Apple macOS vulnerabilities

CVE-2011-0185 [MEDIUM] CWE-134 CVE-2011-0185: Format string vulnerability in the debug-logging feature in Application Firewall in Apple Mac OS X b Format string vulnerability in the debug-logging feature in Application Firewall in Apple Mac OS X before 10.7.2 allows local users to gain privileges via a crafted name of an executable file.

CVE-2007-5847 [MEDIUM] CWE-362 CVE-2007-5847: Race condition in the CFURLWriteDataAndPropertiesToResource API in Core Foundation in Apple Mac OS X Race condition in the CFURLWriteDataAndPropertiesToResource API in Core Foundation in Apple Mac OS X 10.4.11 creates files with insecure permissions, which might allow local users to obtain sensitive information.

CVE-2017-7084 [LOW] CVE-2017-7084: An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involve An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Application Firewall" component. It allows remote attackers to bypass intended settings in opportunistic circumstances by leveraging incorrect handling of a denied setting after an upgrade.

CVE-2013-5188 [MEDIUM] CWE-264 CVE-2013-5188: The Screen Lock implementation in Apple Mac OS X before 10.9, when hibernation and autologin are ena The Screen Lock implementation in Apple Mac OS X before 10.9, when hibernation and autologin are enabled, does not require a password for a transition out of hibernation, which allows physically proximate attackers to obtain access by visiting an unattended workstation in the hibernating state.

CVE-2015-5869 [LOW] CWE-20 CVE-2015-5869: The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Apple iOS before 9 allows r The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Apple iOS before 9 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.

CVE-2014-4440 [LOW] CWE-16 CVE-2014-4440: The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled mobile-configuration profiles, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging access to an unintended proxy server.

CVE-2020-3830 [LOW] CWE-59 CVE-2020-3830: A validation issue existed in the handling of symlinks. This issue was addressed with improved valid A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.3. A malicious application may be able to overwrite arbitrary files.

CVE-2013-5183 [LOW] CWE-200 CVE-2013-5183: Mail in Apple Mac OS X before 10.9, when Kerberos authentication is enabled and TLS is disabled, sen Mail in Apple Mac OS X before 10.9, when Kerberos authentication is enabled and TLS is disabled, sends invalid cleartext data, which allows remote attackers to obtain sensitive information by sniffing the network.

CVE-2006-0388 [LOW] CWE-94 CVE-2006-0388: Safari in Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5 allows remote attackers to redirect use Safari in Mac OS X 10.3 before 10.3.9 and 10.4 before 10.4.5 allows remote attackers to redirect users to local files and execute arbitrary JavaScript via unspecified vectors involving HTTP redirection to local resources.

CVE-2011-1132 [MEDIUM] CVE-2011-1132: The IPv6 implementation in the kernel in Apple Mac OS X before 10.6.8 allows local users to cause a The IPv6 implementation in the kernel in Apple Mac OS X before 10.6.8 allows local users to cause a denial of service (NULL pointer dereference and reboot) via vectors involving socket options.

CVE-2010-1847 [MEDIUM] CWE-399 CVE-2010-1847: The kernel in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform memory management associ The kernel in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform memory management associated with terminal devices, which allows local users to cause a denial of service (system crash) via unspecified vectors.

CVE-2009-2834 [MEDIUM] CWE-264 CVE-2009-2834: IOKit in Apple Mac OS X before 10.6.2 allows local users to modify the firmware of a (1) USB or (2) IOKit in Apple Mac OS X before 10.6.2 allows local users to modify the firmware of a (1) USB or (2) Bluetooth keyboard via unspecified vectors.

CVE-2012-0652 [MEDIUM] CWE-200 CVE-2012-0652: Login Window in Apple Mac OS X 10.7.3, when Legacy File Vault or networked home directories are enab Login Window in Apple Mac OS X 10.7.3, when Legacy File Vault or networked home directories are enabled, does not properly restrict what is written to the system log for network logins, which allows local users to obtain sensitive information by reading the log.

CVE-2013-5166 [MEDIUM] CVE-2013-5166: The Bluetooth USB host controller in Apple Mac OS X before 10.9 prematurely deletes interfaces, whic The Bluetooth USB host controller in Apple Mac OS X before 10.9 prematurely deletes interfaces, which allows local users to cause a denial of service (system crash) via a crafted application.

CVE-2013-5174 [MEDIUM] CWE-189 CVE-2013-5174: Integer signedness error in the kernel in Apple Mac OS X before 10.9 allows local users to cause a d Integer signedness error in the kernel in Apple Mac OS X before 10.9 allows local users to cause a denial of service (system crash) via a crafted tty read operation.

CVE-2005-1336 [MEDIUM] CVE-2005-1336: Buffer overflow in the Foundation framework for Mac OS X 10.3.9 allows local users to execute arbitr Buffer overflow in the Foundation framework for Mac OS X 10.3.9 allows local users to execute arbitrary code via a long environment variable.

CVE-2007-5854 [MEDIUM] CWE-79 CVE-2007-5854: Launch Services in Apple Mac OS X 10.4.11 and 10.5.1 does not treat HTML files as unsafe content, wh Launch Services in Apple Mac OS X 10.4.11 and 10.5.1 does not treat HTML files as unsafe content, which allows attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via a crafted HTML file.

CVE-2006-4397 [MEDIUM] CVE-2006-4397: Unchecked error condition in LoginWindow in Apple Mac OS X 10.4 through 10.4.7 prevents Kerberos tic Unchecked error condition in LoginWindow in Apple Mac OS X 10.4 through 10.4.7 prevents Kerberos tickets from being destroyed if a user does not successfully log on to a network account from the login window, which might allow later users to gain access to the original user's Kerberos tickets.

CVE-2004-1089 [MEDIUM] CVE-2004-1089: Unknown vulnerability in Apple Mac OS X 10.3.6 server, when using Kerberos authentication and Cyrus Unknown vulnerability in Apple Mac OS X 10.3.6 server, when using Kerberos authentication and Cyrus IMAP allows local users to access mailboxes of other users.

CVE-2003-0877 [MEDIUM] CVE-2003-0877: Mac OS X before 10.3 with core files enabled allows local users to overwrite arbitrary files and rea Mac OS X before 10.3 with core files enabled allows local users to overwrite arbitrary files and read core files via a symlink attack on core files that are created with predictable names in the /cores directory.