Mac Os X Security Vulnerabilities and Issues — Mac Os X CVE List

Lucene search

AppleMac Os X

63 matches found

CVE•added 2015/07/20 11:59 p.m.•1524 views

CVE-2015-3185

The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions...

4.3CVSS6.6AI score0.06515EPSS

CVE•added 2015/07/20 11:59 p.m.•111 views

CVE-2015-0253

The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation...

5CVSS7.9AI score0.06619EPSS

CVE•added 2015/07/03 2:0 a.m.•81 views

CVE-2015-3717

Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

7.5CVSS6.5AI score0.01438EPSS

CVE•added 2015/07/03 1:59 a.m.•75 views

CVE-2015-3668

QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, ...

6.8CVSS5.2AI score0.03642EPSS

CVE•added 2015/07/03 1:59 a.m.•71 views

CVE-2015-3687

CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3688, and CVE-2015-3689.

6.8CVSS5.1AI score0.02635EPSS

CVE•added 2015/07/03 1:59 a.m.•69 views

CVE-2015-3666

6.8CVSS5.2AI score0.03642EPSS

CVE•added 2015/07/03 1:59 a.m.•68 views

CVE-2015-3661

6.8CVSS5.2AI score0.03642EPSS

CVE•added 2015/07/03 1:59 a.m.•68 views

CVE-2015-3686

6.8CVSS5.1AI score0.02635EPSS

CVE•added 2015/07/03 1:59 a.m.•63 views

CVE-2015-3667

6.8CVSS5.2AI score0.03642EPSS

CVE•added 2015/07/03 1:59 a.m.•63 views

CVE-2015-3688

6.8CVSS5.1AI score0.02635EPSS

CVE•added 2015/07/03 1:59 a.m.•62 views

CVE-2015-3696

Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.

7.2CVSS4.1AI score0.0014EPSS

CVE•added 2015/07/03 1:59 a.m.•61 views

CVE-2015-3658

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypa...

6.8CVSS7.6AI score0.00273EPSS

CVE•added 2015/07/03 1:59 a.m.•60 views

CVE-2015-3701

Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3702.

7.2CVSS4.1AI score0.0014EPSS

CVE•added 2015/07/03 2:0 a.m.•60 views

CVE-2015-3719

TrueTypeScaler in FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3694.

6.8CVSS5.2AI score0.01404EPSS

CVE•added 2015/07/03 1:59 a.m.•59 views

CVE-2015-3679

Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3680, CVE-2015-3681, and CVE-2015-3682.

6.8CVSS5.2AI score0.02022EPSS

CVE•added 2015/07/03 1:59 a.m.•59 views

CVE-2015-3702

Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3701.

7.2CVSS4.1AI score0.0014EPSS

CVE•added 2015/07/03 1:59 a.m.•58 views

CVE-2015-3685

CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.

6.8CVSS5.1AI score0.02635EPSS

CVE•added 2015/07/03 1:59 a.m.•58 views

CVE-2015-3700

Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3701, and CVE-2015-3702.

7.2CVSS4.1AI score0.0014EPSS

CVE•added 2015/07/03 1:59 a.m.•56 views

CVE-2015-3659

The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause...

6.8CVSS8.8AI score0.01109EPSS

CVE•added 2015/07/03 1:59 a.m.•56 views

CVE-2015-3673

Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory Utility.

7.2CVSS3.6AI score0.06029EPSS

CVE•added 2015/07/03 1:59 a.m.•56 views

CVE-2015-3689

6.8CVSS5.1AI score0.02635EPSS

CVE•added 2015/07/03 2:0 a.m.•56 views

CVE-2015-3709

Race condition in kext tools in Apple OS X before 10.10.4 allows local users to bypass intended signature requirements for kernel extensions by leveraging improper pathname validation.

6.9CVSS3.6AI score0.00035EPSS

CVE•added 2015/07/03 2:0 a.m.•55 views

CVE-2015-3721

The kernel in Apple iOS before 8.4 and OS X before 10.10.4 does not properly handle HFS parameters, which allows attackers to obtain sensitive memory-layout information via a crafted app.

4.3CVSS2.9AI score0.00575EPSS

CVE•added 2015/07/03 2:0 a.m.•54 views

CVE-2015-3727

WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access an arbitrary web site's database via a crafted web site.

6.8CVSS7.6AI score0.00942EPSS

CVE•added 2015/07/03 1:59 a.m.•53 views

CVE-2015-3669

QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3665.

6.8CVSS7.5AI score0.02022EPSS

CVE•added 2015/07/03 1:59 a.m.•53 views

CVE-2015-3694

FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3719.

6.8CVSS5.2AI score0.01404EPSS

CVE•added 2015/07/03 1:59 a.m.•52 views

CVE-2015-3663

6.8CVSS5.2AI score0.03642EPSS

CVE•added 2015/07/03 1:59 a.m.•52 views

CVE-2015-3695

Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.

7.2CVSS4.1AI score0.0014EPSS

CVE•added 2015/07/03 1:59 a.m.•52 views

CVE-2015-3697

Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.

7.2CVSS4.1AI score0.0014EPSS

CVE•added 2015/07/03 1:59 a.m.•51 views

CVE-2015-3662

6.8CVSS5.2AI score0.03642EPSS

CVE•added 2015/07/03 1:59 a.m.•51 views

CVE-2015-3678

AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.

7.2CVSS4.2AI score0.00164EPSS

CVE•added 2015/07/03 2:0 a.m.•51 views

CVE-2015-3710

Mail in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to trigger a refresh operation, and consequently cause a visit to an arbitrary web site, via a crafted HTML e-mail message.

4.3CVSS3.7AI score0.00521EPSS

CVE•added 2015/07/03 1:59 a.m.•50 views

CVE-2015-3676

AppleGraphicsControl in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information via a crafted app.

4.3CVSS3.2AI score0.003EPSS

CVE•added 2015/07/03 1:59 a.m.•50 views

CVE-2015-3699

Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.

7.2CVSS4.1AI score0.0014EPSS

CVE•added 2015/07/03 1:59 a.m.•50 views

CVE-2015-3704

runner in Install.framework in the Install Framework Legacy subsystem in Apple OS X before 10.10.4 does not properly drop privileges, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

9.3CVSS4.6AI score0.37857EPSS

CVE•added 2015/07/03 1:59 a.m.•49 views

CVE-2015-3674

afpserver in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

7.5CVSS5.3AI score0.02159EPSS

CVE•added 2015/07/03 1:59 a.m.•49 views

CVE-2015-3684

The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL.

6.8CVSS5.3AI score0.01789EPSS

CVE•added 2015/07/03 1:59 a.m.•49 views

CVE-2015-3698

Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.

7.2CVSS4.1AI score0.0014EPSS

CVE•added 2015/07/03 1:59 a.m.•49 views

CVE-2015-3705

IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3706.

9.3CVSS5AI score0.01126EPSS

CVE•added 2015/07/03 2:0 a.m.•49 views

CVE-2015-3713

QuickTime in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted movie file.

6.8CVSS5.2AI score0.01395EPSS

CVE•added 2015/07/03 1:59 a.m.•48 views

CVE-2015-3692

Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not enforce a locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging root privileges.

6.8CVSS4.4AI score0.00037EPSS

CVE•added 2015/07/03 1:59 a.m.•48 views

CVE-2015-3703

ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.

6.8CVSS5.2AI score0.01896EPSS

CVE•added 2015/07/03 2:0 a.m.•48 views

CVE-2015-3718

systemstatsd in the System Stats subsystem in Apple OS X before 10.10.4 does not properly interpret data types encountered in interprocess communication, which allows attackers to execute arbitrary code with systemstatsd privileges via a crafted app, related to a "type confusion" issue.

6.8CVSS4.7AI score0.01178EPSS

CVE•added 2015/07/03 2:0 a.m.•48 views

CVE-2015-3720

The kernel in Apple OS X before 10.10.4 does not properly manage memory in kernel-extension APIs, which allows attackers to obtain sensitive memory-layout information via a crafted app.

4.3CVSS3.1AI score0.00297EPSS

CVE•added 2015/07/03 2:0 a.m.•47 views

CVE-2015-3716

Spotlight in Apple OS X before 10.10.4 allows attackers to execute arbitrary commands via a crafted name of a photo file within the local photo library.

4.4CVSS4.5AI score0.00144EPSS

CVE•added 2015/07/03 1:59 a.m.•46 views

CVE-2015-3672

Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.

7.2CVSS3.7AI score0.00043EPSS

CVE•added 2015/07/03 1:59 a.m.•46 views

CVE-2015-3690

The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.

4.3CVSS3AI score0.00575EPSS

CVE•added 2015/07/03 1:59 a.m.•46 views

CVE-2015-3691

The Monitor Control Command Set kernel extension in the Display Drivers subsystem in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages control of a function pointer.

9.3CVSS4.7AI score0.01697EPSS

CVE•added 2015/07/03 2:0 a.m.•46 views

CVE-2015-3708

kextd in kext tools in Apple OS X before 10.10.4 allows attackers to write to arbitrary files via a crafted app that conducts a symlink attack.

8.8CVSS3.8AI score0.00505EPSS

CVE•added 2015/07/03 1:59 a.m.•45 views

CVE-2015-3671

Admin Framework in Apple OS X before 10.10.4 does not properly verify XPC entitlements, which allows local users to bypass authentication and obtain admin privileges via unspecified vectors.

7.2CVSS3.8AI score0.00048EPSS

Total number of security vulnerabilities63