CVE-2013-5167

CVE-2013-5167 concerns CFNetwork in Apple Mac OS X pre-10.9 where Safari’s deletion of session cookies is not properly handled during a reset, enabling remote servers to track users via Set-Cookie headers. Affected: CFNetwork on macOS before 10.9. Root cause: improper cookie deletion handling in ...

CVE-2013-5170

CVE-2013-5170 affects Apple Mac OS X prior to 10.9, due to a buffer underflow in CoreGraphics when processing PDFs. This can allow remote attackers to execute arbitrary code or cause an application crash by delivering a crafted PDF. No remediation details are provided in the supplied documents. T...

CVE-2013-5171

CVE-2013-5171 affects Apple Mac OS X prior to 10.9. The vulnerability is in CoreGraphics and allows local users to bypass Secure Input Mode and log keystrokes for arbitrary applications through a hotkey event registration. The issue is documented in multiple sources (e.g., Red Hat, NVD) with the ...

CVE-2013-5175

The CVE-2013-5175 issue affects the Apple Mac OS X kernel prior to 10.9. A crafted Mach-O file allows local users to perform an out-of-bounds read that can reveal sensitive information or cause a system crash (DoS). Impact is limited to local privilege context and does not specify remote/exploit ...

CVE-2013-5179

The CVE-2013-5179 entry concerns Apple Mac OS X sandbox bypass vulnerabilities described in the NVD entry: App Sandbox in OS X before 10.9 can be bypassed when a crafted app uses LaunchServices to specify process arguments, enabling sandbox evasion. Connected sources confirm the issue is tied to ...

CVE-2013-5180

The CVE-2013-5180 entry concerns the srandomdev function in Libc on Apple Mac OS X prior to 10.9. When the kernel random-number generator is unavailable, srandomdev produces predictable values instead of true randomness, which can help context-dependent attackers defeat cryptographic protections....

CVE-2013-5181

Apple Mac OS X Mail’s auto-configuration (pre-10.9) may select plaintext authentication for servers that support CRAM-MD5, enabling remote sniffing of credentials. Affected: OS X Mail before 10.9. Root cause: plaintext auth chosen during auto-config. Impact: potential exposure of sensitive inform...

CVE-2013-5183

CVE-2013-5183 affects Apple macOS X before 10.9. When Kerberos authentication is enabled and TLS is disabled, Mail sends invalid cleartext data, allowing an attacker who can sniff network traffic to obtain sensitive information. Official entries in multiple sources (NVD/Red Hat) repeat this descr...

CVE-2013-5184

CVE-2013-5184 affects Apple Mac OS X kernels prior to 10.9. The issue is an improper error check when processing multicast Wi‑Fi packets, enabling remote attackers in an 802.11 network’s coverage area to trigger a denial of service (system crash). Public details in the provided documents are limi...

CVE-2013-5185

CVE-2013-5185 affects Apple Mac OS X prior to 10.9, where the ldapsearch utility in OpenLDAP does not correctly process the minssf setting, enabling remote attackers to sniff network traffic and obtain sensitive data via weak encryption. Public references from NVD/Red Hat/OS X security notices co...

CVE-2013-5188

The CVE-2013-5188 entry concerns Apple macOS X before 10.9 where, when hibernation and autologin are enabled, the Screen Lock transition out of hibernation does not require a password. This enables physically proximate attackers to gain access by visiting an unattended workstation in a hibernatin...

CVE-2013-5189

CVE-2013-5189 describes an issue in Apple Mac OS X before 10.9 where an administrative system-preferences setting is not preserved across software updates. The root cause is the failure to maintain that setting after an update, which can allow context-dependent attackers to bypass intended access...

CVE-2013-5191

The CVE-2013-5191 entry describes a local-information-disclosure vulnerability in the syslog implementation of Apple Mac OS X before 10.9. An attacker with access to the Guest account could read console-log messages from previous Guest sessions, revealing sensitive information. The Red Hat entry ...

CVE-2013-5192

CVE-2013-5192 affects Apple Mac OS X before 10.9. The USB hub controller is susceptible to a denial of service (system crash) when a crafted request targets (1) a port or (2) a port number. This description is consistent across multiple sources (NVD/Red Hat cve page); no public details on the und...

CVE-2013-5174

Integer signedness error in the kernel in Apple Mac OS X before 10.9 allows local users to cause a denial of service system crash via a crafted tty read operation...

CVE-2013-5174

CVE-2013-5174 affects the Apple Mac OS X kernel prior to 10.9. The issue is an integer signedness error in the kernel’s handling of a crafted tty read operation, enabling a local user to trigger a denial of service (system crash) . Root cause is the signedness bug in the kernel code. Public refer...

CVE-2013-5186

Power Management in Apple Mac OS X before 10.9 does not properly handle the interaction between locking and power assertions, which allows physically proximate attackers to obtain sensitive information by reading a screen that should have transitioned into the locked state...

CVE-2013-5135

CVE-2013-5135 targets Apple Mac OS X prior to 10.9 and Apple Remote Desktop prior to 3.5.4. The issue is a format string vulnerability in Screen Sharing Server that permits remote code execution via format string specifiers in a VNC username. Impact is remote execution of arbitrary code with netw...

CVE-2013-5165

CVE-2013-5165 concerns Mac OS X before 10.9, where the Application Firewall’s socketfilterfw fails to properly implement the --blockApp option. This allows remote attackers to bypass intended access restrictions by initiating a network connection to an application for which blocking has been conf...

CVE-2013-5176

CVE-2013-5176 affects Apple Mac OS X kernels prior to 10.9. The issue is in handling integer values during unspecified tty device operations, enabling a local attacker to trigger a truncation error that can cause a system hang (denial of service). The available connected sources reiterate the sam...