CVE-2013-3953

The machportspaceinfo function in osfmk/ipc/machdebug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted call...

CVE-2013-3949

The CVE-2013-3949 entry concerns the XNU kernel used in Apple Mac OS X 10.8.x. The issue arises in the posix_spawn system call, which does not prevent the use of _POSIX_SPAWN_DISABLE_ASLR and _POSIX_SPAWN_ALLOW_DATA_EXEC flags for setuid/setgid programs. This enables local users to bypass intende...

CVE-2013-0983

Stack consumption vulnerability in CoreAnimation in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted text glyph in a URL encountered by Safari...

PT-2013-2767

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.8.4 Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted PICT image. This is due to a buffer overflow in the QuickDraw Manager. Recommendations F...

PT-2013-2774

Name of the Vulnerable Software and Affected Versions Mac OS X versions prior to 10.8.4 Description The issue concerns the Private Browsing feature in CFNetwork, which fails to prevent the storage of permanent cookies when exiting Safari. This could allow physically proximate attackers to bypass...

CVE-2013-0985: Improper Authentication

Disk Management in Apple Mac OS X before 10.8.4 does not properly authenticate attempts to disable FileVault, which allows local users to cause a denial of service loss of encryption functionality via an unspecified command line...

CVE-2013-0982: Exposure of Sensitive Information to an Unauthorized Actor

The Private Browsing feature in CFNetwork in Apple Mac OS X before 10.8.4 does not prevent storage of permanent cookies upon exit from Safari, which might allow physically proximate attackers to bypass cookie-based authentication by leveraging an unattended workstation...

Mac OSX Server DirectoryService Buffer Overflow

A memory corruption vulnerability was found in Mac OSX Directory Service. By sending a maliciously crafted message, a remote attacker could cause the directory server to terminate or execute arbitrary code with system privileges. The issue existed in the directory server's handling of messages fr...

PT-2013-4756

Name of the Vulnerable Software and Affected Versions libc in Apple iOS versions 6.1.3 libc in Apple Mac OS X versions 10.8.x Description The issue allows local users to bypass cookie randomization by executing a program with a call-path beginning with the stack-guard= substring. This can be...

PT-2013-2775

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.8.4 Description A stack consumption issue in CoreAnimation allows remote attackers to execute arbitrary code or cause a denial of service, resulting in an application crash, via a crafted text glyph in a URL...

PT-2013-2776

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions through 10.6.8 Description The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in a daemon crash, via a crafted message. Recommendations For Apple Mac OS X versions throug...

PT-2013-4758

Name of the Vulnerable Software and Affected Versions Apple Mac OS X version 10.8.x Description The issue concerns the mach port space info function in the XNU kernel, which fails to initialize a certain structure member. This allows local users to obtain sensitive information from kernel heap...

Apple Mac OSX Server - DirectoryService Buffer Overflow

Apple Mac OSX Server - DirectoryService Buffer Overflow Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Mac OSX Server DirectoryService buffer overflow 1. Advisory Information Title: Mac OSX Server DirectoryService buffer overflow Advisory ID: CORE-2013-0103 Advisory URL:...

Apple Mac OS X Directory Service buffer overflow

Buffer overflow on response parsing...

CVE-2013-3951: Improper Input Validation

sys/openbsd/stackprotector.c in libc in Apple iOS 6.1.3 and Mac OS X 10.8.x does not properly parse the Apple strings employed in the user-space stack-cookie implementation, which allows local users to bypass cookie randomization by executing a program with a call-path beginning with the...

Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)

Binary data 801016.prm...

Mac OS X 10.8.x < 10.8.4 Multiple Vulnerabilities

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.4. The newer version contains multiple security-related fixes for the following components : - CFNetwork - CoreAnimation - CoreMedia Playback - CUPS - Disk Management - OpenSSL - QuickDraw Manager - QuickTime - SMB C...

Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)

Binary data 6857.prm...

PT-2013-2782

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.8.4 Description The issue allows remote authenticated users to create or modify files outside of a shared directory when file sharing is enabled. Recommendations For Apple Mac OS X versions prior to 10.8.4,...

CVE-2013-3953: Exposure of Sensitive Information to an Unauthorized Actor

The machportspaceinfo function in osfmk/ipc/machdebug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted call...