Apple macOS vulnerabilities

CVE-2011-3224 [LOW] CVE-2011-3224: The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information, which allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server.

CVE-2004-0085 [MEDIUM] CVE-2004-0085: Unknown vulnerability in the Mail application for Mac OS X 10.1.5 and 10.2.8 with unknown impact, a Unknown vulnerability in the Mail application for Mac OS X 10.1.5 and 10.2.8 with unknown impact, a different vulnerability than CVE-2004-0086.

CVE-2002-1267 [MEDIUM] CVE-2002-1267: Mac OS X 10.2.2 allows remote attackers to cause a denial of service by accessing the CUPS Printing Mac OS X 10.2.2 allows remote attackers to cause a denial of service by accessing the CUPS Printing Web Administration utility, aka "CUPS Printing Web Administration is Remotely Accessible."

CVE-2004-0428 [MEDIUM] CVE-2004-0428: Unknown vulnerability in CoreFoundation in Mac OS X 10.3.3 and Mac OS X 10.3.3 Server, related to "t Unknown vulnerability in CoreFoundation in Mac OS X 10.3.3 and Mac OS X 10.3.3 Server, related to "the handling of an environment variable," has unknown attack vectors and unknown impact.

CVE-2005-2745 [MEDIUM] CVE-2005-2745: Mail.app in Mail for Apple Mac OS X 10.3.9, when using Kerberos 5 for SMTP authentication, can inclu Mail.app in Mail for Apple Mac OS X 10.3.9, when using Kerberos 5 for SMTP authentication, can include uninitialized memory in a message, which might allow remote attackers to obtain sensitive information.

CVE-2010-4008 [MEDIUM] CWE-119 CVE-2010-4008: libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, an libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

CVE-2015-5747 [MEDIUM] CWE-399 CVE-2015-5747: The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial The fasttrap driver in the kernel in Apple OS X before 10.10.5 allows local users to cause a denial of service (resource consumption) via unspecified vectors.

CVE-2015-1141 [MEDIUM] CVE-2015-1141: The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to caus The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via unspecified vectors.

CVE-2014-8832 [MEDIUM] CWE-200 CVE-2014-8832: The indexing functionality in Spotlight in Apple OS X before 10.10.2 writes memory contents to an ex The indexing functionality in Spotlight in Apple OS X before 10.10.2 writes memory contents to an external hard drive, which allows local users to obtain sensitive information by reading from this drive.

CVE-2013-5176 [MEDIUM] CWE-189 CVE-2013-5176: The kernel in Apple Mac OS X before 10.9 does not properly handle integer values during unspecified The kernel in Apple Mac OS X before 10.9 does not properly handle integer values during unspecified tty device operations, which allows local users to cause a denial of service (system hang) by triggering a truncation error.

CVE-2008-0988 [MEDIUM] CWE-189 CVE-2008-0988: Off-by-one error in the Libsystem strnstr API in libc on Apple Mac OS X 10.4.11 allows context-depen Off-by-one error in the Libsystem strnstr API in libc on Apple Mac OS X 10.4.11 allows context-dependent attackers to cause a denial of service (crash) via crafted arguments that trigger a buffer over-read.

CVE-2004-0383 [HIGH] CVE-2004-0383: Unknown vulnerability in Mail for Mac OS X 10.3.3 and 10.2.8, with unknown impact, related to "the h Unknown vulnerability in Mail for Mac OS X 10.3.3 and 10.2.8, with unknown impact, related to "the handling of HTML-formatted email."

CVE-2004-0382 [HIGH] CVE-2004-0382: Unknown vulnerability in the CUPS printing system in Mac OS X 10.3.3 and Mac OS X 10.2.8 with unknow Unknown vulnerability in the CUPS printing system in Mac OS X 10.3.3 and Mac OS X 10.2.8 with unknown impact, possibly related to a configuration file setting.

CVE-2014-4430 [MEDIUM] CWE-310 CVE-2014-4430: CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in th CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, which makes it easier for physically proximate attackers to obtain cleartext data via a remount.

CVE-2005-0971 [MEDIUM] CVE-2005-0971: Stack-based buffer overflow in the semop system call in Mac OS X 10.3.9 and earlier allows local use Stack-based buffer overflow in the semop system call in Mac OS X 10.3.9 and earlier allows local users to gain privileges via crafted arguments.

CVE-2007-0738 [MEDIUM] CVE-2007-0738: The Login Window in Apple Mac OS X 10.4 through 10.4.9 does not display the screen saver authenticat The Login Window in Apple Mac OS X 10.4 through 10.4.9 does not display the screen saver authentication dialog in certain circumstances when waking from sleep, even though the "require a password to wake the computer from sleep" option is enabled, which allows local users to bypass authentication controls.

CVE-2005-2742 [MEDIUM] CVE-2005-2742: SecurityAgent in Apple Mac OS X 10.4.2, under certain circumstances, can cause the "Switch User..." SecurityAgent in Apple Mac OS X 10.4.2, under certain circumstances, can cause the "Switch User..." button to appear even though the "Enable fast user switching" setting is disabled, which can allow attackers with physical access to gain access to the desktop and bypass the "Require password to wake this computer from sleep or screen saver" setting.

CVE-2015-7062 [MEDIUM] CWE-264 CVE-2015-7062: Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-pro Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.

CVE-2014-1265 [MEDIUM] CWE-264 CVE-2014-1265: The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local user The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock.

CVE-2009-2835 [MEDIUM] CWE-20 CVE-2009-2835: The kernel in Apple Mac OS X before 10.6.2 does not properly handle task state segments, which allow The kernel in Apple Mac OS X before 10.6.2 does not properly handle task state segments, which allows local users to gain privileges, cause a denial of service (system crash), or obtain sensitive information via unspecified vectors.