CVE-2013-0971

Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via crafted ink annotations in a PDF document...

CVE-2013-0969

Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which allows physically proximate attackers to bypass authentication and make arbitrary System Preferences changes via unspecified use of the keyboard...

CVE-2013-0966

The Apple modhfsapple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI...

CVE-2013-0970

Messages in Apple Mac OS X before 10.8.3 allows remote attackers to bypass the FaceTime call-confirmation prompt via a crafted FaceTime: URL...

Memory corruption

IOAcceleratorFamily in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted graphics image...

Code injection

Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView, which allows man-in-the-middle attackers to execute plugin code by modifying the client-server data stream...

Design/Logic Flaw

Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via crafted ink annotations in a PDF document...

Design/Logic Flaw

Messages in Apple Mac OS X before 10.8.3 allows remote attackers to bypass the FaceTime call-confirmation prompt via a crafted FaceTime: URL...

Authentication flaw

Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which allows physically proximate attackers to bypass authentication and make arbitrary System Preferences changes via unspecified use of the keyboard...

Design/Logic Flaw

CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site...

CVE-2013-0970

Messages in Apple Mac OS X before 10.8.3 allows remote attackers to bypass the FaceTime call-confirmation prompt via a crafted FaceTime: URL...

CVE-2013-0976

CVE-2013-0976 is an Apple Mac OS X vulnerability in the IOAcceleratorFamily, affecting Mountain Lion 10.8.x prior to 10.8.3. The issue allows remote attackers to execute arbitrary code or cause a denial of service through a crafted graphics image, due to a memory corruption/bounds checking flaw i...

CVE-2013-0966

CVE-2013-0966 affects Apple’s mod_hfs_apple module for the Apache HTTP Server on Mac OS X prior to 10.8.3. The root cause is improper handling of ignorable Unicode characters in URIs, enabling a remote attacker to bypass the intended HTTP authentication by crafting a URI pathname. Public details ...

CVE-2013-0969

The CVE-2013-0969 issue affects Apple Mac OS X Mountain Lion prior to 10.8.3, where Login Window with VoiceOver could be abused to bypass authentication and modify System Preferences. Public docs consistently describe this vulnerability as tied to VoiceOver launching applications at Login Window,...

CVE-2013-0973

Apple Mac OS X up to 10.7.5 is affected by CVE-2013-0973, where the marketing-text WebView could load plugins, enabling MITM attackers to run plugin code by modifying the data stream. The issue was addressed in the 2013-001 security update for OS X (and related Mountain Lion changes noted in the ...

CVE-2013-0973

Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView, which allows man-in-the-middle attackers to execute plugin code by modifying the client-server data stream...

CVE-2013-0971

Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service application crash via crafted ink annotations in a PDF document...

CVE-2013-0971

CVE-2013-0971 is a use-after-free vulnerability in Apple Mac OS X PDFKit prior to 10.8.3. An attacker can trigger memory corruption via crafted ink annotations in a PDF, leading to arbitrary code execution or an application crash (DoS). Public references describe the affected component as PDFKit ...

CVE-2013-0967

CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site...

CVE-2013-0967

CoreTypes in Apple Mac OS X before 10.8.3 allowed JNLP files to be treated as safe, bypassing a Java plug‑in disabled setting and triggering Java Web Start applications via a crafted website. Affected product/version: Mac OS X up to 10.8.2 (and OS X Mountain Lion era updates). Root cause: JNLP fi...