{"id": "TALOS-2015-0015", "bulletinFamily": "info", "title": "Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability", "description": "# Talos Vulnerability Report\n\n### TALOS-2015-0015\n\n## Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability\n\n##### August 13, 2015\n\n##### CVE Number\n\nCVE-2015-3791\n\n### Description\n\nThere is a denial of service vulnerability in Apple Quicktime. An attacker who can control the elementary video header start codes section or type descriptor length in an \u201cesds\u201d atom in a .mov file can cause additional structures to be expected which can lead to an out-of-bounds read. Since the allocation only contains data already from the file, the impact is limited to denial of service.\n\n### Tested Versions\n\nApple Quicktime 7.7.5 - Windows 7 32-bit Vulnerable \nApple Quicktime 7.7.6 - Windows 7 32-bit Vulnerable\n\n### Product URLs\n\nhttps://www.apple.com/quicktime/\n\n### Details\n\nThe function QuickTimeMPEG4!0x9990 is responsible for parsing out the ES header start codes section of the esds atom in a loop.\n\nOn each iteration, the algorithm pulls the next start code from the buffer and, based on the code, it calls the designated parsing function for the data that follows. A data structure is used to track the algorithm\u2019s location within the buffer, as well as the boundaries, total size, and last 4 bytes pulled from that data block:\n \n \n \tex:\n \t002fc124 14b2afd8 <---- start of buffer \n \t002fc128 00000022 <---- size of data\n \t002fc12c 14b2afdc <---- current location\n \t002fc130 14b2affa <---- end of buffer\n \t002fc134 f3000001 \n \t...\n \n\nBefore, and after each start code and structure, a function is called at QuickTimeMPEG4!0x91F0 to check to see if the value of \u201ccurrent location (obj+8)\u201d is less than \u201cend of buffer (obj+0x0c)\u201d:\n \n \n \t1 BOOL __usercall sub_6A8891F0@<eax>(int a1@<eax>)\n \t2 {\n \t3 return *(_DWORD *)(a1 + 8) < *(_DWORD *)(a1 + 12);\n \t4 }\n \n\nThe designated parsing functions for the data that follows each start code contain many optional elements that are parsed as needed based on whether bit flags within the data itself are set. This makes these data sections variable sized, however no check is made within these functions to ensure the read location does not exceed the end of the read buffer.\n\nThis bug is therefore triggered by a mismatch between the descriptor length (0x22) and the total size of all start codes, required elements, and optional elements within the Elementary Video Header. By flipping bit flags in the data, an attacker can cause additional structures to be parsed resulting in an out-of-bounds read off the end of the data buffer.\n \n \n \tFunctions vulnerable to this:\n \tQuickTimeMPEG4!0x93d0\n \tQuickTimeMPEG4!0x9590\n \n\n### Crash Information\n \n \n \teax=15a3c000 ebx=0000000a ecx=00000016 edx=0014c1b4 esi=c0c0d0d0 edi=000003ff\n \teip=676b910e esp=0014c150 ebp=00000003 iopl=0 nv up ei pl nz na pe nc\n \tcs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206\n \tQuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e:\n \t676b910e 8b00 mov eax,dword ptr [eax] ds:0023:15a3c000=????????\n \n \tSTACK_TEXT:\n \t0014c160 676b9726 00000003 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e\n \t0014c190 676b9af4 0014c1b4 008c00ce 0014c250 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7c26\n \t00000000 00000000 00000000 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7ff4\n \n\n##### Credit\n\nRyan Pentney and Richard Johnson of Cisco Talos\n\n* * *\n\nVulnerability Reports Next Report\n\nTALOS-2015-0017\n\nPrevious Report\n\nTALOS-2015-0014\n", "published": "2015-08-13T00:00:00", "modified": "2015-08-13T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2015-0015", "reporter": "Talos Intelligence", "references": [], "cvelist": ["CVE-2015-3791"], "type": "talos", "lastseen": "2020-07-01T21:25:09", "history": [{"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2015-3791"], "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "description": "# Talos Vulnerability Report\n\n### TALOS-2015-0015\n\n## Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability\n\n##### August 13, 2015\n\n##### CVE Number\n\nCVE-2015-3791\n\n### Description\n\nThere is a denial of service vulnerability in Apple Quicktime. An attacker who can control the elementary video header start codes section or type descriptor length in an \"esds\" atom in a .mov file can cause additional structures to be expected which can lead to an out-of-bounds read. Since the allocation only contains data already from the file, the impact is limited to denial of service.\n\n### Tested Versions\n\nApple Quicktime 7.7.5 - Windows 7 32-bit Vulnerable \nApple Quicktime 7.7.6 - Windows 7 32-bit Vulnerable\n\n### Product URLs\n\nhttps://www.apple.com/quicktime/\n\n### Details\n\nThe function QuickTimeMPEG4!0x9990 is responsible for parsing out the ES header start codes section of the esds atom in a loop.\n\nOn each iteration, the algorithm pulls the next start code from the buffer and, based on the code, it calls the designated parsing function for the data that follows. A data structure is used to track the algorithm's location within the buffer, as well as the boundaries, total size, and last 4 bytes pulled from that data block:\n \n \n ex:\n 002fc124 14b2afd8 <---- start of buffer \n 002fc128 00000022 <---- size of data\n 002fc12c 14b2afdc <---- current location\n 002fc130 14b2affa <---- end of buffer\n 002fc134 f3000001 \n ...\n \n\nBefore, and after each start code and structure, a function is called at QuickTimeMPEG4!0x91F0 to check to see if the value of \"current location (obj+8)\" is less than \"end of buffer (obj+0x0c)\":\n \n \n 1 BOOL __usercall sub_6A8891F0@<eax>(int a1@<eax>)\n 2 {\n 3 return *(_DWORD *)(a1 + 8) < *(_DWORD *)(a1 + 12);\n 4 }\n \n\nThe designated parsing functions for the data that follows each start code contain many optional elements that are parsed as needed based on whether bit flags within the data itself are set. This makes these data sections variable sized, however no check is made within these functions to ensure the read location does not exceed the end of the read buffer.\n\nThis bug is therefore triggered by a mismatch between the descriptor length (0x22) and the total size of all start codes, required elements, and optional elements within the Elementary Video Header. By flipping bit flags in the data, an attacker can cause additional structures to be parsed resulting in an out-of-bounds read off the end of the data buffer.\n \n \n Functions vulnerable to this:\n QuickTimeMPEG4!0x93d0\n QuickTimeMPEG4!0x9590\n \n\n### Crash Information\n \n \n eax=15a3c000 ebx=0000000a ecx=00000016 edx=0014c1b4 esi=c0c0d0d0 edi=000003ff\n eip=676b910e esp=0014c150 ebp=00000003 iopl=0 nv up ei pl nz na pe nc\n cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206\n QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e:\n 676b910e 8b00 mov eax,dword ptr [eax] ds:0023:15a3c000=????????\n \n STACK_TEXT:\n 0014c160 676b9726 00000003 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e\n 0014c190 676b9af4 0014c1b4 008c00ce 0014c250 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7c26\n 00000000 00000000 00000000 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7ff4\n \n\n##### Credit\n\nRyan Pentney and Richard Johnson of Cisco Talos\n\n* * *\n\nVulnerability Reports Next Report\n\nTALOS-2015-0017\n\nPrevious Report\n\nTALOS-2015-0014\n", "edition": 12, "enchantments": {"dependencies": {"modified": "2019-05-29T19:20:02", "references": [{"idList": ["OPENVAS:1361412562310806153", "OPENVAS:1361412562310805969"], "type": "openvas"}, {"idList": ["KLA10653"], "type": "kaspersky"}, {"idList": ["CVE-2015-3791"], "type": "cve"}, {"idList": ["THREATPOST:9AEED8D39F7239AD854BD7471129BD8F"], "type": "threatpost"}, {"idList": ["SECURITYVULNS:DOC:32390", "SECURITYVULNS:VULN:14630", "SECURITYVULNS:DOC:32394", "SECURITYVULNS:VULN:14633"], "type": "securityvulns"}, {"idList": ["MACOSX_SECUPD2015-006.NASL", "QUICKTIME_778.NASL", "MACOSX_10_10_5.NASL"], "type": "nessus"}], "rev": 2}, "score": {"modified": "2019-05-29T19:20:02", "rev": 2, "value": 5.5, "vector": "NONE"}}, "hash": "3c304fdc8fcd6543c8c8a2e71b7bf7ade0995607cd3ac8fe9400900f70907ae0", "hashmap": [{"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "234f048afbaa46edbff1db344429b061", "key": "description"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "39f0a2b60f7baaa3ba808a0d631dd871", "key": "cvelist"}, {"hash": "4cac367be6dd8242802053610be9dee6", "key": "cvss"}, {"hash": "25d9e9c09fe3898fdf6100ef2e49c937", "key": "href"}, {"hash": "f2cee3fd74aadb43c91396f206bcf3e8", "key": "type"}, {"hash": "6564c96be1f22b8713f20e4cac7ecffb", "key": "title"}, {"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "modified"}, {"hash": "34956ac0a726126687502bf9088bc7bb", "key": "reporter"}], "history": [], "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2015-0015", "id": "TALOS-2015-0015", "lastseen": "2019-05-29T19:20:02", "modified": "2015-08-13T00:00:00", "objectVersion": "1.3", "published": "2015-08-13T00:00:00", "references": [], "reporter": "Talos Intelligence", "title": "Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability", "type": "talos", "viewCount": 9}, "differentElements": ["description"], "edition": 12, "lastseen": "2019-05-29T19:20:02"}, {"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2015-3791"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "# Talos Vulnerability Report\n\n### TALOS-2015-0015\n\n## Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability\n\n##### August 13, 2015\n\n##### CVE Number\n\nCVE-2015-3791\n\n### Description\n\nThere is a denial of service vulnerability in Apple Quicktime. An attacker who can control the elementary video header start codes section or type descriptor length in an \"esds\" atom in a .mov file can cause additional structures to be expected which can lead to an out-of-bounds read. Since the allocation only contains data already from the file, the impact is limited to denial of service.\n\n### Tested Versions\n\nApple Quicktime 7.7.5 - Windows 7 32-bit Vulnerable \nApple Quicktime 7.7.6 - Windows 7 32-bit Vulnerable\n\n### Product URLs\n\nhttps://www.apple.com/quicktime/\n\n### Details\n\nThe function QuickTimeMPEG4!0x9990 is responsible for parsing out the ES header start codes section of the esds atom in a loop.\n\nOn each iteration, the algorithm pulls the next start code from the buffer and, based on the code, it calls the designated parsing function for the data that follows. A data structure is used to track the algorithm's location within the buffer, as well as the boundaries, total size, and last 4 bytes pulled from that data block:\n \n \n ex:\n 002fc124 14b2afd8 <---- start of buffer \n 002fc128 00000022 <---- size of data\n 002fc12c 14b2afdc <---- current location\n 002fc130 14b2affa <---- end of buffer\n 002fc134 f3000001 \n ...\n \n\nBefore, and after each start code and structure, a function is called at QuickTimeMPEG4!0x91F0 to check to see if the value of \"current location (obj+8)\" is less than \"end of buffer (obj+0x0c)\":\n \n \n 1 BOOL __usercall sub_6A8891F0@<eax>(int a1@<eax>)\n 2 {\n 3 return *(_DWORD *)(a1 + 8) < *(_DWORD *)(a1 + 12);\n 4 }\n \n\nThe designated parsing functions for the data that follows each start code contain many optional elements that are parsed as needed based on whether bit flags within the data itself are set. This makes these data sections variable sized, however no check is made within these functions to ensure the read location does not exceed the end of the read buffer.\n\nThis bug is therefore triggered by a mismatch between the descriptor length (0x22) and the total size of all start codes, required elements, and optional elements within the Elementary Video Header. By flipping bit flags in the data, an attacker can cause additional structures to be parsed resulting in an out-of-bounds read off the end of the data buffer.\n \n \n Functions vulnerable to this:\n QuickTimeMPEG4!0x93d0\n QuickTimeMPEG4!0x9590\n \n\n### Crash Information\n \n \n eax=15a3c000 ebx=0000000a ecx=00000016 edx=0014c1b4 esi=c0c0d0d0 edi=000003ff\n eip=676b910e esp=0014c150 ebp=00000003 iopl=0 nv up ei pl nz na pe nc\n cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206\n QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e:\n 676b910e 8b00 mov eax,dword ptr [eax] ds:0023:15a3c000=????????\n \n STACK_TEXT:\n 0014c160 676b9726 00000003 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e\n 0014c190 676b9af4 0014c1b4 008c00ce 0014c250 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7c26\n 00000000 00000000 00000000 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7ff4\n \n\n##### Credit\n\nRyan Pentney and Richard Johnson of Cisco Talos\n\n* * *\n\nVulnerability Reports Next Report\n\nTALOS-2015-0017\n\nPrevious Report\n\nTALOS-2015-0014\n", "edition": 11, "enchantments": {"dependencies": {"modified": "2018-08-31T00:36:39", "references": [{"idList": ["OPENVAS:1361412562310806153", "OPENVAS:1361412562310805969"], "type": "openvas"}, {"idList": ["KLA10653"], "type": "kaspersky"}, {"idList": ["CVE-2015-3791"], "type": "cve"}, {"idList": ["THREATPOST:9AEED8D39F7239AD854BD7471129BD8F"], "type": "threatpost"}, {"idList": ["SECURITYVULNS:DOC:32390", "SECURITYVULNS:VULN:14630", "SECURITYVULNS:DOC:32394", "SECURITYVULNS:VULN:14633"], "type": "securityvulns"}, {"idList": ["MACOSX_SECUPD2015-006.NASL", "QUICKTIME_778.NASL", "MACOSX_10_10_5.NASL"], "type": "nessus"}]}, "score": {"value": 5.0, "vector": "NONE"}}, "hash": "d8a62c311c8fab28bcc8c4bf39c18fbfcf7f2ffd93090f81c6460e118ac7aa3b", "hashmap": [{"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "234f048afbaa46edbff1db344429b061", "key": "description"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "39f0a2b60f7baaa3ba808a0d631dd871", "key": "cvelist"}, {"hash": "25d9e9c09fe3898fdf6100ef2e49c937", "key": "href"}, {"hash": "f2cee3fd74aadb43c91396f206bcf3e8", "key": "type"}, {"hash": "6564c96be1f22b8713f20e4cac7ecffb", "key": "title"}, {"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "modified"}, {"hash": "34956ac0a726126687502bf9088bc7bb", "key": "reporter"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2015-0015", "id": "TALOS-2015-0015", "lastseen": "2018-08-31T00:36:39", "modified": "2015-08-13T00:00:00", "objectVersion": "1.3", "published": "2015-08-13T00:00:00", "references": [], "reporter": "Talos Intelligence", "title": "Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability", "type": "talos", "viewCount": 6}, "differentElements": ["cvss"], "edition": 11, "lastseen": "2018-08-31T00:36:39"}, {"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2015-3791"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "# Talos Vulnerability Report\n\n### TALOS-2015-0015\n\n## Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability\n\n##### August 13, 2015\n\n##### CVE Number\n\nCVE-2015-3791\n\n### Description\n\nThere is a denial of service vulnerability in Apple Quicktime. An attacker who can control the elementary video header start codes section or type descriptor length in an \"esds\" atom in a .mov file can cause additional structures to be expected which can lead to an out-of-bounds read. Since the allocation only contains data already from the file, the impact is limited to denial of service.\n\n### Tested Versions\n\nApple Quicktime 7.7.5 - Windows 7 32-bit Vulnerable \nApple Quicktime 7.7.6 - Windows 7 32-bit Vulnerable\n\n### Product URLs\n\nhttps://www.apple.com/quicktime/\n\n### Details\n\nThe function QuickTimeMPEG4!0x9990 is responsible for parsing out the ES header start codes section of the esds atom in a loop.\n\nOn each iteration, the algorithm pulls the next start code from the buffer and, based on the code, it calls the designated parsing function for the data that follows. A data structure is used to track the algorithm's location within the buffer, as well as the boundaries, total size, and last 4 bytes pulled from that data block:\n \n \n ex:\n 002fc124 14b2afd8 <---- start of buffer \n 002fc128 00000022 <---- size of data\n 002fc12c 14b2afdc <---- current location\n 002fc130 14b2affa <---- end of buffer\n 002fc134 f3000001 \n ...\n \n\nBefore, and after each start code and structure, a function is called at QuickTimeMPEG4!0x91F0 to check to see if the value of \"current location (obj+8)\" is less than \"end of buffer (obj+0x0c)\":\n \n \n 1 BOOL __usercall sub_6A8891F0@<eax>(int a1@<eax>)\n 2 {\n 3 return *(_DWORD *)(a1 + 8) < *(_DWORD *)(a1 + 12);\n 4 }\n \n\nThe designated parsing functions for the data that follows each start code contain many optional elements that are parsed as needed based on whether bit flags within the data itself are set. This makes these data sections variable sized, however no check is made within these functions to ensure the read location does not exceed the end of the read buffer.\n\nThis bug is therefore triggered by a mismatch between the descriptor length (0x22) and the total size of all start codes, required elements, and optional elements within the Elementary Video Header. By flipping bit flags in the data, an attacker can cause additional structures to be parsed resulting in an out-of-bounds read off the end of the data buffer.\n \n \n Functions vulnerable to this:\n QuickTimeMPEG4!0x93d0\n QuickTimeMPEG4!0x9590\n \n\n### Crash Information\n \n \n eax=15a3c000 ebx=0000000a ecx=00000016 edx=0014c1b4 esi=c0c0d0d0 edi=000003ff\n eip=676b910e esp=0014c150 ebp=00000003 iopl=0 nv up ei pl nz na pe nc\n cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206\n QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e:\n 676b910e 8b00 mov eax,dword ptr [eax] ds:0023:15a3c000=????????\n \n STACK_TEXT:\n 0014c160 676b9726 00000003 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e\n 0014c190 676b9af4 0014c1b4 008c00ce 0014c250 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7c26\n 00000000 00000000 00000000 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7ff4\n \n\n##### Credit\n\nRyan Pentney and Richard Johnson of Cisco Talos\n\n* * *\n\nVulnerability Reports Next Report Previous Report\n", "edition": 6, "enchantments": {}, "hash": "7c9d0c7a17248c0a4ec8af7112db1093f027bd4b676857a1b457987fa675f3bc", "hashmap": [{"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "39f0a2b60f7baaa3ba808a0d631dd871", "key": "cvelist"}, {"hash": "25d9e9c09fe3898fdf6100ef2e49c937", "key": "href"}, {"hash": "f2cee3fd74aadb43c91396f206bcf3e8", "key": "type"}, {"hash": "6564c96be1f22b8713f20e4cac7ecffb", "key": "title"}, {"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "modified"}, {"hash": "34956ac0a726126687502bf9088bc7bb", "key": "reporter"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}, {"hash": "3ab733632cdae5b45e973d7acf76dd07", "key": "description"}], "history": [], "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2015-0015", "id": "TALOS-2015-0015", "lastseen": "2017-07-26T04:23:28", "modified": "2015-08-13T00:00:00", "objectVersion": "1.3", "published": "2015-08-13T00:00:00", "references": [], "reporter": "Talos Intelligence", "title": "Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability", "type": "talos", "viewCount": 0}, "differentElements": ["description"], "edition": 6, "lastseen": "2017-07-26T04:23:28"}, {"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2015-3791"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "# Talos Vulnerability Report\n\n### TALOS-2015-0015\n\n## Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability\n\n##### August 13, 2015\n\n##### CVE Number\n\nCVE-2015-3791\n\n### Description\n\nThere is a denial of service vulnerability in Apple Quicktime. An attacker who can control the elementary video header start codes section or type descriptor length in an \"esds\" atom in a .mov file can cause additional structures to be expected which can lead to an out-of-bounds read. Since the allocation only contains data already from the file, the impact is limited to denial of service.\n\n### Tested Versions\n\nApple Quicktime 7.7.5 - Windows 7 32-bit Vulnerable \nApple Quicktime 7.7.6 - Windows 7 32-bit Vulnerable\n\n### Product URLs\n\nhttps://www.apple.com/quicktime/\n\n### Details\n\nThe function QuickTimeMPEG4!0x9990 is responsible for parsing out the ES header start codes section of the esds atom in a loop.\n\nOn each iteration, the algorithm pulls the next start code from the buffer and, based on the code, it calls the designated parsing function for the data that follows. A data structure is used to track the algorithm's location within the buffer, as well as the boundaries, total size, and last 4 bytes pulled from that data block:\n \n \n ex:\n 002fc124 14b2afd8 <---- start of buffer \n 002fc128 00000022 <---- size of data\n 002fc12c 14b2afdc <---- current location\n 002fc130 14b2affa <---- end of buffer\n 002fc134 f3000001 \n ...\n \n\nBefore, and after each start code and structure, a function is called at QuickTimeMPEG4!0x91F0 to check to see if the value of \"current location (obj+8)\" is less than \"end of buffer (obj+0x0c)\":\n \n \n 1 BOOL __usercall [email\u00a0protected]<eax>(int [email\u00a0protected]<eax>)\n 2 {\n 3 return *(_DWORD *)(a1 + 8) < *(_DWORD *)(a1 + 12);\n 4 }\n \n\nThe designated parsing functions for the data that follows each start code contain many optional elements that are parsed as needed based on whether bit flags within the data itself are set. This makes these data sections variable sized, however no check is made within these functions to ensure the read location does not exceed the end of the read buffer.\n\nThis bug is therefore triggered by a mismatch between the descriptor length (0x22) and the total size of all start codes, required elements, and optional elements within the Elementary Video Header. By flipping bit flags in the data, an attacker can cause additional structures to be parsed resulting in an out-of-bounds read off the end of the data buffer.\n \n \n Functions vulnerable to this:\n QuickTimeMPEG4!0x93d0\n QuickTimeMPEG4!0x9590\n \n\n### Crash Information\n \n \n eax=15a3c000 ebx=0000000a ecx=00000016 edx=0014c1b4 esi=c0c0d0d0 edi=000003ff\n eip=676b910e esp=0014c150 ebp=00000003 iopl=0 nv up ei pl nz na pe nc\n cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206\n QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e:\n 676b910e 8b00 mov eax,dword ptr [eax] ds:0023:15a3c000=????????\n \n STACK_TEXT:\n 0014c160 676b9726 00000003 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e\n 0014c190 676b9af4 0014c1b4 008c00ce 0014c250 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7c26\n 00000000 00000000 00000000 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7ff4\n \n\n##### Credit\n\nRyan Pentney and Richard Johnson of Cisco Talos\n\n* * *\n\nVulnerability Reports Next Report\n\nTALOS-2015-0017\n\nPrevious Report\n\nTALOS-2015-0014\n", "edition": 8, "enchantments": {"score": {"modified": "2017-08-23T17:12:45", "value": 9.0}}, "hash": "aa1ff8eac4e96ed35617ba4126b49fdaf35029043aebb5cdf2eb84187214e6c0", "hashmap": [{"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "39f0a2b60f7baaa3ba808a0d631dd871", "key": "cvelist"}, {"hash": "25d9e9c09fe3898fdf6100ef2e49c937", "key": "href"}, {"hash": "f2cee3fd74aadb43c91396f206bcf3e8", "key": "type"}, {"hash": "6564c96be1f22b8713f20e4cac7ecffb", "key": "title"}, {"hash": "69a0814896402d31de9ece4fcab1c52c", "key": "description"}, {"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "modified"}, {"hash": "34956ac0a726126687502bf9088bc7bb", "key": "reporter"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2015-0015", "id": "TALOS-2015-0015", "lastseen": "2017-08-23T17:12:45", "modified": "2015-08-13T00:00:00", "objectVersion": "1.3", "published": "2015-08-13T00:00:00", "references": [], "reporter": "Talos Intelligence", "title": "Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability", "type": "talos", "viewCount": 0}, "differentElements": ["description"], "edition": 8, "lastseen": "2017-08-23T17:12:45"}, {"bulletin": {"bulletinFamily": "info", "cvelist": ["CVE-2015-3791"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "# Talos Vulnerability Report\n\n### TALOS-2015-0015\n\n## Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability\n\n##### August 13, 2015\n\n##### CVE Number\n\nCVE-2015-3791\n\n### Description\n\nThere is a denial of service vulnerability in Apple Quicktime. An attacker who can control the elementary video header start codes section or type descriptor length in an \"esds\" atom in a .mov file can cause additional structures to be expected which can lead to an out-of-bounds read. Since the allocation only contains data already from the file, the impact is limited to denial of service.\n\n### Tested Versions\n\nApple Quicktime 7.7.5 - Windows 7 32-bit Vulnerable \nApple Quicktime 7.7.6 - Windows 7 32-bit Vulnerable\n\n### Product URLs\n\nhttps://www.apple.com/quicktime/\n\n### Details\n\nThe function QuickTimeMPEG4!0x9990 is responsible for parsing out the ES header start codes section of the esds atom in a loop.\n\nOn each iteration, the algorithm pulls the next start code from the buffer and, based on the code, it calls the designated parsing function for the data that follows. A data structure is used to track the algorithm's location within the buffer, as well as the boundaries, total size, and last 4 bytes pulled from that data block:\n \n \n ex:\n 002fc124 14b2afd8 <---- start of buffer \n 002fc128 00000022 <---- size of data\n 002fc12c 14b2afdc <---- current location\n 002fc130 14b2affa <---- end of buffer\n 002fc134 f3000001 \n ...\n \n\nBefore, and after each start code and structure, a function is called at QuickTimeMPEG4!0x91F0 to check to see if the value of \"current location (obj+8)\" is less than \"end of buffer (obj+0x0c)\":\n \n \n 1 BOOL __usercall sub_6A8891F0@<eax>(int a1@<eax>)\n 2 {\n 3 return *(_DWORD *)(a1 + 8) < *(_DWORD *)(a1 + 12);\n 4 }\n \n\nThe designated parsing functions for the data that follows each start code contain many optional elements that are parsed as needed based on whether bit flags within the data itself are set. This makes these data sections variable sized, however no check is made within these functions to ensure the read location does not exceed the end of the read buffer.\n\nThis bug is therefore triggered by a mismatch between the descriptor length (0x22) and the total size of all start codes, required elements, and optional elements within the Elementary Video Header. By flipping bit flags in the data, an attacker can cause additional structures to be parsed resulting in an out-of-bounds read off the end of the data buffer.\n \n \n Functions vulnerable to this:\n QuickTimeMPEG4!0x93d0\n QuickTimeMPEG4!0x9590\n \n\n### Crash Information\n \n \n eax=15a3c000 ebx=0000000a ecx=00000016 edx=0014c1b4 esi=c0c0d0d0 edi=000003ff\n eip=676b910e esp=0014c150 ebp=00000003 iopl=0 nv up ei pl nz na pe nc\n cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206\n QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e:\n 676b910e 8b00 mov eax,dword ptr [eax] ds:0023:15a3c000=????????\n \n STACK_TEXT:\n 0014c160 676b9726 00000003 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x760e\n 0014c190 676b9af4 0014c1b4 008c00ce 0014c250 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7c26\n 00000000 00000000 00000000 00000000 00000000 QuickTimeMPEG4!MPEG4_DComponentDispatch+0x7ff4\n \n\n##### Credit\n\nRyan Pentney and Richard Johnson of Cisco Talos\n\n* * *\n\nVulnerability Reports Next Report\n\nTALOS-2015-0017\n\nPrevious Report\n\nTALOS-2015-0014\n", "edition": 10, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "279358743e344dc321f928644b602e2b98750819116c762833dc03e844ae8c04", "hashmap": [{"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "234f048afbaa46edbff1db344429b061", "key": "description"}, {"hash": "caf9b6b99962bf5c2264824231d7a40c", "key": "bulletinFamily"}, {"hash": "39f0a2b60f7baaa3ba808a0d631dd871", "key": "cvelist"}, {"hash": "25d9e9c09fe3898fdf6100ef2e49c937", "key": "href"}, {"hash": "f2cee3fd74aadb43c91396f206bcf3e8", "key": "type"}, {"hash": "6564c96be1f22b8713f20e4cac7ecffb", "key": "title"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "ea14f9898cd9ff4538d6a0f1a719167d", "key": "modified"}, {"hash": "34956ac0a726126687502bf9088bc7bb", "key": "reporter"}], "history": [], "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2015-0015", "id": "TALOS-2015-0015", "lastseen": "2018-08-30T20:35:57", "modified": "2015-08-13T00:00:00", "objectVersion": "1.3", "published": "2015-08-13T00:00:00", "references": [], "reporter": "Talos Intelligence", "title": "Apple Quicktime esds Atom Descriptor Type Length Mismatch Denial of Service Vulnerability", "type": "talos", "viewCount": 2}, "differentElements": ["cvss"], "edition": 10, "lastseen": "2018-08-30T20:35:57"}], "edition": 13, "hashmap": [{"key": "bulletinFamily", "hash": "caf9b6b99962bf5c2264824231d7a40c"}, {"key": "cvelist", "hash": "39f0a2b60f7baaa3ba808a0d631dd871"}, {"key": "cvss", "hash": "4cac367be6dd8242802053610be9dee6"}, {"key": "description", "hash": "27bd70dbc6a087861628df4c76ed39ee"}, {"key": "href", "hash": "25d9e9c09fe3898fdf6100ef2e49c937"}, {"key": "modified", "hash": "ea14f9898cd9ff4538d6a0f1a719167d"}, {"key": "published", "hash": "ea14f9898cd9ff4538d6a0f1a719167d"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "34956ac0a726126687502bf9088bc7bb"}, {"key": "title", "hash": "6564c96be1f22b8713f20e4cac7ecffb"}, {"key": "type", "hash": "f2cee3fd74aadb43c91396f206bcf3e8"}], "hash": "3e8e33007f4350f9623388789c165ff155ca7e97a1d475c174890b13085e9564", "viewCount": 10, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2015-3791"]}, {"type": "threatpost", "idList": ["THREATPOST:9AEED8D39F7239AD854BD7471129BD8F"]}, {"type": "nessus", "idList": ["MACOSX_SECUPD2015-006.NASL", "QUICKTIME_778.NASL", "MACOSX_10_10_5.NASL"]}, {"type": "kaspersky", "idList": ["KLA10653"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310805969", "OPENVAS:1361412562310806153"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:32390", "SECURITYVULNS:DOC:32394", "SECURITYVULNS:VULN:14630", "SECURITYVULNS:VULN:14633"]}], "modified": "2020-07-01T21:25:09", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2020-07-01T21:25:09", "rev": 2}, "vulnersScore": 5.5}, "objectVersion": "1.3", "scheme": null}

{"cve": [{"lastseen": "2019-05-29T18:14:42", "bulletinFamily": "NVD", "description": "QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3792, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.", "modified": "2017-09-21T01:29:00", "id": "CVE-2015-3791", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3791", "published": "2015-08-17T00:00:00", "title": "CVE-2015-3791", "type": "cve", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "threatpost": [{"lastseen": "2018-10-06T22:56:23", "bulletinFamily": "info", "description": "Apple on Thursday pushed out a new version of QuickTime for Windows that patched nine vulnerabilities, including a handful reported Aug. 13 by Cisco Talos and Fortinet researchers.\n\nAll five flaws, if exploited, could lead to a crash of the media player or code execution in some cases, Apple said in its [advisory](<https://support.apple.com/en-us/HT205046>). Two other vulnerabilities reported by Cisco and Fortinet also expose QuickTime to remote code execution attacks; CVE-2015-5785 and -5786 are memory corruption errors in QuickTime versions prior to 7.7.8 running on Windows machines, Fortinet\u2019s FortiGuard Labs and Cisco\u2019s Ryan Pentney and Richard Johnson said.\n\n\u201cA remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user\u2019s system,\u201d according to a SecurityTracker [advisory](<http://securitytracker.com/id/1033346>).\n\nThe QuickTime update comes a week after a giant [patch update for Mac OS X, OS X Server and iOS](<https://threatpost.com/apple-patches-critical-os-x-dyld-flaw-in-monster-update/114289>) that addressed dozens of vulnerabilities, including a critical privilege escalation issue in the DYLD dynamic linker that was disclosed a month earlier. All of yesterday\u2019s patches were released on OS X last week.\n\nApple said it improved memory handling to address the denial-of-service and code execution vulnerabilities in yesterday\u2019s update. The five DoS vulnerabilities reported by Cisco affect QuickTime versions 7.7.5 and 7.7.6 running on Windows 7 32-bit machines.\n\nAccording to Cisco:\n\n * [CVE-2015-3788](<http://talosintel.com/reports/2015/08/13/TALOS-2015-0012.html>) is described as an invalid URL Atom size flaw where an attacker who controls the size of a URL atom in a .mov media file can lead to an out of bounds read and a crash of the application.\n * [CVE-2015-3789](<http://talosintel.com/reports/2015/08/13/TALOS-2015-0013.html>) is exploited when an attack has control of the entries and description table in a 3GPP .mov file.\n * [CVE-2015-3790](<http://talosintel.com/reports/2015/08/13/TALOS-2015-0014.html>) is triggered when an attacker controls the size of a mvhd atom, and can cause an out-of-bounds read and crash.\n * [CVE-2015-3791](<http://talosintel.com/reports/2015/08/13/TALOS-2015-0015.html>) is a flaw that enables an attacker to control the elementary video header start codes or type descriptor length in an esds atom in a .mov file.\n * [CVE-2015-3792](<http://talosintel.com/reports/2015/08/13/TALOS-2015-0017.html>) enables an attacker to control the content of the mdat section in a .mov file, leading to a crash.\n\nApple still has not patched [kernel-level vulnerabilities in Mac OS X](<https://threatpost.com/inside-the-unpatched-os-x-vulnerabilities/114344>) that were disclosed last weekend by a researcher in Italy. Two vulnerabilities leading to [privilege escalation and security feature bypasses](<https://threatpost.com/apple-zero-day-remains-unpatched/114333>), along with proof of concept code, were reported to Apple hours before they were publicly disclosed by Luca Todesco.\n\nThe vulnerabilities lie in the Yosemite and Mavericks versions of OS X, but have been patched in beta versions of OS X 10.11, also known as El Capitan, Todesco said.\n", "modified": "2015-08-21T13:34:29", "published": "2015-08-21T09:34:29", "id": "THREATPOST:9AEED8D39F7239AD854BD7471129BD8F", "href": "https://threatpost.com/apple-patches-quicktime-crash-and-code-execution-flaws/114375/", "type": "threatpost", "title": "August 2015 Apple QuickTime Security Patches", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2020-03-03T20:53:49", "bulletinFamily": "scanner", "description": "This host is installed with Apple QuickTime\n and is prone to multiple vulnerabilities.", "modified": "2020-02-28T00:00:00", "published": "2015-09-01T00:00:00", "id": "OPENVAS:1361412562310805969", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310805969", "title": "Apple QuickTime Multiple Vulnerabilities Sep15 (Windows)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Apple QuickTime Multiple Vulnerabilities Sep15 (Windows)\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:apple:quicktime\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.805969\");\n script_version(\"2020-02-28T13:41:47+0000\");\n script_cve_id(\"CVE-2015-3788\", \"CVE-2015-3789\", \"CVE-2015-3790\", \"CVE-2015-3791\",\n \"CVE-2015-3792\", \"CVE-2015-5751\", \"CVE-2015-5779\", \"CVE-2015-5785\",\n \"CVE-2015-5786\");\n script_bugtraq_id(76340, 76443, 76444);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-02-28 13:41:47 +0000 (Fri, 28 Feb 2020)\");\n script_tag(name:\"creation_date\", value:\"2015-09-01 17:24:20 +0530 (Tue, 01 Sep 2015)\");\n script_name(\"Apple QuickTime Multiple Vulnerabilities Sep15 (Windows)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Apple QuickTime\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to multiple memory\n corruption issues.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote\n attackers to have unexpected application termination or arbitrary code execution.\");\n\n script_tag(name:\"affected\", value:\"Apple QuickTime version before 7.7.8 on\n Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple QuickTime version 7.7.8\n or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"http://lists.apple.com/archives/security-announce/2015/Aug/msg00004.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"secpod_apple_quicktime_detection_win_900124.nasl\");\n script_mandatory_keys(\"QuickTime/Win/Ver\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos[\"version\"];\npath = infos[\"location\"];\n\nif(version_is_less(version:vers, test_version:\"7.78.80.95\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"7.78.80.95\", install_path:path);\n security_message(port:0, data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:36:30", "bulletinFamily": "scanner", "description": "This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.", "modified": "2019-05-03T00:00:00", "published": "2015-10-29T00:00:00", "id": "OPENVAS:1361412562310806153", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806153", "title": "Apple Mac OS X Multiple Vulnerabilities-03 October-15", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Apple Mac OS X Multiple Vulnerabilities-03 October-15\n#\n# Authors:\n# Antu Sanadi <santu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806153\");\n script_version(\"2019-05-03T08:55:39+0000\");\n script_cve_id(\"CVE-2015-5779\", \"CVE-2015-5783\", \"CVE-2015-5772\", \"CVE-2015-5771\",\n \"CVE-2015-5768\", \"CVE-2015-5763\", \"CVE-2015-5754\", \"CVE-2015-5753\",\n \"CVE-2015-5751\", \"CVE-2015-5750\", \"CVE-2015-5748\", \"CVE-2015-5747\",\n \"CVE-2015-3794\", \"CVE-2015-3799\", \"CVE-2015-3792\", \"CVE-2015-3791\",\n \"CVE-2015-3790\", \"CVE-2015-3789\", \"CVE-2015-3788\", \"CVE-2015-3787\",\n \"CVE-2015-3786\", \"CVE-2015-3783\", \"CVE-2015-3781\", \"CVE-2015-3780\",\n \"CVE-2015-3779\", \"CVE-2015-3777\", \"CVE-2015-3775\", \"CVE-2015-3774\",\n \"CVE-2015-3773\", \"CVE-2015-3772\", \"CVE-2015-3771\", \"CVE-2015-3770\",\n \"CVE-2015-3769\", \"CVE-2015-3767\", \"CVE-2015-3765\", \"CVE-2015-3764\",\n \"CVE-2015-3762\", \"CVE-2015-3761\", \"CVE-2015-3760\", \"CVE-2015-3757\",\n \"CVE-2013-7422\", \"CVE-2015-5784\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-05-03 08:55:39 +0000 (Fri, 03 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2015-10-29 13:43:34 +0530 (Thu, 29 Oct 2015)\");\n script_name(\"Apple Mac OS X Multiple Vulnerabilities-03 October-15\");\n\n script_tag(name:\"summary\", value:\"This host is running Apple Mac OS X and\n is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists. For details refer\n reference section.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker\n to obtain sensitive information, execute arbitrary code, bypass intended launch\n restrictions and access restrictions, cause a denial of service, write to\n arbitrary files, execute arbitrary code with system privilege.\");\n\n script_tag(name:\"affected\", value:\"Apple Mac OS X versions 10.9 through 10.9.5\n prior to build 13F1134 and 10.10.x before 10.10.5\");\n\n script_tag(name:\"solution\", value:\"Upgrade Apple Mac OS X 10.10.x to version\n 10.10.5 or later or apply appropriate patch for Apple Mac OS X 10.9.x. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT205031\");\n script_xref(name:\"URL\", value:\"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\", re:\"ssh/login/osx_version=^10\\.(10|9)\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName || \"Mac OS X\" >!< osName){\n exit(0);\n}\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer || osVer !~ \"^10\\.(10|9)\"){\n exit(0);\n}\n\nif(osVer =~ \"^10\\.9\")\n{\n if(version_in_range(version:osVer, test_version:\"10.9\", test_version2:\"10.9.4\")){\n fix = \"Upgrade to latest OS release and apply patch from vendor\";\n }\n\n else if(osVer == \"10.9.5\")\n {\n buildVer = get_kb_item(\"ssh/login/osx_build\");\n if(buildVer)\n {\n if((osVer == \"10.9.5\" && version_is_less(version:buildVer, test_version:\"13F1134\")))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n }\n }\n}\n\nelse if(version_in_range(version:osVer, test_version:\"10.10\", test_version2:\"10.10.4\")){\n fix = \"10.10.5\";\n}\n\nif(fix)\n{\n report = report_fixed_ver(installed_version:osVer, fixed_version:fix);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "kaspersky": [{"lastseen": "2019-03-21T00:14:43", "bulletinFamily": "info", "description": "### *Detect date*:\n05/18/2015\n\n### *Severity*:\nCritical\n\n### *Description*:\nAn unspecified vulnerability was found in QuickTime. By exploiting this vulnerability malicious users can cause denial of service or execute arbitrary code. This vulnerability can be exploited remotely via a specially designed file.\n\n### *Affected products*:\nApple QuickTime versions earlier than 7.7.8\n\n### *Solution*:\nUpdate to the latest version \n[Get Apple QuickTime](<http://www.apple.com/ru/quicktime/download/>)\n\n### *Original advisories*:\n[Apple advisory](<https://support.apple.com/en-us/HT205046>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Apple QuickTime](<https://threats.kaspersky.com/en/product/Apple-QuickTime/>)\n\n### *CVE-IDS*:\n[CVE-2015-5779](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5779>)7.5Critical \n[CVE-2015-3791](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3791>)6.8Critical \n[CVE-2015-3790](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3790>)6.8Critical \n[CVE-2015-3792](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3792>)6.8Critical \n[CVE-2015-5751](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5751>)6.8Critical \n[CVE-2015-3789](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3789>)6.8Critical \n[CVE-2015-5785](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5785>)6.8Critical \n[CVE-2015-5786](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5786>)6.8Critical \n[CVE-2015-3788](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3788>)6.8Critical", "modified": "2019-03-07T00:00:00", "published": "2015-05-18T00:00:00", "id": "KLA10653", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10653", "title": "\r KLA10653Code execution vulnerability in QuickTime ", "type": "kaspersky", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2020-08-01T04:22:19", "bulletinFamily": "scanner", "description": "The version of Apple QuickTime installed on the remote Windows host is\nprior to 7.7.8. It is, therefore, affected by multiple arbitrary code\nexecution vulnerabilities :\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling URL atom\n sizes. A remote attacker can exploit this issue by\n convincing a user to open a specially crafted file,\n resulting in the execution of arbitrary code in the\n context of the current user. (CVE-2015-3788)\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling 3GPP\n STSD sample description entry sizes. A remote attacker\n can exploit this issue by convincing a user to open a\n specially crafted file, resulting in the execution of\n arbitrary code in the context of the current user.\n (CVE-2015-3789)\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling MVHD\n atom sizes. A remote attacker can exploit this issue by\n convincing a user to open a specially crafted file,\n resulting in the execution of arbitrary code in the\n context of the current user. (CVE-2015-3790)\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling\n mismatching ESDS atom descriptor type lengths. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-3791)\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling\n MDAT sections. A remote attacker can exploit this issue\n by convincing a user to open a specially crafted file,\n resulting in the execution of arbitrary code in the\n context of the current user. (CVE-2015-3792)\n\n - An unspecified memory corruption issue exists due to\n improper validation of user-supplied input. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-5751)\n\n - An unspecified memory corruption issue exists due to\n improper validation of user-supplied input. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-5779)\n\n - An unspecified memory corruption issue exists due to\n improper validation of user-supplied input. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-5785)\n\n - An unspecified memory corruption issue exists due to\n improper validation of user-supplied input. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-5786)", "modified": "2020-08-02T00:00:00", "id": "QUICKTIME_778.NASL", "href": "https://www.tenable.com/plugins/nessus/85662", "published": "2015-08-27T00:00:00", "title": "Apple QuickTime < 7.7.8 Multiple Arbitrary Code Vulnerabilities (Windows)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85662);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/11/22\");\n\n script_cve_id(\n \"CVE-2015-3788\",\n \"CVE-2015-3789\",\n \"CVE-2015-3790\",\n \"CVE-2015-3791\",\n \"CVE-2015-3792\",\n \"CVE-2015-5751\",\n \"CVE-2015-5779\",\n \"CVE-2015-5785\",\n \"CVE-2015-5786\"\n );\n script_bugtraq_id(76340, 76443, 76444);\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2015-08-20-1\");\n\n script_name(english:\"Apple QuickTime < 7.7.8 Multiple Arbitrary Code Vulnerabilities (Windows)\");\n script_summary(english:\"Checks the version of QuickTime on Windows.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains an application that is affected by\nmultiple arbitrary code execution vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Apple QuickTime installed on the remote Windows host is\nprior to 7.7.8. It is, therefore, affected by multiple arbitrary code\nexecution vulnerabilities :\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling URL atom\n sizes. A remote attacker can exploit this issue by\n convincing a user to open a specially crafted file,\n resulting in the execution of arbitrary code in the\n context of the current user. (CVE-2015-3788)\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling 3GPP\n STSD sample description entry sizes. A remote attacker\n can exploit this issue by convincing a user to open a\n specially crafted file, resulting in the execution of\n arbitrary code in the context of the current user.\n (CVE-2015-3789)\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling MVHD\n atom sizes. A remote attacker can exploit this issue by\n convincing a user to open a specially crafted file,\n resulting in the execution of arbitrary code in the\n context of the current user. (CVE-2015-3790)\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling\n mismatching ESDS atom descriptor type lengths. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-3791)\n\n - A memory corruption issue exists due to improper\n validation of user-supplied input when handling\n MDAT sections. A remote attacker can exploit this issue\n by convincing a user to open a specially crafted file,\n resulting in the execution of arbitrary code in the\n context of the current user. (CVE-2015-3792)\n\n - An unspecified memory corruption issue exists due to\n improper validation of user-supplied input. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-5751)\n\n - An unspecified memory corruption issue exists due to\n improper validation of user-supplied input. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-5779)\n\n - An unspecified memory corruption issue exists due to\n improper validation of user-supplied input. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-5785)\n\n - An unspecified memory corruption issue exists due to\n improper validation of user-supplied input. A remote\n attacker can exploit this issue by convincing a user to\n open a specially crafted file, resulting in the\n execution of arbitrary code in the context of the\n current user. (CVE-2015-5786)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT205046\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Apple QuickTime 7.7.8 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-5779\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/08/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/08/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/08/27\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:apple:quicktime\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"quicktime_installed.nasl\");\n script_require_keys(\"SMB/QuickTime/Version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nkb_base = \"SMB/QuickTime/\";\n\nversion = get_kb_item_or_exit(kb_base+\"Version\");\npath = get_kb_item_or_exit(kb_base+\"Path\");\n\nversion_ui = get_kb_item(kb_base+\"Version_UI\");\nif (isnull(version_ui)) version_report = version;\nelse version_report = version_ui;\n\nfixed_version = \"7.78.80.95\";\nfixed_version_ui = \"7.7.8 (1680.95.71)\";\n\nif (ver_compare(ver:version, fix:fixed_version) == -1)\n{\n port = get_kb_item(\"SMB/transport\");\n if (!port) port = 445;\n\n if (report_verbosity > 0)\n {\n report =\n '\\n Path : ' + path +\n '\\n Installed version : ' + version_report +\n '\\n Fixed version : ' + fixed_version_ui +\n '\\n';\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n exit(0);\n}\naudit(AUDIT_INST_PATH_NOT_VULN, 'QuickTime Player', version_report, path);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-08-01T03:05:41", "bulletinFamily": "scanner", "description": "The remote host is running a version of Mac OS X 10.8.5 or 10.9.5\nthat is missing Security Update 2015-006. It is, therefore, affected\nby multiple vulnerabilities in the following components :\n\n - apache\n - apache_mod_php\n - CoreText\n - FontParser\n - Libinfo\n - libxml2\n - OpenSSL\n - perl\n - PostgreSQL\n - QL Office\n - Quartz Composer Framework\n - QuickTime 7\n - SceneKit\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.", "modified": "2020-08-02T00:00:00", "id": "MACOSX_SECUPD2015-006.NASL", "href": "https://www.tenable.com/plugins/nessus/85409", "published": "2015-08-17T00:00:00", "title": "Mac OS X Multiple Vulnerabilities (Security Update 2015-006)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85409);\n script_version(\"1.16\");\n script_cvs_date(\"Date: 2019/11/22\");\n\n script_cve_id(\n \"CVE-2012-6685\",\n \"CVE-2014-0067\",\n \"CVE-2014-0191\",\n \"CVE-2014-3581\",\n \"CVE-2014-3583\",\n \"CVE-2014-3660\",\n \"CVE-2014-8109\",\n \"CVE-2014-8161\",\n \"CVE-2015-0228\",\n \"CVE-2015-0241\",\n \"CVE-2015-0242\",\n \"CVE-2015-0243\",\n \"CVE-2015-0244\",\n \"CVE-2015-0253\",\n \"CVE-2015-1788\",\n \"CVE-2015-1789\",\n \"CVE-2015-1790\",\n \"CVE-2015-1791\",\n \"CVE-2015-1792\",\n \"CVE-2015-2783\",\n \"CVE-2015-2787\",\n \"CVE-2015-3183\",\n \"CVE-2015-3185\",\n \"CVE-2015-3307\",\n \"CVE-2015-3329\",\n \"CVE-2015-3330\",\n \"CVE-2015-3729\",\n \"CVE-2015-3730\",\n \"CVE-2015-3731\",\n \"CVE-2015-3732\",\n \"CVE-2015-3733\",\n \"CVE-2015-3734\",\n \"CVE-2015-3735\",\n \"CVE-2015-3736\",\n \"CVE-2015-3737\",\n \"CVE-2015-3738\",\n \"CVE-2015-3739\",\n \"CVE-2015-3740\",\n \"CVE-2015-3741\",\n \"CVE-2015-3742\",\n \"CVE-2015-3743\",\n \"CVE-2015-3744\",\n \"CVE-2015-3745\",\n \"CVE-2015-3746\",\n \"CVE-2015-3747\",\n \"CVE-2015-3748\",\n \"CVE-2015-3749\",\n \"CVE-2015-3750\",\n \"CVE-2015-3751\",\n \"CVE-2015-3752\",\n \"CVE-2015-3753\",\n \"CVE-2015-3754\",\n \"CVE-2015-3755\",\n \"CVE-2015-3765\",\n \"CVE-2015-3779\",\n \"CVE-2015-3783\",\n \"CVE-2015-3788\",\n \"CVE-2015-3789\",\n \"CVE-2015-3790\",\n \"CVE-2015-3791\",\n \"CVE-2015-3792\",\n \"CVE-2015-3804\",\n \"CVE-2015-3807\",\n \"CVE-2015-4021\",\n \"CVE-2015-4022\",\n \"CVE-2015-4024\",\n \"CVE-2015-4025\",\n \"CVE-2015-4026\",\n \"CVE-2015-4147\",\n \"CVE-2015-4148\",\n \"CVE-2015-5751\",\n \"CVE-2015-5753\",\n \"CVE-2015-5756\",\n \"CVE-2015-5761\",\n \"CVE-2015-5771\",\n \"CVE-2015-5773\",\n \"CVE-2015-5775\",\n \"CVE-2015-5776\",\n \"CVE-2015-5779\"\n );\n script_bugtraq_id(\n 65721,\n 67233,\n 70644,\n 71656,\n 71657,\n 72538,\n 72540,\n 72542,\n 72543,\n 73040,\n 73041,\n 73357,\n 73431,\n 74174,\n 74204,\n 74239,\n 74240,\n 74700,\n 74703,\n 74902,\n 74903,\n 74904,\n 75056,\n 75103,\n 75154,\n 75156,\n 75157,\n 75158,\n 75161,\n 75963,\n 75964,\n 75965,\n 76338,\n 76339,\n 76340,\n 76341,\n 76342,\n 76343,\n 76344\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2015-08-13-2\");\n\n script_name(english:\"Mac OS X Multiple Vulnerabilities (Security Update 2015-006)\");\n script_summary(english:\"Checks for the presence of Security Update 2015-006.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is missing a Mac OS X update that fixes multiple\nsecurity vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X 10.8.5 or 10.9.5\nthat is missing Security Update 2015-006. It is, therefore, affected\nby multiple vulnerabilities in the following components :\n\n - apache\n - apache_mod_php\n - CoreText\n - FontParser\n - Libinfo\n - libxml2\n - OpenSSL\n - perl\n - PostgreSQL\n - QL Office\n - Quartz Composer Framework\n - QuickTime 7\n - SceneKit\n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT205031\");\n script_set_attribute(attribute:\"solution\", value:\n\"Install Security Update 2015-006 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-5779\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2012/06/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/08/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/08/17\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/MacOSX/Version\", \"Host/MacOSX/packages/boms\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\npatch = \"2015-006\";\n\n# Compare 2 patch numbers to determine if patch requirements are satisfied.\n# Return true if this patch or a later patch is applied\n# Return false otherwise\nfunction check_patch(year, number)\n{\n local_var p_split = split(patch, sep:\"-\");\n local_var p_year = int( p_split[0]);\n local_var p_num = int( p_split[1]);\n\n if (year > p_year) return TRUE;\n else if (year < p_year) return FALSE;\n else if (number >= p_num) return TRUE;\n else return FALSE;\n}\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\n# Advisory states that the update is available for 10.10.2\nos = get_kb_item(\"Host/MacOSX/Version\");\nif (!os) audit(AUDIT_OS_NOT, \"Mac OS X\");\nif (!ereg(pattern:\"Mac OS X 10\\.[89]\\.5([^0-9]|$)\", string:os)) audit(AUDIT_OS_NOT, \"Mac OS X 10.8.5 or Mac OS X 10.9.5\");\n\npackages = get_kb_item_or_exit(\"Host/MacOSX/packages/boms\", exit_code:1);\nsec_boms_report = egrep(pattern:\"^com\\.apple\\.pkg\\.update\\.security\\..*bom$\", string:packages);\nsec_boms = split(sec_boms_report, sep:'\\n');\n\nforeach package (sec_boms)\n{\n # Grab patch year and number\n match = eregmatch(pattern:\"[^0-9](20[0-9][0-9])[-.]([0-9]{3})[^0-9]\", string:package);\n if (empty_or_null(match[1]) || empty_or_null(match[2]))\n continue;\n\n patch_found = check_patch(year:int(match[1]), number:int(match[2]));\n if (patch_found) exit(0, \"The host has Security Update \" + patch + \" or later installed and is therefore not affected.\");\n}\n\nreport = '\\n Missing security update : ' + patch;\nreport += '\\n Installed security BOMs : ';\nif (sec_boms_report) report += str_replace(find:'\\n', replace:'\\n ', string:sec_boms_report);\nelse report += 'n/a';\nreport += '\\n';\n\nsecurity_report_v4(port:0, severity:SECURITY_HOLE, extra:report);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-08-01T03:04:23", "bulletinFamily": "scanner", "description": "The remote host is running a version of Mac OS X 10.10.x that is prior\nto 10.10.5. It is, therefore, affected by multiple vulnerabilities in\nthe following components :\n\n - apache\n - apache_mod_php\n - Apple ID OD Plug-in\n - AppleGraphicsControl\n - Bluetooth\n - bootp\n - CloudKit\n - CoreMedia Playback\n - CoreText\n - curl\n - Data Detectors Engine\n - Date & Time pref pane\n - Dictionary Application\n - DiskImages\n - dyld\n - FontParser\n - groff\n - ImageIO\n - Install Framework Legacy\n - IOFireWireFamily\n - IOGraphics\n - IOHIDFamily\n - Kernel\n - Libc\n - Libinfo\n - libpthread\n - libxml2\n - libxpc\n - mail_cmds\n - Notification Center OSX\n - ntfs\n - OpenSSH\n - OpenSSL\n - perl\n - PostgreSQL\n - python\n - QL Office\n - Quartz Composer Framework\n - Quick Look\n - QuickTime 7\n - SceneKit\n - Security\n - SMBClient\n - Speech UI\n - sudo\n - tcpdump\n - Text Formats\n - udf \n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.", "modified": "2020-08-02T00:00:00", "id": "MACOSX_10_10_5.NASL", "href": "https://www.tenable.com/plugins/nessus/85408", "published": "2015-08-17T00:00:00", "title": "Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(85408);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2018/07/16 12:48:31\");\n\n script_cve_id(\n \"CVE-2009-5044\",\n \"CVE-2009-5078\",\n \"CVE-2012-6685\",\n \"CVE-2013-1775\",\n \"CVE-2013-1776\",\n \"CVE-2013-2776\",\n \"CVE-2013-2777\",\n \"CVE-2013-7040\",\n \"CVE-2013-7338\",\n \"CVE-2013-7422\",\n \"CVE-2014-0067\",\n \"CVE-2014-0106\",\n \"CVE-2014-0191\",\n \"CVE-2014-1912\",\n \"CVE-2014-3581\",\n \"CVE-2014-3583\",\n \"CVE-2014-3613\",\n \"CVE-2014-3620\",\n \"CVE-2014-3660\",\n \"CVE-2014-3707\",\n \"CVE-2014-7185\",\n \"CVE-2014-7844\",\n \"CVE-2014-8109\",\n \"CVE-2014-8150\",\n \"CVE-2014-8151\",\n \"CVE-2014-8161\",\n \"CVE-2014-8767\",\n \"CVE-2014-8769\",\n \"CVE-2014-9140\",\n \"CVE-2014-9365\",\n \"CVE-2014-9680\",\n \"CVE-2015-0228\",\n \"CVE-2015-0241\",\n \"CVE-2015-0242\",\n \"CVE-2015-0243\",\n \"CVE-2015-0244\",\n \"CVE-2015-0253\",\n \"CVE-2015-1788\",\n \"CVE-2015-1789\",\n \"CVE-2015-1790\",\n \"CVE-2015-1791\",\n \"CVE-2015-1792\",\n \"CVE-2015-2783\",\n \"CVE-2015-2787\",\n \"CVE-2015-3143\",\n \"CVE-2015-3144\",\n \"CVE-2015-3145\",\n \"CVE-2015-3148\",\n \"CVE-2015-3153\",\n \"CVE-2015-3183\",\n \"CVE-2015-3185\",\n \"CVE-2015-3307\",\n \"CVE-2015-3329\",\n \"CVE-2015-3330\",\n \"CVE-2015-3729\",\n \"CVE-2015-3730\",\n \"CVE-2015-3731\",\n \"CVE-2015-3732\",\n \"CVE-2015-3733\",\n \"CVE-2015-3734\",\n \"CVE-2015-3735\",\n \"CVE-2015-3736\",\n \"CVE-2015-3737\",\n \"CVE-2015-3738\",\n \"CVE-2015-3739\",\n \"CVE-2015-3740\",\n \"CVE-2015-3741\",\n \"CVE-2015-3742\",\n \"CVE-2015-3743\",\n \"CVE-2015-3744\",\n \"CVE-2015-3745\",\n \"CVE-2015-3746\",\n \"CVE-2015-3747\",\n \"CVE-2015-3748\",\n \"CVE-2015-3749\",\n \"CVE-2015-3750\",\n \"CVE-2015-3751\",\n \"CVE-2015-3752\",\n \"CVE-2015-3753\",\n \"CVE-2015-3754\",\n \"CVE-2015-3755\",\n \"CVE-2015-3757\",\n \"CVE-2015-3760\",\n \"CVE-2015-3761\",\n \"CVE-2015-3762\",\n \"CVE-2015-3764\",\n \"CVE-2015-3765\",\n \"CVE-2015-3766\",\n \"CVE-2015-3767\",\n \"CVE-2015-3768\",\n \"CVE-2015-3769\",\n \"CVE-2015-3770\",\n \"CVE-2015-3771\",\n \"CVE-2015-3772\",\n \"CVE-2015-3773\",\n \"CVE-2015-3774\",\n \"CVE-2015-3775\",\n \"CVE-2015-3776\",\n \"CVE-2015-3777\",\n \"CVE-2015-3778\",\n \"CVE-2015-3779\",\n \"CVE-2015-3780\",\n \"CVE-2015-3781\",\n \"CVE-2015-3782\",\n \"CVE-2015-3783\",\n \"CVE-2015-3784\",\n \"CVE-2015-3786\",\n \"CVE-2015-3787\",\n \"CVE-2015-3788\",\n \"CVE-2015-3789\",\n \"CVE-2015-3790\",\n \"CVE-2015-3791\",\n \"CVE-2015-3792\",\n \"CVE-2015-3794\",\n \"CVE-2015-3795\",\n \"CVE-2015-3796\",\n \"CVE-2015-3797\",\n \"CVE-2015-3798\",\n \"CVE-2015-3799\",\n \"CVE-2015-3800\",\n \"CVE-2015-3802\",\n \"CVE-2015-3803\",\n \"CVE-2015-3804\",\n \"CVE-2015-3805\",\n \"CVE-2015-3806\",\n \"CVE-2015-3807\",\n \"CVE-2015-4021\",\n \"CVE-2015-4022\",\n \"CVE-2015-4024\",\n \"CVE-2015-4025\",\n \"CVE-2015-4026\",\n \"CVE-2015-4147\",\n \"CVE-2015-4148\",\n \"CVE-2015-5600\",\n \"CVE-2015-5747\",\n \"CVE-2015-5748\",\n \"CVE-2015-5750\",\n \"CVE-2015-5751\",\n \"CVE-2015-5753\",\n \"CVE-2015-5754\",\n \"CVE-2015-5755\",\n \"CVE-2015-5756\",\n \"CVE-2015-5757\",\n \"CVE-2015-5758\",\n \"CVE-2015-5761\",\n \"CVE-2015-5763\",\n \"CVE-2015-5768\",\n \"CVE-2015-5771\",\n \"CVE-2015-5772\",\n \"CVE-2015-5773\",\n \"CVE-2015-5774\",\n \"CVE-2015-5775\",\n \"CVE-2015-5776\",\n \"CVE-2015-5777\",\n \"CVE-2015-5778\",\n \"CVE-2015-5779\",\n \"CVE-2015-5781\",\n \"CVE-2015-5782\",\n \"CVE-2015-5783\",\n \"CVE-2015-5784\"\n );\n script_bugtraq_id(\n 36381,\n 58203,\n 58207,\n 62741,\n 64194,\n 65179,\n 65379,\n 65721,\n 65997,\n 67233,\n 69742,\n 69748,\n 70089,\n 70644,\n 70988,\n 71150,\n 71153,\n 71468,\n 71639,\n 71656,\n 71657,\n 71701,\n 71964,\n 72538,\n 72540,\n 72542,\n 72543,\n 72649,\n 72981,\n 73040,\n 73041,\n 73357,\n 73431,\n 74174,\n 74204,\n 74239,\n 74240,\n 74299,\n 74300,\n 74301,\n 74303,\n 74408,\n 74700,\n 74703,\n 74902,\n 74903,\n 74904,\n 75056,\n 75103,\n 75154,\n 75156,\n 75157,\n 75158,\n 75161,\n 75704,\n 75963,\n 75964,\n 75965,\n 75990,\n 76337,\n 76338,\n 76339,\n 76340,\n 76341,\n 76342,\n 76343,\n 76344\n );\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2015-08-13-2\");\n\n script_name(english:\"Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of Mac OS X.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is missing a Mac OS X update that fixes multiple\nsecurity vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X 10.10.x that is prior\nto 10.10.5. It is, therefore, affected by multiple vulnerabilities in\nthe following components :\n\n - apache\n - apache_mod_php\n - Apple ID OD Plug-in\n - AppleGraphicsControl\n - Bluetooth\n - bootp\n - CloudKit\n - CoreMedia Playback\n - CoreText\n - curl\n - Data Detectors Engine\n - Date & Time pref pane\n - Dictionary Application\n - DiskImages\n - dyld\n - FontParser\n - groff\n - ImageIO\n - Install Framework Legacy\n - IOFireWireFamily\n - IOGraphics\n - IOHIDFamily\n - Kernel\n - Libc\n - Libinfo\n - libpthread\n - libxml2\n - libxpc\n - mail_cmds\n - Notification Center OSX\n - ntfs\n - OpenSSH\n - OpenSSL\n - perl\n - PostgreSQL\n - python\n - QL Office\n - Quartz Composer Framework\n - Quick Look\n - QuickTime 7\n - SceneKit\n - Security\n - SMBClient\n - Speech UI\n - sudo\n - tcpdump\n - Text Formats\n - udf \n\nNote that successful exploitation of the most serious issues can\nresult in arbitrary code execution.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT205031\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mac OS X 10.10.5 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Apple OS X DYLD_PRINT_TO_FILE Privilege Escalation');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/07/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/08/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/08/17\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"os_fingerprint.nasl\");\n script_require_ports(\"Host/MacOSX/Version\", \"Host/OS\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nos = get_kb_item(\"Host/MacOSX/Version\");\nif (!os)\n{\n os = get_kb_item_or_exit(\"Host/OS\");\n if (\"Mac OS X\" >!< os) audit(AUDIT_OS_NOT, \"Mac OS X\");\n\n c = get_kb_item(\"Host/OS/Confidence\");\n if (c <= 70) exit(1, \"Can't determine the host's OS with sufficient confidence.\");\n}\nif (!os) audit(AUDIT_OS_NOT, \"Mac OS X\");\n\nmatch = eregmatch(pattern:\"Mac OS X ([0-9]+(\\.[0-9]+)+)\", string:os);\nif (isnull(match)) exit(1, \"Failed to parse the Mac OS X version ('\" + os + \"').\");\n\nversion = match[1];\nif (!ereg(pattern:\"^10\\.10([^0-9]|$)\", string:version)) audit(AUDIT_OS_NOT, \"Mac OS X 10.10\", \"Mac OS X \"+version);\n\nfixed_version = \"10.10.5\";\nif (ver_compare(ver:version, fix:fixed_version, strict:FALSE) == -1)\n{\n if (report_verbosity > 0)\n {\n report = '\\n Installed version : ' + version +\n '\\n Fixed version : ' + fixed_version +\n '\\n';\n security_hole(port:0, extra:report);\n }\n else security_hole(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected since it is running Mac OS X \"+version+\".\");\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "securityvulns": [{"lastseen": "2018-08-31T11:11:01", "bulletinFamily": "software", "description": "\r\n\r\nAPPLE-SA-2015-08-20-1 QuickTime 7.7.8\r\n\r\nQuickTime 7.7.8 is now available and addresses the following:\r\n\r\nQuickTime\r\nAvailable for: Windows 7 and Windows Vista\r\nImpact: Processing a maliciously crafted file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Multiple memory corruption issues existed in QuickTime.\r\nThese issues were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3788 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3789 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3790 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3791 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3792 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-5751 : WalkerFuz\r\nCVE-2015-5779 : Apple\r\nCVE-2015-5785 : Fortinet&#39;s FortiGuard Labs\r\nCVE-2015-5786 : Ryan Pentney and Richard Johnson of Cisco Talos\r\n\r\n\r\nQuickTime 7.7.8 may be obtained from the QuickTime Downloads site:\r\nhttp://www.apple.com/quicktime/download/\r\n\r\nYou may also update to the latest version of QuickTime via Apple\r\nSoftware Update, which can be found in the Start menu.\r\n\r\nInformation will also be posted to the Apple Security Updates\r\nweb site: https://support.apple.com/kb/HT201222\r\n\r\nThis message is signed with Apple&#39;s Product Security PGP key,\r\nand details are available at:\r\nhttps://www.apple.com/support/security/pgp/\r\n\r\n", "modified": "2015-08-23T00:00:00", "published": "2015-08-23T00:00:00", "id": "SECURITYVULNS:DOC:32394", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32394", "title": "APPLE-SA-2015-08-20-1 QuickTime 7.7.8", "type": "securityvulns", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:02", "bulletinFamily": "software", "description": "Multiple memory corruptions.", "modified": "2015-08-23T00:00:00", "published": "2015-08-23T00:00:00", "id": "SECURITYVULNS:VULN:14633", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14633", "title": "Apple QuickTime multiple security vulnerabilities", "type": "securityvulns", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:01", "bulletinFamily": "software", "description": "Over 150 different vulnerabilities in system components and libraries.", "modified": "2015-08-17T00:00:00", "published": "2015-08-17T00:00:00", "id": "SECURITYVULNS:VULN:14630", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14630", "title": "Apple Mac OS X / OS X Server multiple security vulnerabilities", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:11:00", "bulletinFamily": "software", "description": "\r\n\r\nAPPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update\r\n2015-006\r\n\r\nOS X Yosemite v10.10.5 and Security Update 2015-006 is now available\r\nand addresses the following:\r\n\r\napache\r\nAvailable for: OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in Apache 2.4.16, the most\r\nserious of which may allow a remote attacker to cause a denial of\r\nservice.\r\nDescription: Multiple vulnerabilities existed in Apache versions\r\nprior to 2.4.16. These were addressed by updating Apache to version\r\n2.4.16.\r\nCVE-ID\r\nCVE-2014-3581\r\nCVE-2014-3583\r\nCVE-2014-8109\r\nCVE-2015-0228\r\nCVE-2015-0253\r\nCVE-2015-3183\r\nCVE-2015-3185\r\n\r\napache_mod_php\r\nAvailable for: OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in PHP 5.5.20, the most\r\nserious of which may lead to arbitrary code execution.\r\nDescription: Multiple vulnerabilities existed in PHP versions prior\r\nto 5.5.20. These were addressed by updating Apache to version 5.5.27.\r\nCVE-ID\r\nCVE-2015-2783\r\nCVE-2015-2787\r\nCVE-2015-3307\r\nCVE-2015-3329\r\nCVE-2015-3330\r\nCVE-2015-4021\r\nCVE-2015-4022\r\nCVE-2015-4024\r\nCVE-2015-4025\r\nCVE-2015-4026\r\nCVE-2015-4147\r\nCVE-2015-4148\r\n\r\nApple ID OD Plug-in\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able change the password of a\r\nlocal user\r\nDescription: In some circumstances, a state management issue existed\r\nin password authentication. The issue was addressed through improved\r\nstate management.\r\nCVE-ID\r\nCVE-2015-3799 : an anonymous researcher working with HP&#39;s Zero Day\r\nInitiative\r\n\r\nAppleGraphicsControl\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to determine kernel\r\nmemory layout\r\nDescription: An issue existed in AppleGraphicsControl which could\r\nhave led to the disclosure of kernel memory layout. This issue was\r\naddressed through improved bounds checking.\r\nCVE-ID\r\nCVE-2015-5768 : JieTao Yang of KeenTeam\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A memory corruption issue existed in\r\nIOBluetoothHCIController. This issue was addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2015-3779 : Teddy Reed of Facebook Security\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to determine kernel\r\nmemory layout\r\nDescription: A memory management issue could have led to the\r\ndisclosure of kernel memory layout. This issue was addressed with\r\nimproved memory management.\r\nCVE-ID\r\nCVE-2015-3780 : Roberto Paleari and Aristide Fattori of Emaze\r\nNetworks\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious app may be able to access notifications from\r\nother iCloud devices\r\nDescription: An issue existed where a malicious app could access a\r\nBluetooth-paired Mac or iOS device&#39;s Notification Center\r\nnotifications via the Apple Notification Center Service. The issue\r\naffected devices using Handoff and logged into the same iCloud\r\naccount. This issue was resolved by revoking access to the Apple\r\nNotification Center Service.\r\nCVE-ID\r\nCVE-2015-3786 : Xiaolong Bai &#40;Tsinghua University&#41;, System Security\r\nLab &#40;Indiana University&#41;, Tongxin Li &#40;Peking University&#41;, XiaoFeng\r\nWang &#40;Indiana University&#41;\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: An attacker with privileged network position may be able to\r\nperform denial of service attack using malformed Bluetooth packets\r\nDescription: An input validation issue existed in parsing of\r\nBluetooth ACL packets. This issue was addressed through improved\r\ninput validation.\r\nCVE-ID\r\nCVE-2015-3787 : Trend Micro\r\n\r\nBluetooth\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local attacker may be able to cause unexpected application\r\ntermination or arbitrary code execution\r\nDescription: Multiple buffer overflow issues existed in blued&#39;s\r\nhandling of XPC messages. These issues were addressed through\r\nimproved bounds checking.\r\nCVE-ID\r\nCVE-2015-3777 : mitp0sh of [PDX]\r\n\r\nbootp\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious Wi-Fi network may be able to determine networks\r\na device has previously accessed\r\nDescription: Upon connecting to a Wi-Fi network, iOS may have\r\nbroadcast MAC addresses of previously accessed networks via the DNAv4\r\nprotocol. This issue was addressed through disabling DNAv4 on\r\nunencrypted Wi-Fi networks.\r\nCVE-ID\r\nCVE-2015-3778 : Piers O&#39;Hanlon of Oxford Internet Institute,\r\nUniversity of Oxford &#40;on the EPSRC Being There project&#41;\r\n\r\nCloudKit\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to access the iCloud\r\nuser record of a previously signed in user\r\nDescription: A state inconsistency existed in CloudKit when signing\r\nout users. This issue was addressed through improved state handling.\r\nCVE-ID\r\nCVE-2015-3782 : Deepkanwal Plaha of University of Toronto\r\n\r\nCoreMedia Playback\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Viewing a maliciously crafted movie file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Memory corruption issues existed in CoreMedia Playback.\r\nThese were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5777 : Apple\r\nCVE-2015-5778 : Apple\r\n\r\nCoreText\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted font file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nfont files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-5761 : John Villamil &#40;@day6reak&#41;, Yahoo Pentest Team\r\n\r\nCoreText\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted font file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nfont files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-5755 : John Villamil &#40;@day6reak&#41;, Yahoo Pentest Team\r\n\r\ncurl\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities in cURL and libcurl prior to\r\n7.38.0, one of which may allow remote attackers to bypass the Same\r\nOrigin Policy.\r\nDescription: Multiple vulnerabilities existed in cURL and libcurl\r\nprior to 7.38.0. These issues were addressed by updating cURL to\r\nversion 7.43.0.\r\nCVE-ID\r\nCVE-2014-3613\r\nCVE-2014-3620\r\nCVE-2014-3707\r\nCVE-2014-8150\r\nCVE-2014-8151\r\nCVE-2015-3143\r\nCVE-2015-3144\r\nCVE-2015-3145\r\nCVE-2015-3148\r\nCVE-2015-3153\r\n\r\nData Detectors Engine\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a sequence of unicode characters can lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Memory corruption issues existed in processing of\r\nUnicode characters. These issues were addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2015-5750 : M1x7e1 of Safeye Team &#40;www.safeye.org&#41;\r\n\r\nDate &amp; Time pref pane\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Applications that rely on system time may have unexpected\r\nbehavior\r\nDescription: An authorization issue existed when modifying the\r\nsystem date and time preferences. This issue was addressed with\r\nadditional authorization checks.\r\nCVE-ID\r\nCVE-2015-3757 : Mark S C Smith\r\n\r\nDictionary Application\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: An attacker with a privileged network position may be able\r\nto intercept users&#39; Dictionary app queries\r\nDescription: An issue existed in the Dictionary app, which did not\r\nproperly secure user communications. This issue was addressed by\r\nmoving Dictionary queries to HTTPS.\r\nCVE-ID\r\nCVE-2015-3774 : Jeffrey Paul of EEQJ, Jan Bee of the Google Security\r\nTeam\r\n\r\nDiskImages\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted DMG file may lead to an\r\nunexpected application termination or arbitrary code execution with\r\nsystem privileges\r\nDescription: A memory corruption issue existed in parsing of\r\nmalformed DMG images. This issue was addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2015-3800 : Frank Graziano of the Yahoo Pentest Team\r\n\r\ndyld\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A path validation issue existed in dyld. This was\r\naddressed through improved environment sanitization.\r\nCVE-ID\r\nCVE-2015-3760 : beist of grayhash, Stefan Esser\r\n\r\nFontParser\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted font file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nfont files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-3804 : Apple\r\nCVE-2015-5775 : Apple\r\n\r\nFontParser\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted font file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nfont files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-5756 : John Villamil &#40;@day6reak&#41;, Yahoo Pentest Team\r\n\r\ngroff\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple issues in pdfroff\r\nDescription: Multiple issues existed in pdfroff, the most serious of\r\nwhich may allow arbitrary filesystem modification. These issues were\r\naddressed by removing pdfroff.\r\nCVE-ID\r\nCVE-2009-5044\r\nCVE-2009-5078\r\n\r\nImageIO\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted TIFF image may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the processing of\r\nTIFF images. This issue was addressed through improved bounds\r\nchecking.\r\nCVE-ID\r\nCVE-2015-5758 : Apple\r\n\r\nImageIO\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Visiting a maliciously crafted website may result in the\r\ndisclosure of process memory\r\nDescription: An uninitialized memory access issue existed in\r\nImageIO&#39;s handling of PNG and TIFF images. Visiting a malicious\r\nwebsite may result in sending data from process memory to the\r\nwebsite. This issue is addressed through improved memory\r\ninitialization and additional validation of PNG and TIFF images.\r\nCVE-ID\r\nCVE-2015-5781 : Michal Zalewski\r\nCVE-2015-5782 : Michal Zalewski\r\n\r\nInstall Framework Legacy\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with root privileges\r\nDescription: An issue existed in how Install.framework&#39;s &#39;runner&#39;\r\nbinary dropped privileges. This issue was addressed through improved\r\nprivilege management.\r\nCVE-ID\r\nCVE-2015-5784 : Ian Beer of Google Project Zero\r\n\r\nInstall Framework Legacy\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: A race condition existed in\r\nInstall.framework&#39;s &#39;runner&#39; binary that resulted in\r\nprivileges being incorrectly dropped. This issue was addressed\r\nthrough improved object locking.\r\nCVE-ID\r\nCVE-2015-5754 : Ian Beer of Google Project Zero\r\n\r\nIOFireWireFamily\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: Memory corruption issues existed in IOFireWireFamily.\r\nThese issues were addressed through additional type input validation.\r\nCVE-ID\r\nCVE-2015-3769 : Ilja van Sprundel\r\nCVE-2015-3771 : Ilja van Sprundel\r\nCVE-2015-3772 : Ilja van Sprundel\r\n\r\nIOGraphics\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: A memory corruption issue existed in IOGraphics. This\r\nissue was addressed through additional type input validation.\r\nCVE-ID\r\nCVE-2015-3770 : Ilja van Sprundel\r\nCVE-2015-5783 : Ilja van Sprundel\r\n\r\nIOHIDFamily\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A buffer overflow issue existed in IOHIDFamily. This\r\nissue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5774 : TaiG Jailbreak Team\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to determine kernel\r\nmemory layout\r\nDescription: An issue existed in the mach_port_space_info interface,\r\nwhich could have led to the disclosure of kernel memory layout. This\r\nwas addressed by disabling the mach_port_space_info interface.\r\nCVE-ID\r\nCVE-2015-3766 : Cererdlong of Alibaba Mobile Security Team,\r\n@PanguTeam\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: An integer overflow existed in the handling of IOKit\r\nfunctions. This issue was addressed through improved validation of\r\nIOKit API arguments.\r\nCVE-ID\r\nCVE-2015-3768 : Ilja van Sprundel\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to cause a system denial of service\r\nDescription: A resource exhaustion issue existed in the fasttrap\r\ndriver. This was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5747 : Maxime VILLARD of m00nbsd\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to cause a system denial of service\r\nDescription: A validation issue existed in the mounting of HFS\r\nvolumes. This was addressed by adding additional checks.\r\nCVE-ID\r\nCVE-2015-5748 : Maxime VILLARD of m00nbsd\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute unsigned code\r\nDescription: An issue existed that allowed unsigned code to be\r\nappended to signed code in a specially crafted executable file. This\r\nissue was addressed through improved code signature validation.\r\nCVE-ID\r\nCVE-2015-3806 : TaiG Jailbreak Team\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A specially crafted executable file could allow unsigned,\r\nmalicious code to execute\r\nDescription: An issue existed in the way multi-architecture\r\nexecutable files were evaluated that could have allowed unsigned code\r\nto be executed. This issue was addressed through improved validation\r\nof executable files.\r\nCVE-ID\r\nCVE-2015-3803 : TaiG Jailbreak Team\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute unsigned code\r\nDescription: A validation issue existed in the handling of Mach-O\r\nfiles. This was addressed by adding additional checks.\r\nCVE-ID\r\nCVE-2015-3802 : TaiG Jailbreak Team\r\nCVE-2015-3805 : TaiG Jailbreak Team\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted plist may lead to an\r\nunexpected application termination or arbitrary code execution with\r\nsystem privileges\r\nDescription: A memory corruption existed in processing of malformed\r\nplists. This issue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3776 : Teddy Reed of Facebook Security, Patrick Stein\r\n&#40;@jollyjinx&#41; of Jinx Germany\r\n\r\nKernel\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A path validation issue existed. This was addressed\r\nthrough improved environment sanitization.\r\nCVE-ID\r\nCVE-2015-3761 : Apple\r\n\r\nLibc\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted regular expression may lead\r\nto an unexpected application termination or arbitrary code execution\r\nDescription: Memory corruption issues existed in the TRE library.\r\nThese were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3796 : Ian Beer of Google Project Zero\r\nCVE-2015-3797 : Ian Beer of Google Project Zero\r\nCVE-2015-3798 : Ian Beer of Google Project Zero\r\n\r\nLibinfo\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: A remote attacker may be able to cause unexpected\r\napplication termination or arbitrary code execution\r\nDescription: Memory corruption issues existed in handling AF_INET6\r\nsockets. These were addressed by improved memory handling.\r\nCVE-ID\r\nCVE-2015-5776 : Apple\r\n\r\nlibpthread\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: A memory corruption issue existed in handling syscalls.\r\nThis issue was addressed through improved lock state checking.\r\nCVE-ID\r\nCVE-2015-5757 : Lufeng Li of Qihoo 360\r\n\r\nlibxml2\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in libxml2 versions prior\r\nto 2.9.2, the most serious of which may allow a remote attacker to\r\ncause a denial of service\r\nDescription: Multiple vulnerabilities existed in libxml2 versions\r\nprior to 2.9.2. These were addressed by updating libxml2 to version\r\n2.9.2.\r\nCVE-ID\r\nCVE-2012-6685 : Felix Groebert of Google\r\nCVE-2014-0191 : Felix Groebert of Google\r\n\r\nlibxml2\r\nAvailable for: OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted XML document may lead to\r\ndisclosure of user information\r\nDescription: A memory access issue existed in libxml2. This was\r\naddressed by improved memory handling\r\nCVE-ID\r\nCVE-2014-3660 : Felix Groebert of Google\r\n\r\nlibxml2\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted XML document may lead to\r\ndisclosure of user information\r\nDescription: A memory corruption issue existed in parsing of XML\r\nfiles. This issue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3807 : Apple\r\n\r\nlibxpc\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to execute arbitrary\r\ncode with system privileges\r\nDescription: A memory corruption issue existed in handling of\r\nmalformed XPC messages. This issue was improved through improved\r\nbounds checking.\r\nCVE-ID\r\nCVE-2015-3795 : Mathew Rowley\r\n\r\nmail_cmds\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary shell commands\r\nDescription: A validation issue existed in the mailx parsing of\r\nemail addresses. This was addressed by improved sanitization.\r\nCVE-ID\r\nCVE-2014-7844\r\n\r\nNotification Center OSX\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A malicious application may be able to access all\r\nnotifications previously displayed to users\r\nDescription: An issue existed in Notification Center, which did not\r\nproperly delete user notifications. This issue was addressed by\r\ncorrectly deleting notifications dismissed by users.\r\nCVE-ID\r\nCVE-2015-3764 : Jonathan Zdziarski\r\n\r\nntfs\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A local user may be able to execute arbitrary code with\r\nsystem privileges\r\nDescription: A memory corruption issue existed in NTFS. This issue\r\nwas addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5763 : Roberto Paleari and Aristide Fattori of Emaze\r\nNetworks\r\n\r\nOpenSSH\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Remote attackers may be able to circumvent a time delay for\r\nfailed login attempts and conduct brute-force attacks\r\nDescription: An issue existed when processing keyboard-interactive\r\ndevices. This issue was addressed through improved authentication\r\nrequest validation.\r\nCVE-ID\r\nCVE-2015-5600\r\n\r\nOpenSSL\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in OpenSSL versions prior\r\nto 0.9.8zg, the most serious of which may allow a remote attacker to\r\ncause a denial of service.\r\nDescription: Multiple vulnerabilities existed in OpenSSL versions\r\nprior to 0.9.8zg. These were addressed by updating OpenSSL to version\r\n0.9.8zg.\r\nCVE-ID\r\nCVE-2015-1788\r\nCVE-2015-1789\r\nCVE-2015-1790\r\nCVE-2015-1791\r\nCVE-2015-1792\r\n\r\nperl\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted regular expression may lead to\r\ndisclosure of unexpected application termination or arbitrary code\r\nexecution\r\nDescription: An integer underflow issue existed in the way Perl\r\nparsed regular expressions. This issue was addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2013-7422\r\n\r\nPostgreSQL\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: An attacker may be able to cause unexpected application\r\ntermination or gain access to data without proper authentication\r\nDescription: Multiple issues existed in PostgreSQL 9.2.4. These\r\nissues were addressed by updating PostgreSQL to 9.2.13.\r\nCVE-ID\r\nCVE-2014-0067\r\nCVE-2014-8161\r\nCVE-2015-0241\r\nCVE-2015-0242\r\nCVE-2015-0243\r\nCVE-2015-0244\r\n\r\npython\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in Python 2.7.6, the most\r\nserious of which may lead to arbitrary code execution\r\nDescription: Multiple vulnerabilities existed in Python versions\r\nprior to 2.7.6. These were addressed by updating Python to version\r\n2.7.10.\r\nCVE-ID\r\nCVE-2013-7040\r\nCVE-2013-7338\r\nCVE-2014-1912\r\nCVE-2014-7185\r\nCVE-2014-9365\r\n\r\nQL Office\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted Office document may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in parsing of Office\r\ndocuments. This issue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-5773 : Apple\r\n\r\nQL Office\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted XML file may lead to\r\ndisclosure of user information\r\nDescription: An external entity reference issue existed in XML file\r\nparsing. This issue was addressed through improved parsing.\r\nCVE-ID\r\nCVE-2015-3784 : Bruno Morisson of INTEGRITY S.A.\r\n\r\nQuartz Composer Framework\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted QuickTime file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in parsing of\r\nQuickTime files. This issue was addressed through improved memory\r\nhandling.\r\nCVE-ID\r\nCVE-2015-5771 : Apple\r\n\r\nQuick Look\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Searching for a previously viewed website may launch the web\r\nbrowser and render that website\r\nDescription: An issue existed where QuickLook had the capability to\r\nexecute JavaScript. The issue was addressed by disallowing execution\r\nof JavaScript.\r\nCVE-ID\r\nCVE-2015-3781 : Andrew Pouliot of Facebook, Anto Loyola of Qubole\r\n\r\nQuickTime 7\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Multiple memory corruption issues existed in QuickTime.\r\nThese issues were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3772\r\nCVE-2015-3779\r\nCVE-2015-5753 : Apple\r\nCVE-2015-5779 : Apple\r\n\r\nQuickTime 7\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted file may lead to an\r\nunexpected application termination or arbitrary code execution\r\nDescription: Multiple memory corruption issues existed in QuickTime.\r\nThese issues were addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3765 : Joe Burnett of Audio Poison\r\nCVE-2015-3788 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3789 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3790 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3791 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-3792 : Ryan Pentney and Richard Johnson of Cisco Talos\r\nCVE-2015-5751 : WalkerFuz\r\n\r\nSceneKit\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Viewing a maliciously crafted Collada file may lead to\r\narbitrary code execution\r\nDescription: A heap buffer overflow existed in SceneKit&#39;s handling\r\nof Collada files. This issue was addressed through improved input\r\nvalidation.\r\nCVE-ID\r\nCVE-2015-5772 : Apple\r\n\r\nSceneKit\r\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,\r\nOS X Yosemite v10.10 to v10.10.4\r\nImpact: A remote attacker may be able to cause unexpected\r\napplication termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in SceneKit. This\r\nissue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3783 : Haris Andrianakis of Google Security Team\r\n\r\nSecurity\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A standard user may be able to gain access to admin\r\nprivileges without proper authentication\r\nDescription: An issue existed in handling of user authentication.\r\nThis issue was addressed through improved authentication checks.\r\nCVE-ID\r\nCVE-2015-3775 : [Eldon Ahrold]\r\n\r\nSMBClient\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: A remote attacker may be able to cause unexpected\r\napplication termination or arbitrary code execution\r\nDescription: A memory corruption issue existed in the SMB client.\r\nThis issue was addressed through improved memory handling.\r\nCVE-ID\r\nCVE-2015-3773 : Ilja van Sprundel\r\n\r\nSpeech UI\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted unicode string with speech\r\nalerts enabled may lead to an unexpected application termination or\r\narbitrary code execution\r\nDescription: A memory corruption issue existed in handling of\r\nUnicode strings. This issue was addressed by improved memory\r\nhandling.\r\nCVE-ID\r\nCVE-2015-3794 : Adam Greenbaum of Refinitive\r\n\r\nsudo\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in sudo versions prior to\r\n1.7.10p9, the most serious of which may allow an attacker access to\r\narbitrary files\r\nDescription: Multiple vulnerabilities existed in sudo versions prior\r\nto 1.7.10p9. These were addressed by updating sudo to version\r\n1.7.10p9.\r\nCVE-ID\r\nCVE-2013-1775\r\nCVE-2013-1776\r\nCVE-2013-2776\r\nCVE-2013-2777\r\nCVE-2014-0106\r\nCVE-2014-9680\r\n\r\ntcpdump\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Multiple vulnerabilities existed in tcpdump 4.7.3, the most\r\nserious of which may allow a remote attacker to cause a denial of\r\nservice.\r\nDescription: Multiple vulnerabilities existed in tcpdump versions\r\nprior to 4.7.3. These were addressed by updating tcpdump to version\r\n4.7.3.\r\nCVE-ID\r\nCVE-2014-8767\r\nCVE-2014-8769\r\nCVE-2014-9140\r\n\r\nText Formats\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Parsing a maliciously crafted text file may lead to\r\ndisclosure of user information\r\nDescription: An XML external entity reference issue existed with\r\nTextEdit parsing. This issue was addressed through improved parsing.\r\nCVE-ID\r\nCVE-2015-3762 : Xiaoyong Wu of the Evernote Security Team\r\n\r\nudf\r\nAvailable for: OS X Yosemite v10.10 to v10.10.4\r\nImpact: Processing a maliciously crafted DMG file may lead to an\r\nunexpected application termination or arbitrary code execution with\r\nsystem privileges\r\nDescription: A memory corruption issue existed in parsing of\r\nmalformed DMG images. This issue was addressed through improved\r\nmemory handling.\r\nCVE-ID\r\nCVE-2015-3767 : beist of grayhash\r\n\r\nOS X Yosemite v10.10.5 includes the security content of Safari 8.0.8:\r\nhttps://support.apple.com/en-us/HT205033\r\n\r\nOS X Yosemite 10.10.5 and Security Update 2015-006 may be obtained\r\nfrom the Mac App Store or Apple&#39;s Software Downloads web site:\r\nhttp://www.apple.com/support/downloads/\r\n\r\nInformation will also be posted to the Apple Security Updates\r\nweb site: https://support.apple.com/kb/HT201222\r\n\r\nThis message is signed with Apple&#39;s Product Security PGP key,\r\nand details are available at:\r\nhttps://www.apple.com/support/security/pgp/\r\n\r\n\r\n\r\n", "modified": "2015-08-17T00:00:00", "published": "2015-08-17T00:00:00", "id": "SECURITYVULNS:DOC:32390", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32390", "title": "APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}