Apple macOS vulnerabilities

CVE-2018-4448 [MEDIUM] CVE-2018-4448: A memory initialization issue was addressed with improved memory handling. This issue is fixed in ma A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.1.1, watchOS 5.1.2, macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra, tvOS 12.1.1. A local user may be able to read kern

CVE-2018-4256 [MEDIUM] CWE-125 CVE-2018-4256: In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validat In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.

CVE-2018-4255 [MEDIUM] CWE-125 CVE-2018-4255: In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validat In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.

CVE-2020-9833 [MEDIUM] CWE-665 CVE-2020-9833: A memory initialization issue was addressed with improved memory handling. This issue is fixed in ma A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.5. A local user may be able to read kernel memory.

CVE-2019-8692 [MEDIUM] CWE-125 CVE-2019-8692: A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Moja A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Mojave 10.14.6. An application may be able to read restricted memory.

CVE-2017-13851 [MEDIUM] CVE-2017-13851: An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involve An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "DesktopServices" component. It allows local users to bypass intended access restrictions on home folder files.

CVE-2017-13839 [MEDIUM] CWE-200 CVE-2017-13839: An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involve An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Spotlight" component. It allows local users to see results for other users' files.

CVE-2018-4178 [MEDIUM] CWE-732 CVE-2018-4178: A permissions issue existed in which execute permission was incorrectly granted. This issue was addr A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue affected versions prior to macOS High Sierra 10.13.4.

CVE-2022-32849 [MEDIUM] CWE-200 CVE-2022-32849: An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed i An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to access sensitive user information.

CVE-2019-8702 [MEDIUM] CWE-668 CVE-2019-8702: This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Securi This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra, iOS 12.4, tvOS 12.4. A local user may be able to read a persistent account identifier.

CVE-2008-3617 [MEDIUM] CWE-255 CVE-2008-3617: Remote Management and Screen Sharing in Apple Mac OS X 10.5 through 10.5.4, when used to set a passw Remote Management and Screen Sharing in Apple Mac OS X 10.5 through 10.5.4, when used to set a password for a VNC viewer, displays additional input characters beyond the maximum password length, which might make it easier for attackers to guess passwords that the user believed were longer.

CVE-2013-5182 [MEDIUM] CWE-310 CVE-2013-5182: Mail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a cryptographic Mail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a cryptographic signature for an e-mail message by using the multipart/signed content type within an unsigned message.

CVE-2010-1830 [MEDIUM] CVE-2010-1830: AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 generates different error messages depe AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 generates different error messages depending on whether a share exists, which allows remote attackers to enumerate valid share names via unspecified vectors.

CVE-2016-4748 [MEDIUM] CWE-254 CVE-2016-4748: Perl in Apple OS X before 10.12 allows local users to bypass the taint-mode protection mechanism via Perl in Apple OS X before 10.12 allows local users to bypass the taint-mode protection mechanism via a crafted environment variable.

CVE-2013-0990 [MEDIUM] CWE-264 CVE-2013-0990: SMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated users SMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated users to create or modify files outside of a shared directory via unspecified vectors.

CVE-2015-3807 [MEDIUM] CWE-119 CVE-2015-3807: libxml2 in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain sensitiv libxml2 in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted XML document.

CVE-2015-3710 [MEDIUM] CWE-254 CVE-2015-3710: Mail in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to trigger a refresh op Mail in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to trigger a refresh operation, and consequently cause a visit to an arbitrary web site, via a crafted HTML e-mail message.

CVE-2004-0822 [HIGH] CVE-2004-0822: Buffer overflow in The Core Foundation framework (CoreFoundation.framework) in Mac OS X 10.2.8, 10.3 Buffer overflow in The Core Foundation framework (CoreFoundation.framework) in Mac OS X 10.2.8, 10.3.4, and 10.3.5 allows local users to execute arbitrary code via a certain environment variable.

CVE-2001-1411 [HIGH] CVE-2001-1411: Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.

CVE-2008-1517 [HIGH] CWE-20 CVE-2008-1517: Array index error in the xnu (Mach) kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users t Array index error in the xnu (Mach) kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (system shutdown) via unspecified vectors related to workqueues.