Apple macOS vulnerabilities

CVE-2014-1355 [MEDIUM] CVE-2014-1355: The IOKit implementation in the kernel in Apple iOS before 7.1.2 and Apple TV before 6.1.2, and in I The IOKit implementation in the kernel in Apple iOS before 7.1.2 and Apple TV before 6.1.2, and in IOReporting in Apple OS X before 10.9.4, allows local users to cause a denial of service (NULL pointer dereference and reboot) via crafted API arguments.

CVE-2015-5902 [MEDIUM] CVE-2015-5902: The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local users to cause a denial of service via unspecified vectors.

CVE-2013-5192 [MEDIUM] CWE-20 CVE-2013-5192: The USB hub controller in Apple Mac OS X before 10.9 allows local users to cause a denial of service The USB hub controller in Apple Mac OS X before 10.9 allows local users to cause a denial of service (system crash) via a request with a crafted (1) port or (2) port number.

CVE-2013-5177 [MEDIUM] CWE-189 CVE-2013-5177: The kernel in Apple Mac OS X before 10.9 allows local users to cause a denial of service (panic) via The kernel in Apple Mac OS X before 10.9 allows local users to cause a denial of service (panic) via an invalid iovec structure.

CVE-2010-1794 [MEDIUM] CWE-264 CVE-2010-1794: The webdav_mount function in webdav_vfsops.c in the WebDAV kernel extension (aka webdav_fs.kext) for The webdav_mount function in webdav_vfsops.c in the WebDAV kernel extension (aka webdav_fs.kext) for Mac OS X 10.6 allows local users to cause a denial of service (panic) via a mount request with a large integer in the pa_socket_namelen field.

CVE-2006-0393 [MEDIUM] CVE-2006-0393: OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine a OpenSSH in Apple Mac OS X 10.4.7 allows remote attackers to cause a denial of service or determine account existence by attempting to log in using an invalid user, which causes the server to hang.

CVE-2005-2521 [MEDIUM] CVE-2005-2521: Buffer overflow in traceroute in Mac OS X 10.3.9 allows local users to execute arbitrary code via un Buffer overflow in traceroute in Mac OS X 10.3.9 allows local users to execute arbitrary code via unknown vectors.

CVE-2007-0739 [MEDIUM] CVE-2007-0739: The Login Window in Apple Mac OS X 10.4 through 10.4.9 displays the software update window beneath t The Login Window in Apple Mac OS X 10.4 through 10.4.9 displays the software update window beneath the loginwindow authentication dialog in certain circumstances related to running scheduled tasks, which allows local users to bypass authentication controls.

CVE-2005-3700 [MEDIUM] CVE-2005-3700: Unknown vulnerability in iodbcadmintool in the ODBC Administrator utility in Mac OS X and OS X Serve Unknown vulnerability in iodbcadmintool in the ODBC Administrator utility in Mac OS X and OS X Server 10.3.9 and 10.4.3 allows local users to execute arbitrary code via unknown attack vectors.

CVE-2008-1572 [MEDIUM] CWE-264 CVE-2008-1572: Image Capture in Apple Mac OS X before 10.5 does not properly use temporary files, which allows loca Image Capture in Apple Mac OS X before 10.5 does not properly use temporary files, which allows local users to overwrite arbitrary files, and display images that are being resized by this application.

CVE-2006-0401 [MEDIUM] CVE-2006-0401: Unspecified vulnerability in Mac OS X before 10.4.6, when running on an Intel-based computer, allows Unspecified vulnerability in Mac OS X before 10.4.6, when running on an Intel-based computer, allows attackers with physical access to bypass the firmware password and log on in Single User Mode via unspecified vectors.

CVE-2011-0260 [MEDIUM] CWE-264 CVE-2011-0260: The CoreProcesses component in Apple Mac OS X 10.7 before 10.7.2 does not prevent a system window fr The CoreProcesses component in Apple Mac OS X 10.7 before 10.7.2 does not prevent a system window from receiving keystrokes in the locked-screen state, which might allow physically proximate attackers to bypass intended access restrictions by typing into this window.

CVE-2008-2324 [MEDIUM] CWE-264 CVE-2008-2324: The Repair Permissions tool in Disk Utility in Apple Mac OS X 10.4.11 adds the setuid bit to the ema The Repair Permissions tool in Disk Utility in Apple Mac OS X 10.4.11 adds the setuid bit to the emacs executable file, which allows local users to gain privileges by executing commands within emacs.

CVE-2007-0737 [MEDIUM] CVE-2007-0737: The Login Window in Apple Mac OS X 10.3.9 through 10.4.9 does not properly check certain environment The Login Window in Apple Mac OS X 10.3.9 through 10.4.9 does not properly check certain environment variables, which allows local users to gain privileges via unspecified vectors.

CVE-2008-2313 [MEDIUM] CWE-264 CVE-2008-2313: Apple Mac OS X before 10.5 uses weak permissions for the User Template directory, which allows local Apple Mac OS X before 10.5 uses weak permissions for the User Template directory, which allows local users to gain privileges by inserting a Trojan horse file into this directory.

CVE-2020-9804 [MEDIUM] CVE-2020-9804: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15. A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.5. Inserting a USB device that sends invalid messages may cause a kernel panic.

CVE-2009-0149 [MEDIUM] CWE-94 CVE-2009-0149: Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows local users to gain privileges or cause a denia Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (application crash) by attempting to mount a crafted sparse disk image that triggers memory corruption.

CVE-2013-1776 [MEDIUM] CWE-264 CVE-2013-1776: sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another termi

CVE-2013-2777 [MEDIUM] CVE-2013-2777: sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not prop sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, an

CVE-2007-0728 [MEDIUM] CVE-2007-0728: Unspecified vulnerability in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 creates files insecurely Unspecified vulnerability in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 creates files insecurely while initializing a USB printer, which allows local users to create or overwrite arbitrary files.