causes the hashes function to return NULL...