15329 matches found
CVE-2013-0966
The Apple modhfsapple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI...
CVE-2013-0969
Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which allows physically proximate attackers to bypass authentication and make arbitrary System Preferences changes via unspecified use of the keyboard...
Design/Logic Flaw
Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via crafted ink annotations in a PDF document...
Memory corruption
IOAcceleratorFamily in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted graphics image...
Authentication flaw
Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which allows physically proximate attackers to bypass authentication and make arbitrary System Preferences changes via unspecified use of the keyboard...
Design/Logic Flaw
Messages in Apple Mac OS X before 10.8.3 allows remote attackers to bypass the FaceTime call-confirmation prompt via a crafted FaceTime: URL...
Design/Logic Flaw
CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site...
Code injection
Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView, which allows man-in-the-middle attackers to execute plugin code by modifying the client-server data stream...
CVE-2013-0969
The CVE-2013-0969 issue affects Apple Mac OS X Mountain Lion prior to 10.8.3, where Login Window with VoiceOver could be abused to bypass authentication and modify System Preferences. Public docs consistently describe this vulnerability as tied to VoiceOver launching applications at Login Window,...
CVE-2013-0973
Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView, which allows man-in-the-middle attackers to execute plugin code by modifying the client-server data stream...
CVE-2013-0966
The Apple modhfsapple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI...
CVE-2013-0967
CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site...
CVE-2013-0967
CoreTypes in Apple Mac OS X before 10.8.3 allowed JNLP files to be treated as safe, bypassing a Java plug‑in disabled setting and triggering Java Web Start applications via a crafted website. Affected product/version: Mac OS X up to 10.8.2 (and OS X Mountain Lion era updates). Root cause: JNLP fi...
CVE-2013-0971
Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via crafted ink annotations in a PDF document...
CVE-2013-0966
CVE-2013-0966 affects Apple’s mod_hfs_apple module for the Apache HTTP Server on Mac OS X prior to 10.8.3. The root cause is improper handling of ignorable Unicode characters in URIs, enabling a remote attacker to bypass the intended HTTP authentication by crafting a URI pathname. Public details ...
CVE-2013-0970
Apple Mac OS X through 10.8.2 is vulnerable in Messages to bypassing the FaceTime call-confirmation prompt when a specially crafted FaceTime: URL is processed; CVE-2013-0970. Affected component is the Messages/FaceTime URL handling. Impact is bypass of user confirmation to initiate FaceTime calls...
CVE-2013-0976
CVE-2013-0976 is an Apple Mac OS X vulnerability in the IOAcceleratorFamily, affecting Mountain Lion 10.8.x prior to 10.8.3. The issue allows remote attackers to execute arbitrary code or cause a denial of service through a crafted graphics image, due to a memory corruption/bounds checking flaw i...
CVE-2013-0971
CVE-2013-0971 is a use-after-free vulnerability in Apple Mac OS X PDFKit prior to 10.8.3. An attacker can trigger memory corruption via crafted ink annotations in a PDF, leading to arbitrary code execution or an application crash (DoS). Public references describe the affected component as PDFKit ...
CVE-2013-0973
Apple Mac OS X up to 10.7.5 is affected by CVE-2013-0973, where the marketing-text WebView could load plugins, enabling MITM attackers to run plugin code by modifying the data stream. The issue was addressed in the 2013-001 security update for OS X (and related Mountain Lion changes noted in the ...