Apple macOS vulnerabilities

CVE-2005-1339 [HIGH] CVE-2005-1339: lukemftpd in Mac OS X 10.3.9 allows remote authenticated users to escape the chroot environment by l lukemftpd in Mac OS X 10.3.9 allows remote authenticated users to escape the chroot environment by logging in with their full name.

CVE-2017-7150 [MEDIUM] CWE-521 CVE-2017-7150: An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affecte An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "Security" component. It allows attackers to bypass the keychain access prompt, and consequently extract passwords, via a synthetic click.

CVE-2020-29621 [MEDIUM] CWE-862 CVE-2020-29621: This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.1, Security U This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to bypass Privacy preferences.

CVE-2019-7293 [MEDIUM] CWE-787 CVE-2019-7293: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A local user may be able to read kernel memory.

CVE-2020-9989 [MEDIUM] CVE-2020-9989: The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, watchOS The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0. A local user may be able to discover a user’s deleted messages.

CVE-2020-9988 [MEDIUM] CVE-2020-9988: The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, iOS 14. The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0. A local user may be able to discover a user’s deleted messages.

CVE-2019-8504 [MEDIUM] CWE-665 CVE-2019-8504: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iO A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A local user may be able to read kernel memory.

CVE-2019-8520 [MEDIUM] CWE-125 CVE-2019-8520: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Moja An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to read restricted memory.

CVE-2021-30972 [MEDIUM] CWE-863 CVE-2021-30972: This issue was addressed with improved checks. This issue is fixed in Security Update 2022-001 Catal This issue was addressed with improved checks. This issue is fixed in Security Update 2022-001 Catalina, macOS Big Sur 11.6.3. A malicious application may be able to bypass certain Privacy preferences.

CVE-2019-8519 [MEDIUM] CWE-125 CVE-2019-8519: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Moja An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. An application may be able to read restricted memory.

CVE-2021-30697 [MEDIUM] CVE-2021-30697: A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, Securi A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. A local user may be able to leak sensitive user information.

CVE-2018-4448 [MEDIUM] CVE-2018-4448: A memory initialization issue was addressed with improved memory handling. This issue is fixed in ma A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.1.1, watchOS 5.1.2, macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra, tvOS 12.1.1. A local user may be able to read kern

CVE-2021-1786 [MEDIUM] CVE-2021-1786: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11. A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A local user may be able to create or modify system files.

CVE-2017-13851 [MEDIUM] CVE-2017-13851: An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involve An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "DesktopServices" component. It allows local users to bypass intended access restrictions on home folder files.

CVE-2022-22650 [MEDIUM] CWE-281 CVE-2022-22650: This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.5, macOS Mo This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. A plug-in may be able to inherit the application's permissions and access user data.

CVE-2014-4458 [MEDIUM] CWE-200 CVE-2014-4458: The "System Profiler About This Mac" component in Apple OS X before 10.10.1 includes extraneous cook The "System Profiler About This Mac" component in Apple OS X before 10.10.1 includes extraneous cookie data in system-model requests, which might allow remote attackers to obtain sensitive information via unspecified vectors.

CVE-2017-13910 [MEDIUM] CVE-2017-13910: An access issue was addressed with additional sandbox restrictions on applications. This issue is fi An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files.

CVE-2019-8858 [MEDIUM] CVE-2019-8858: A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10 A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006. A user who shares their screen may not be able to end screen sharing.

CVE-2009-3767 [MEDIUM] CVE-2009-3767: libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification

CVE-2004-0921 [HIGH] CVE-2004-0921: AFP Server on Mac OS X 10.3.x to 10.3.5, when a guest has mounted an AFP volume, allows the guest to AFP Server on Mac OS X 10.3.x to 10.3.5, when a guest has mounted an AFP volume, allows the guest to "terminate authenticated user mounts" via modified SessionDestroy packets.