PT-2013-5420

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows local users to obtain sensitive information or cause a denial of service, resulting in an out-of-bounds read and system crash, via a crafted Mach-O file. Recommendations For...

PT-2013-5425

Name of the Vulnerable Software and Affected Versions Libc in Apple Mac OS X versions prior to 10.9 Description The issue concerns the production of predictable values by the srandomdev function in Libc when the kernel random-number generator is unavailable. This predictability can be exploited b...

PT-2013-5424

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows attackers to bypass intended sandbox restrictions. This can be achieved by using a crafted app that utilizes the LaunchServices interface to specify process arguments...

PT-2013-5426

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue concerns the auto-configuration feature in Mail, which selects plaintext authentication for certain servers that support CRAM-MD5 authentication. This allows remote attackers to obtai...

PT-2013-5429

Name of the Vulnerable Software and Affected Versions Mac OS X versions prior to 10.9 Description The issue is related to the kernel's handling of multicast Wi-Fi packets. It does not properly check for errors during the processing of these packets, which can be exploited by remote attackers to...

PT-2013-5431

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue arises from improper handling of the interaction between locking and power assertions in Power Management. This allows physically proximate attackers to obtain sensitive information b...

PT-2013-5428

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows remote attackers to obtain sensitive information by sniffing the network when Kerberos authentication is enabled and TLS is disabled, due to the sending of invalid cleartext...

PT-2013-5434

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows context-dependent attackers to bypass intended access restrictions by leveraging an unintended security configuration after a software update. This occurs because a certain...

PT-2013-5436

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows local users to obtain sensitive information by leveraging access to the Guest account and reading console-log messages from previous Guest sessions. Recommendations For Apple M...

PT-2013-5437

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows local users to cause a denial of service, resulting in a system crash, by sending a request with a crafted port or port number. Recommendations For versions prior to 10.9, upda...

PT-2013-5410

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue is related to the socketfilterfw in Application Firewall, which does not properly implement the --blockApp option. This allows remote attackers to bypass intended access restrictions...

PT-2013-5419

Name of the Vulnerable Software and Affected Versions Mac OS X versions prior to 10.9 Description The issue is caused by an integer signedness error in the kernel, allowing local users to cause a denial of service, resulting in a system crash. This can be achieved via a crafted tty read operation...

PT-2013-5416

Name of the Vulnerable Software and Affected Versions CoreGraphics in Apple Mac OS X versions prior to 10.9 Description The issue allows local users to bypass secure input mode and log an arbitrary application's keystrokes via a hotkey event registration. Recommendations For CoreGraphics in Apple...

CVE-2013-5174: Undefined Security Weakness

Integer signedness error in the kernel in Apple Mac OS X before 10.9 allows local users to cause a denial of service system crash via a crafted tty read operation...

CVE-2013-5175: Improper Input Validation

The kernel in Apple Mac OS X before 10.9 allows local users to obtain sensitive information or cause a denial of service out-of-bounds read and system crash via a crafted Mach-O file...

CVE-2013-5178: Undefined Security Weakness

LaunchServices in Apple Mac OS X before 10.9 does not properly restrict Unicode characters in filenames, which allows context-dependent attackers to spoof file extensions via a crafted character sequence...

CVE-2013-5187: Undefined Security Weakness

The Screen Lock implementation in Apple Mac OS X before 10.9 does not immediately accept Keychain Status menu Lock Screen commands, and instead incorrectly relies on a certain timeout setting, which allows physically proximate attackers to obtain sensitive information by reading a screen that...

CVE-2013-5192: Improper Input Validation

The USB hub controller in Apple Mac OS X before 10.9 allows local users to cause a denial of service system crash via a request with a crafted 1 port or 2 port number...

CVE-2013-5191: Undefined Security Weakness

The syslog implementation in Apple Mac OS X before 10.9 allows local users to obtain sensitive information by leveraging access to the Guest account and reading console-log messages from previous Guest sessions...

CVE-2013-5188: Undefined Security Weakness

The Screen Lock implementation in Apple Mac OS X before 10.9, when hibernation and autologin are enabled, does not require a password for a transition out of hibernation, which allows physically proximate attackers to obtain access by visiting an unattended workstation in the hibernating state...