Apple macOS vulnerabilities

CVE-2016-1836 [MEDIUM] CWE-416 CVE-2016-1836: Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.

CVE-2007-0588 [HIGH] CVE-2007-0588: The InternalUnpackBits function in Apple QuickDraw, as used by Quicktime 7.1.3 and other application The InternalUnpackBits function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT file that triggers memory corruption in the _GetSrcBits32ARGB function. NOTE: this issue might overla

CVE-2020-27935 [MEDIUM] CVE-2020-27935: Multiple issues were addressed with improved logic. This issue is fixed in iOS 14.2 and iPadOS 14.2, Multiple issues were addressed with improved logic. This issue is fixed in iOS 14.2 and iPadOS 14.2, macOS Big Sur 11.0.1, watchOS 7.1, tvOS 14.2. A sandboxed process may be able to circumvent sandbox restrictions.

CVE-2006-4400 [MEDIUM] CVE-2006-4400: Stack-based buffer overflow in the Apple Type Services (ATS) server in Mac OS 10.4.8 and earlier all Stack-based buffer overflow in the Apple Type Services (ATS) server in Mac OS 10.4.8 and earlier allow user-assisted attackers to execute arbitrary code via crafted font files.

CVE-2018-4478 [MEDIUM] CWE-269 CVE-2018-4478: A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13 A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-003 El Capitan. An attacker with physical access to a device may be able to elevate privileges.

CVE-2016-7580 [MEDIUM] CWE-20 CVE-2016-7580: An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involve An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves the "Mail" component, which allows remote web servers to cause a denial of service via a crafted URL.

CVE-2013-5163 [MEDIUM] CWE-287 CVE-2013-5163: Directory Services in Apple Mac OS X before 10.8.5 Supplemental Update allows local users to bypass Directory Services in Apple Mac OS X before 10.8.5 Supplemental Update allows local users to bypass password-based authentication and modify arbitrary Directory Services records via unspecified vectors.

CVE-2005-2744 [MEDIUM] CVE-2005-2744: Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2, as used by applications such Buffer overflow in QuickDraw Manager for Apple OS X 10.3.9 and 10.4.2, as used by applications such as Safari, Mail, and Finder, allows remote attackers to execute arbitrary code via a crafted PICT file.

CVE-2016-4722 [MEDIUM] CWE-20 CVE-2016-4722: The IDS - Connectivity component in Apple iOS before 10 and OS X before 10.12 allows man-in-the-midd The IDS - Connectivity component in Apple iOS before 10 and OS X before 10.12 allows man-in-the-middle attackers to conduct Call Relay spoofing attacks and cause a denial of service via unspecified vectors.

CVE-2022-26766 [MEDIUM] CWE-295 CVE-2022-26766: A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iO A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious app may be able to bypass signature validation.

CVE-2022-32786 [MEDIUM] CWE-20 CVE-2022-32786: An issue in the handling of environment variables was addressed with improved validation. This issue An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to modify protected parts of the file system.

CVE-2020-10012 [MEDIUM] CWE-79 CVE-2020-10012: An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Su An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted document may lead to a cross site scripting attack.

CVE-2022-32800 [MEDIUM] CWE-284 CVE-2022-32800: This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catal This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to modify protected parts of the file system.

CVE-2016-4652 [MEDIUM] CWE-125 CVE-2016-4652: CoreGraphics in Apple OS X before 10.11.6 allows local users to obtain sensitive information from ke CoreGraphics in Apple OS X before 10.11.6 allows local users to obtain sensitive information from kernel memory and consequently gain privileges, or cause a denial of service (out-of-bounds read), via unspecified vectors.

CVE-2007-0318 [HIGH] CVE-2007-0318: The do_hfs_truncate function in Mac OS X 10.4.8 allows context-dependent attackers to cause a denial The do_hfs_truncate function in Mac OS X 10.4.8 allows context-dependent attackers to cause a denial of service (kernel panic) via a crafted HFS+ filesystem in a DMG image, which causes an access of an invalid vnode structure during file removal.

CVE-2021-1883 [MEDIUM] CWE-787 CVE-2021-1883: This issue was addressed with improved checks. This issue is fixed in Security Update 2021-004 Mojav This issue was addressed with improved checks. This issue is fixed in Security Update 2021-004 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, Security Update 2021-003 Catalina, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted server messages may lead to heap corruption.

CVE-2022-22583 [MEDIUM] CVE-2022-22583: A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2 A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access restricted files.

CVE-2021-30912 [MEDIUM] CWE-281 CVE-2021-30912: The issue was addressed with improved permissions logic. This issue is fixed in macOS Monterey 12.0. The issue was addressed with improved permissions logic. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may gain access to a user's Keychain items.

CVE-2008-3643 [HIGH] CVE-2008-3643: Unspecified vulnerability in Finder in Mac OS X 10.5.5 allows user-assisted attackers to cause a den Unspecified vulnerability in Finder in Mac OS X 10.5.5 allows user-assisted attackers to cause a denial of service (continuous termination and restart) via a crafted Desktop file that generates an error when producing its icon, related to an "error recovery issue."

CVE-2001-0720 [HIGH] CVE-2001-0720: Internet Explorer 5.1 for Macintosh on Mac OS X allows remote attackers to execute arbitrary command Internet Explorer 5.1 for Macintosh on Mac OS X allows remote attackers to execute arbitrary commands by causing a BinHex or MacBinary file type to be downloaded, which causes the files to be executed if automatic decoding is enabled.