CVE-2011-3218

The "Save for Web" selection in QuickTime Player in Apple Mac OS X through 10.6.8 exports HTML documents that contain an http link to a script file, which allows man-in-the-middle attackers to conduct cross-site scripting XSS attacks by spoofing the http server during local viewing of an exported...

CVE-2011-3227

CVE-2011-3227 affects macOS X before 10.7.2, specifically the libsecurity component. The issue arises from improper error handling when processing a nonstandard CRL extension, which can allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted...

CVE-2011-3227

libsecurity in Apple Mac OS X before 10.7.2 does not properly handle errors during processing of a nonstandard extension in a Certificate Revocation list CRL, which allows remote attackers to execute arbitrary code or cause a denial of service application crash a crafted 1 web site or 2 e-mail...

CVE-2011-3215

The kernel in Apple Mac OS X before 10.7.2 does not properly prevent FireWire DMA in the absence of a login, which allows physically proximate attackers to bypass intended access restrictions and discover a password by making a DMA request in the 1 loginwindow, 2 boot, or 3 shutdown state...

CVE-2011-0229

Apple Type Services (ATS) in OS X up to 10.6.8 is affected by CVE-2011-0229 due to an out-of-bounds memory access when handling embedded Type 1 fonts, enabling remote code execution via a crafted document. Apple’s advisory for Security Update 2011-006 (and related Lion updates) remedies this by u...

CVE-2011-3212

CVE-2011-3212 affects Apple Mac OS X 10.7 prior to 10.7.2, where CoreStorage during FileVault enablement may not encrypt all disk data, enabling physically proximate attackers to read sensitive data from the disk. The description does not specify a fixed remediation in the provided documents; upg...

CVE-2011-3226

Open Directory in Apple Mac OS X 10.7 before 10.7.2, when an LDAPv3 server is used with RFC 2307 or custom mappings, allows remote attackers to bypass the password requirement by leveraging lack of an AuthenticationAuthority attribute for a user account...

CVE-2011-0231

CFNetwork in Apple Mac OS X before 10.7.2 does not properly follow an intended cookie-storage policy, which makes it easier for remote web servers to track users via a cookie, related to a "synchronization issue."...

CVE-2011-0185

The CVE-2011-0185 entry concerns a format-string vulnerability in the Application Firewall’s debug-logging feature on Apple Mac OS X prior to 10.7.2, allowing local privilege escalation via a crafted executable name. Affected product: Mac OS X (Application Firewall). Root cause: format string iss...

CVE-2011-3223

CVE-2011-3223 affects Apple QuickTime. The vulnerability resides in QuickTime’s FLIC/FLIC movie decoding, specifically the FLC RLE packet handling, where an out-of-bounds write during decompression can lead to remote code execution. Exploitation requires the user to view a malicious file or page,...

CVE-2011-3228

CVE-2011-3228 is part of Apple QuickTime multiple vulnerabilities affecting QuickTime in Windows and macOS. The vulnerability arises from memory corruption in QuickTime’s handling of movie files, leading to remote code execution or a crash. In macOS, affected versions include OS X prior to 10.7.2...

CVE-2011-3228

QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted movie file...

CVE-2011-3242

The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie...

CVE-2011-3242

The CVE-2011-3242 issue affects Apple Safari

CVE-2011-3214

IOGraphics in Apple Mac OS X through 10.6.8 does not properly handle a locked-screen state in display sleep mode for an Apple Cinema Display, which allows physically proximate attackers to bypass the password requirement via unspecified vectors...

CVE-2011-3214

CVE-2011-3214: IOGraphics in Apple Mac OS X up to 10.6.8 exposes a locked-screen bypass when an Apple Cinema Display is in display sleep. A physically proximate attacker could bypass the password requirement. Apple issued a security update (Security Update 2011-006 / OS X 10.7.2) addressing the l...

CVE-2011-3436

CVE-2011-3436 affects Open Directory on OS X Lion (10.7 and 10.7.1). A password-change access-control flaw allows an unauthenticated bypass where a user can change another account’s password without providing the current one, exploitable via an unattended workstation. The issue is documented in A...

CVE-2011-3225

CVE-2011-3225 affects Apple Mac OS X 10.7 (Lion) SMB File Server. Before 10.7.2, guest users could access the share point record of a guest-restricted folder via the nobody account, bypassing browsing restrictions. Apple fixed this in OS X v10.7.2 / Security Update 2011-006 by applying appropriat...

CVE-2011-3217

CVE-2011-3217 affects MediaKit in Apple Mac OS X through 10.6.8. A crafted disk image can trigger remote arbitrary code execution or memory corruption leading to application crash. Apple’s bundled bulletin for Security Update 2011-006 (and OS X 10.7.2) remediates MediaKit among other components. ...

CVE-2011-3437

CVE-2011-3437 affects Apple OS X 10.7 prior to 10.7.2, caused by an ATS (Apple Type Services) signedness error in handling Type 1 fonts. A crafted embedded Type 1 font in a document can lead to remote arbitrary code execution. The vulnerability impact is described as arbitrary code execution with...