Apple macOS vulnerabilities

CVE-2016-4670 [LOW] CWE-255 CVE-2016-4670: An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "Security" component. It allows local users to discover lengths of arbitrary passwords by reading a log.

CVE-2007-4679 [LOW] CWE-264 CVE-2007-4679: CFFTP in CFNetwork for Apple Mac OS X 10.4 through 10.4.10 allows remote FTP servers to force client CFFTP in CFNetwork for Apple Mac OS X 10.4 through 10.4.10 allows remote FTP servers to force clients to connect to other hosts via crafted responses to FTP PASV commands.

CVE-2015-7094 [LOW] CWE-20 CVE-2015-7094: CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle atta CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.

CVE-2009-2194 [MEDIUM] CVE-2009-2194: Apple Mac OS X 10.5 before 10.5.8 does not properly share file descriptors over local sockets, which Apple Mac OS X 10.5 before 10.5.8 does not properly share file descriptors over local sockets, which allows local users to cause a denial of service (system crash) by placing file descriptors in messages sent to a socket that has no receiver, related to a "synchronization issue."

CVE-2007-0743 [MEDIUM] CVE-2007-0743: URLMount in Apple Mac OS X 10.3.9 through 10.4.9 passes the username and password credentials for mo URLMount in Apple Mac OS X 10.3.9 through 10.4.9 passes the username and password credentials for mounting filesystems on SMB servers as command line arguments to the mount_sub command, which may allow local users to obtain sensitive information by listing the process.

CVE-2008-4219 [MEDIUM] CWE-399 CVE-2008-4219: The kernel in Apple Mac OS X before 10.5.6 allows local users to cause a denial of service (infinite The kernel in Apple Mac OS X before 10.5.6 allows local users to cause a denial of service (infinite loop and system halt) by running an application that is dynamically linked to libraries on an NFS server, related to occurrence of an exception in this application.

CVE-2008-2312 [MEDIUM] CWE-255 CVE-2008-2312: Network Preferences in Apple Mac OS X 10.4.11 stores PPP passwords in cleartext in a world-readable Network Preferences in Apple Mac OS X 10.4.11 stores PPP passwords in cleartext in a world-readable file, which allows local users to obtain sensitive information by reading this file.

CVE-2011-3435 [LOW] CWE-255 CVE-2011-3435: Open Directory in Apple Mac OS X 10.7 before 10.7.2 allows local users to read the password data of Open Directory in Apple Mac OS X 10.7 before 10.7.2 allows local users to read the password data of arbitrary users via unspecified vectors.

CVE-2003-0518 [MEDIUM] CVE-2003-0518: The screen saver in MacOS X allows users with physical access to cause the screen saver to crash and The screen saver in MacOS X allows users with physical access to cause the screen saver to crash and gain access to the underlying session via a large number of characters in the password field, possibly triggering a buffer overflow.

CVE-2005-2515 [MEDIUM] CVE-2005-2515: Quartz Composer Screen Saver in Mac OS X 10.4.2 allows local users to access links from the RSS Visu Quartz Composer Screen Saver in Mac OS X 10.4.2 allows local users to access links from the RSS Visualizer even when a password is required.

CVE-2006-4387 [MEDIUM] CVE-2006-4387: Apple Mac OS X 10.4 through 10.4.7, when the administrator clears the "Allow user to administer this Apple Mac OS X 10.4 through 10.4.7, when the administrator clears the "Allow user to administer this computer" checkbox in System Preferences for a user, does not remove the user's account from the appserveradm or appserverusr groups, which still allows the user to manage WebObjects applications.

CVE-2005-1473 [MEDIUM] CVE-2005-1473: SecurityAgent in Apple Mac OS X 10.4.1 allows attackers with physical access to bypass the locked sc SecurityAgent in Apple Mac OS X 10.4.1 allows attackers with physical access to bypass the locked screensaver and launch background applications by opening a URL from a text input field.

CVE-2005-0712 [MEDIUM] CVE-2005-0712: Mac OS X before 10.3.8 users world-writable permissions for certain directories, which may allow loc Mac OS X before 10.3.8 users world-writable permissions for certain directories, which may allow local users to gain privileges, possibly via the receipt cache or ColorSync profiles.

CVE-2008-0990 [MEDIUM] CWE-200 CVE-2008-0990: notifyd in Apple Mac OS X 10.4.11 does not verify that Mach port death notifications have originated notifyd in Apple Mac OS X 10.4.11 does not verify that Mach port death notifications have originated from the kernel, which allows local users to cause a denial of service via spoofed death notifications that prevent other applications from receiving notifications.

CVE-2006-0391 [LOW] CVE-2006-0391: Directory traversal vulnerability in the BOM framework in Mac OS X 10.x before 10.3.9 and 10.4 befor Directory traversal vulnerability in the BOM framework in Mac OS X 10.x before 10.3.9 and 10.4 before 10.4.5 allows user-assisted attackers to overwrite or create arbitrary files via an archive that is handled by BOMArchiveHelper.

CVE-2017-2426 [LOW] CWE-200 CVE-2017-2426: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue invol An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "iBooks" component. It allows remote attackers to obtain sensitive information from local files via a file: URL in an iBooks file.

CVE-2016-1796 [LOW] CWE-200 CVE-2016-1796: Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel m Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds memory access) via a crafted app.

CVE-2016-4715 [LOW] CWE-200 CVE-2016-4715: The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences fil The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via a crafted app.

CVE-2016-1791 [LOW] CWE-200 CVE-2016-1791: The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-la The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.

CVE-2019-8502 [LOW] CWE-20 CVE-2019-8502: An API issue existed in the handling of dictation requests. This issue was addressed with improved v An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization.