CVE-2011-3447

CFNetwork in Apple OS X 10.7.x before 10.7.3 is affected. The issue arises when parsing URLs, where request headers may be constructed improperly, potentially allowing a remote attacker to obtain sensitive information via a malformed URL. This CVE (CVE-2011-3447) is associated with OS X Lion/CFNe...

CVE-2011-3450

CVE-2011-3450 affects Apple OS X 10.7.x: CoreUI’s handling of long URLs allows an unbounded stack allocation, enabling remote code execution or a denial of service (memory consumption and crash). Affected component: CoreUI in OS X Lion up to 10.7.2; vulnerability arises from improper restriction ...

CVE-2011-3457

CVE-2011-3457 concerns the OpenGL GLSL shader compilation path in Apple OS X prior to 10.7.3. The issue is described as memory corruption during GLSL shader compilation, which could allow remote code execution or cause a application crash via a crafted program. Public details in connected sources...

CVE-2011-3458

QuickTime in Apple Mac OS X before 10.7.3 does not prevent access to uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted MP4 file...

CVE-2011-3460

Apple QuickTime on Mac OS X before 10.7.3 contains a buffer overflow in PNG image decoding within the MediaVideo handling, allowing remote code execution or application crash when processing a crafted PNG file. This is the vulnerability identified as CVE-2011-3460. Public records corroborate a PN...

CVE-2011-3449

CVE-2011-3449 affects Apple OS X CoreText. Description from connected docs: a use-after-free in CoreText’s handling of embedded fonts can allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded font in a document. The issue is tied ...

CVE-2011-3457

The OpenGL implementation in Apple Mac OS X before 10.7.3 does not properly perform OpenGL Shading Language aka GLSL compilation, which allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted program...

CVE-2011-3453

Integer overflow in libresolv in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption and application crash via crafted DNS data...

CVE-2011-3450

CoreUI in Apple Mac OS X 10.7.x before 10.7.3 does not properly restrict the allocation of stack memory, which allows remote attackers to execute arbitrary code or cause a denial of service memory consumption and application crash via a long URL...

CVE-2011-3452

CVE-2011-3452 affects Apple Mac OS X: Internet Sharing in OS X before 10.7.3 may not preserve Wi‑Fi configuration across software updates, enabling a remote attacker to access sensitive information due to a missing WEP password. The issue is fixed by updating to OS X 10.7.3 or applying Security U...

CVE-2011-3448

Heap-based buffer overflow in CoreMedia in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted movie file with H.264 encoding...

CVE-2011-3462

CVE-2011-3462 affects Time Machine in Apple Mac OS X prior to 10.7.3. The vulnerability is due to OS X not verifying the unique identifier of a remote AFP volume/Time Capsule, allowing a remote attacker to spoof the storage object and access new backups. Connected sources confirm the issue and in...

CVE-2011-3459

Off-by-one error in QuickTime in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted rdrf atom in a movie file that triggers a buffer overflow...

CVE-2011-3446

Apple Type Services ATS in Apple Mac OS X before 10.7.3 does not properly manage memory for data-font files, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted font that is accessed by Font Book...

CVE-2011-3446

Summary: CVE-2011-3446 affects Apple Type Services (ATS) in Mac OS X up to 10.7.3. The vulnerability stems from improper memory management for data-font files, enabling remote code execution or a denial of service when a crafted font is opened by Font Book. Affected product/component: Apple Mac O...

CVE-2011-3444

CVE-2011-3444 affects Apple OS X Address Book prior to 10.7.3. The issue: when an encrypted connection fails, Address Book downgrades to unencrypted sessions, enabling an attacker to read CardDAV data by terminating encryption and sniffing traffic. Public details indicate Apple addressed this in ...

CVE-2011-3459

Apple QuickTime on macOS X before 10.7.3 contains an off-by-one buffer overflow in handling of rdrf atoms within movie files, enabling remote code execution or denial of service. Exploitation requires a crafted file; user interaction may be needed. Apple released fixes in OS X Lion 10.7.3 (and re...

CVE-2011-3453

CVE-2011-3453: Apple Mac OS X libresolv DNS handling overflow. Affected: OS X pre-10.7.3; Apple TV 5.0 update references heap corruption and arbitrary code execution via crafted DNS data. Impact: remote code execution or denial of service; no exploit details provided in the documents. Remediation...

CVE-2011-3444: Undefined Security Weakness

Address Book in Apple Mac OS X before 10.7.3 automatically switches to unencrypted sessions upon failure of encrypted connections, which allows remote attackers to read CardDAV data by terminating an encrypted connection and then sniffing the network...

CVE-2011-3448: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in CoreMedia in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted movie file with H.264 encoding...