CVE-2013-0990

SMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated users to create or modify files outside of a shared directory via unspecified vectors...

CVE-2013-0982

The Private Browsing feature in CFNetwork in Apple Mac OS X before 10.8.4 does not prevent storage of permanent cookies upon exit from Safari, which might allow physically proximate attackers to bypass cookie-based authentication by leveraging an unattended workstation...

CVE-2013-0984

Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service daemon crash via a crafted message...

CVE-2013-0985

Disk Management in Apple Mac OS X before 10.8.4 does not properly authenticate attempts to disable FileVault, which allows local users to cause a denial of service loss of encryption functionality via an unspecified command line...

CVE-2013-1024

CoreMedia Playback in Apple Mac OS X before 10.8.4 does not properly initialize memory during the processing of text tracks, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted movie file...

CVE-2013-1024

CVE-2013-1024 is a memory‑initialization flaw in CoreMedia Playback for Mac OS X before 10.8.4, triggered by processing text tracks in a crafted movie file, allowing remote code execution or a denial of service. Related advisories reference Apple HT5784/HT6001, but the provided documents do not s...

CVE-2013-3951

CVE-2013-3951 affects Apple iOS 6.1.3 and Mac OS X 10.8.x. Kernel/XNU stack cookies could be bypassed due to improper generation/parsing of user-space stack cookies, allowing local attackers to bypass cookie randomization via a stack-guard= path. Exploitation is described in the kernel context as...

CVE-2013-0982

CVE-2013-0982 concerns the Private Browsing feature in CFNetwork on macOS OS X versions prior to 10.8.4. The issue: permanent cookies can be stored after quitting Safari, potentially allowing a physically proximate attacker with an unattended workstation to bypass cookie-based authentication. Aff...

CVE-2013-0984

Apple Mac OS X Directory Service vulnerability (CVE-2013-0984) affects Mac OS X up to 10.6.8. A remote attacker can send a crafted Directory Service message to trigger a memory corruption (buffer overflow) in the directory service, leading to arbitrary code execution or a daemon crash. This is a ...

CVE-2013-0985

CVE-2013-0985 affects Apple Mac OS X prior to 10.8.4 where Disk Management does not properly authenticate attempts to disable FileVault. This allows a local user to cause a denial of service (loss of encryption functionality) via an unspecified command line. Documents show the issue is addressed ...

CVE-2013-0983

CVE-2013-0983: A stack consumption vulnerability in CoreAnimation on macOS OS X

CVE-2013-3952

The fillpipeinfo function in bsd/kern/syspipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protection mechanism via the PROCPIDFDPIPEINFO option to the procinfo system call for a kernel pipe handle...

CVE-2013-3949

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of the POSIXSPAWNDISABLEASLR and POSIXSPAWNALLOWDATAEXEC flags for setuid and setgid programs, which allows local users to bypass intended access restrictions via a wrapper program that calls the...

CVE-2013-3953

CVE-2013-3953 concerns the XNU kernel on macOS, where the mach_port_space_info API in osfmk/ipc/mach_debug.c does not initialize a structure member. This causes information disclosure from kernel heap memory via a crafted call on affected systems (OS X 10.8.x). Connected documents confirm the ker...

CVE-2013-3951

sys/openbsd/stackprotector.c in libc in Apple iOS 6.1.3 and Mac OS X 10.8.x does not properly parse the Apple strings employed in the user-space stack-cookie implementation, which allows local users to bypass cookie randomization by executing a program with a call-path beginning with the...

CVE-2013-3954

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions, which allows local users to 1 cause a denial of service panic via a size value that is inconsistent with a header count field, or 2 obtain sensitive...

CVE-2013-3952

The CVE affects Apple Mac OS X 10.8.x, specifically the XNU kernel’s fill_pipeinfo in bsd/kern/sys_pipe.c. The vulnerability allows local users to defeat KASLR by abusing the PROC_PIDFDPIPEINFO option to the proc_info system call on a kernel pipe handle. Potential impact is exposure of kernel add...

CVE-2013-3954

CVE-2013-3954 affects Apple OS X/macOS kernels (e.g., OS X 10.8.x) where the posix_spawn API arguments to file/port actions are not properly validated. The underlying cause is insufficient bounds checking on data for file actions and port actions, enabling a local attacker to trigger a panic (DoS...

CVE-2013-0990

CVE-2013-0990 affects Apple Mac OS X before 10.8.4 when SMB file sharing is enabled. An authenticated remote user may write or modify files outside the shared directory via unspecified vectors due to SMB access control weaknesses. The issue is documented across multiple sources (NVD/NVD 2013-0990...

CVE-2013-0975

Apple Mac OS X QuickDraw Manager is affected by a buffer overflow in handling PICT images, allowing remote code execution or application crash. The vulnerability exists in OS X versions before 10.8.4 and is triggered by a crafted PICT image. Apple addressed this in OS X 10.8.4 and Security Update...