PT-2013-5436

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows local users to obtain sensitive information by leveraging access to the Guest account and reading console-log messages from previous Guest sessions. Recommendations For Apple M...

PT-2013-5425

Name of the Vulnerable Software and Affected Versions Libc in Apple Mac OS X versions prior to 10.9 Description The issue concerns the production of predictable values by the srandomdev function in Libc when the kernel random-number generator is unavailable. This predictability can be exploited b...

PT-2013-5433

Name of the Vulnerable Software and Affected Versions Mac OS X versions prior to 10.9 Description The issue concerns the Screen Lock implementation, which fails to require a password when transitioning out of hibernation, allowing physically proximate attackers to gain access to an unattended...

PT-2013-5428

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows remote attackers to obtain sensitive information by sniffing the network when Kerberos authentication is enabled and TLS is disabled, due to the sending of invalid cleartext...

PT-2013-5412

Name of the Vulnerable Software and Affected Versions CFNetwork in Apple Mac OS X versions prior to 10.9 Description The issue concerns CFNetwork in Apple Mac OS X, where it does not properly handle the deletion of session cookies when a reset operation is performed in Safari. This makes it easie...

PT-2013-5410

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue is related to the socketfilterfw in Application Firewall, which does not properly implement the --blockApp option. This allows remote attackers to bypass intended access restrictions...

Mac OS X : OS X Server < 3.0 Multiple Vulnerabilities

The remote Mac OS X host has a version of OS X Server installed that is prior to 3.0. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the included JSON Ruby Gem, which can be abused to exhaust all available memory resources. CVE-2013-026...

PT-2013-5419

Name of the Vulnerable Software and Affected Versions Mac OS X versions prior to 10.9 Description The issue is caused by an integer signedness error in the kernel, allowing local users to cause a denial of service, resulting in a system crash. This can be achieved via a crafted tty read operation...

PT-2013-5431

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue arises from improper handling of the interaction between locking and power assertions in Power Management. This allows physically proximate attackers to obtain sensitive information b...

PT-2013-5417

Name of the Vulnerable Software and Affected Versions Mac OS X versions prior to 10.9 Description The issue is related to the kernel in Mac OS X, which does not properly determine the output length for SHA-2 digest function calls. This allows attackers to cause a denial of service panic by...

CVE-2013-5192: Improper Input Validation

The USB hub controller in Apple Mac OS X before 10.9 allows local users to cause a denial of service system crash via a request with a crafted 1 port or 2 port number...

CVE-2013-5188: Undefined Security Weakness

The Screen Lock implementation in Apple Mac OS X before 10.9, when hibernation and autologin are enabled, does not require a password for a transition out of hibernation, which allows physically proximate attackers to obtain access by visiting an unattended workstation in the hibernating state...

PT-2013-5434

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows context-dependent attackers to bypass intended access restrictions by leveraging an unintended security configuration after a software update. This occurs because a certain...

CVE-2013-5181: Undefined Security Weakness

The auto-configuration feature in Mail in Apple Mac OS X before 10.9 selects plaintext authentication for unspecified servers that support CRAM-MD5 authentication, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2013-5189: Undefined Security Weakness

Apple Mac OS X before 10.9 does not preserve a certain administrative system-preferences setting across software updates, which allows context-dependent attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended security configuration after the...

CVE-2013-5167: Undefined Security Weakness

CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers...

CVE-2013-5165: Undefined Security Weakness

socketfilterfw in Application Firewall in Apple Mac OS X before 10.9 does not properly implement the --blockApp option, which allows remote attackers to bypass intended access restrictions via a network connection to an application for which blocking was configured...

CVE-2013-5184: Undefined Security Weakness

The kernel in Apple Mac OS X before 10.9 does not properly check for errors during the processing of multicast Wi-Fi packets, which allows remote attackers to cause a denial of service system crash by leveraging presence in an 802.11 network's coverage area...

CVE-2013-5170: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer underflow in CoreGraphics in Apple Mac OS X before 10.9 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted PDF document...

CVE-2013-5190: Undefined Security Weakness

Smart Card Services in Apple Mac OS X before 10.9 does not properly implement certificate-revocation checks, which allows remote attackers to cause a denial of service Smart Card usage outage by interfering with the revocation-check procedure...