Apple macOS vulnerabilities

CVE-2015-5859 [MEDIUM] CWE-200 CVE-2015-5859: The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly r The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

CVE-2015-3690 [MEDIUM] CWE-200 CVE-2015-3690: The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.

CVE-2015-5836 [MEDIUM] CWE-200 CVE-2015-5836: Apple Online Store Kit in Apple OS X before 10.11 improperly validates iCloud keychain item ACLs, wh Apple Online Store Kit in Apple OS X before 10.11 improperly validates iCloud keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.

CVE-2015-3786 [MEDIUM] CWE-200 CVE-2015-3786: The Bluetooth subsystem in Apple OS X before 10.10.5 does not properly restrict Notification Center The Bluetooth subsystem in Apple OS X before 10.10.5 does not properly restrict Notification Center Service access, which allows attackers to read Notification Center notifications of certain paired devices via a crafted app.

CVE-2015-3677 [MEDIUM] CWE-200 CVE-2015-3677: The LZVN compression feature in AppleFSCompression in Apple OS X before 10.10.4 allows attackers to The LZVN compression feature in AppleFSCompression in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.

CVE-2015-3711 [MEDIUM] CWE-200 CVE-2015-3711: The NTFS implementation in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-lay The NTFS implementation in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.

CVE-2015-3720 [MEDIUM] CWE-200 CVE-2015-3720: The kernel in Apple OS X before 10.10.4 does not properly manage memory in kernel-extension APIs, wh The kernel in Apple OS X before 10.10.4 does not properly manage memory in kernel-extension APIs, which allows attackers to obtain sensitive memory-layout information via a crafted app.

CVE-2019-8769 [MEDIUM] CVE-2019-8769: An issue existed in the drawing of web page elements. The issue was addressed with improved logic. T An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Visiting a maliciously crafted website may reveal browsing history.

CVE-2014-0067 [MEDIUM] CWE-264 CVE-2014-0067: The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invok The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.

CVE-2020-9942 [MEDIUM] CWE-1021 CVE-2020-9942: An inconsistent user interface issue was addressed with improved state management. This issue is fix An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing.

CVE-2007-4681 [MEDIUM] CWE-119 CVE-2007-4681: Buffer overflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 allows local use Buffer overflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted directory hierarchy.

CVE-2013-3954 [MEDIUM] CWE-20 CVE-2013-3954: The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate th The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions, which allows local users to (1) cause a denial of service (panic) via a size value that is inconsistent with a header count field, or (2) obtain sensitive information from kernel heap memory via a certain size va

CVE-2011-3422 [MEDIUM] CWE-20 CVE-2011-3422: The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrust The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.

CVE-2012-0649 [MEDIUM] CWE-362 CVE-2012-0649: Race condition in the initialization routine in blued in Bluetooth in Apple Mac OS X before 10.7.4 a Race condition in the initialization routine in blued in Bluetooth in Apple Mac OS X before 10.7.4 allows local users to gain privileges via vectors involving a temporary file.

CVE-2015-3692 [MEDIUM] CWE-284 CVE-2015-3692: Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not enforce a Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not enforce a locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging root privileges.

CVE-2014-0106 [MEDIUM] CWE-20 CVE-2014-0106: Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables f Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

CVE-2005-2502 [MEDIUM] CVE-2005-2502: Buffer overflow in AppKit for Mac OS X 10.3.9 and 10.4.2, as used in applications such as TextEdit, Buffer overflow in AppKit for Mac OS X 10.3.9 and 10.4.2, as used in applications such as TextEdit, allows external user-assisted attackers to execute arbitrary code via a crafted Microsoft Word file.

CVE-2006-4395 [MEDIUM] CVE-2006-4395: Unspecified vulnerability in QuickDraw Manager in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allo Unspecified vulnerability in QuickDraw Manager in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows context-dependent attackers to cause a denial of service ("memory corruption" and crash) via a crafted PICT image that is not properly handled by a certain "unsupported QuickDraw operation."

CVE-2006-1447 [MEDIUM] CVE-2006-1447: LaunchServices in Apple Mac OS X 10.4.6 allows remote attackers to cause Safari to launch unsafe con LaunchServices in Apple Mac OS X 10.4.6 allows remote attackers to cause Safari to launch unsafe content via long file name extensions, which prevents Download Validation from determining which application will be used to open the file.

CVE-2006-3502 [MEDIUM] CVE-2006-3502: Unspecified vulnerability in ImageIO in Apple Mac OS X 10.4.7 allows user-assisted attackers to caus Unspecified vulnerability in ImageIO in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GIF image that triggers a memory allocation failure that is not properly handled.