Apple macOS vulnerabilities

CVE-2005-3782 [LOW] CVE-2005-3782: Mac OS X 10.4.3 up to 10.4.6, when loginwindow uses the "Name and password" setting, and the "Show t Mac OS X 10.4.3 up to 10.4.6, when loginwindow uses the "Name and password" setting, and the "Show the Restart, Sleep, and Shut Down buttons" option is disabled, allows users with physical access to bypass login and reboot the system by entering ">restart", ">power", or ">shutdown" sequences after the username.

CVE-2014-4460 [LOW] CWE-200 CVE-2014-4460: CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cac CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cache upon a transition out of private-browsing mode, which makes it easier for physically proximate attackers to obtain sensitive information by reading cache files.

CVE-2006-1981 [LOW] CVE-2006-1981: Unspecified vulnerability in Java InputMethods on Mac OS X 10.4.5 may cause InputMethods to send inp Unspecified vulnerability in Java InputMethods on Mac OS X 10.4.5 may cause InputMethods to send input events for secure fields to the wrong text field, which might reveal the password to others who can view the screen.

CVE-2013-3952 [LOW] CWE-264 CVE-2013-3952: The fill_pipeinfo function in bsd/kern/sys_pipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows The fill_pipeinfo function in bsd/kern/sys_pipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protection mechanism via the PROC_PIDFDPIPEINFO option to the proc_info system call for a kernel pipe handle.

CVE-2015-5854 [LOW] CWE-200 CVE-2015-5854: The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain ac The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors.

CVE-2014-1378 [LOW] CWE-264 CVE-2014-1378: IOGraphicsFamily in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechan IOGraphicsFamily in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.

CVE-2015-5893 [LOW] CWE-200 CVE-2015-5893: SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-lay SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.

CVE-2015-1142 [LOW] CWE-20 CVE-2015-1142: LaunchServices in Apple OS X before 10.10.3 allows local users to cause a denial of service (Finder LaunchServices in Apple OS X before 10.10.3 allows local users to cause a denial of service (Finder crash) via crafted localization data.

CVE-2015-5864 [LOW] CWE-200 CVE-2015-5864: IOAudioFamily in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout IOAudioFamily in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.

CVE-2005-2751 [LOW] CVE-2005-2751: memberd in Mac OS X 10.4 up to 10.4.2, in certain situations, does not quickly synchronize access co memberd in Mac OS X 10.4 up to 10.4.2, in certain situations, does not quickly synchronize access control checks with changes in group membership, which could allow users to access files and other resources after they have been removed from a group.

CVE-2014-8827 [LOW] CWE-284 CVE-2014-8827: LoginWindow in Apple OS X before 10.10.2 does not transition to the lock-screen state immediately up LoginWindow in Apple OS X before 10.10.2 does not transition to the lock-screen state immediately upon being woken from sleep, which allows physically proximate attackers to obtain sensitive information by reading the screen.

CVE-2015-7067 [LOW] CVE-2015-7067: IOThunderboltFamily in Apple OS X before 10.11.2 allows local users to cause a denial of service (NU IOThunderboltFamily in Apple OS X before 10.11.2 allows local users to cause a denial of service (NULL pointer dereference) via an unspecified userclient type.

CVE-2003-0876 [LOW] CVE-2003-0876: Finder in Mac OS X 10.2.8 and earlier sets global read/write/execute permissions on directories when Finder in Mac OS X 10.2.8 and earlier sets global read/write/execute permissions on directories when they are dragged (copied) from a mounted volume such as a disk image (DMG), which could cause the directories to have less restrictive permissions than intended.

CVE-2001-1565 [LOW] CVE-2001-1565: Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username Point to Point Protocol daemon (pppd) in MacOS x 10.0 and 10.1 through 10.1.5 provides the username and password on the command line, which allows local users to obtain authentication information via the ps command.

CVE-2015-3757 [LOW] CWE-284 CVE-2015-3757: Apple OS X before 10.10.5 does not properly restrict access to the Date & Time preferences pane, whi Apple OS X before 10.10.5 does not properly restrict access to the Date & Time preferences pane, which allows local users to spoof the time by visiting this pane.

CVE-2004-0087 [LOW] CVE-2004-0087: The System Configuration subsystem in Mac OS 10.2.8 and 10.3.2 allows local users to modify network The System Configuration subsystem in Mac OS 10.2.8 and 10.3.2 allows local users to modify network settings, a different vulnerability than CVE-2004-0088.

CVE-2014-8833 [LOW] CWE-284 CVE-2014-8833: SpotlightIndex in Apple OS X before 10.10.2 does not properly perform deserialization during access SpotlightIndex in Apple OS X before 10.10.2 does not properly perform deserialization during access to a permission cache, which allows local users to read search results associated with other users' protected files via a Spotlight query.

CVE-2014-1375 [LOW] CWE-264 CVE-2014-1375: Intel Graphics Driver in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection m Intel Graphics Driver in Apple OS X before 10.9.4 allows local users to bypass the ASLR protection mechanism by leveraging read access to a kernel pointer in an IOKit object.

CVE-2012-3718 [LOW] CWE-200 CVE-2012-3718: Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 allows local users to read passwords entered i Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 allows local users to read passwords entered into Login Window (aka LoginWindow) or Screen Saver Unlock by installing an input method that intercepts keystrokes.

CVE-2005-0973 [LOW] CVE-2005-0973: Unknown vulnerability in the setsockopt system call in Mac OS X 10.3.9 and earlier allows local user Unknown vulnerability in the setsockopt system call in Mac OS X 10.3.9 and earlier allows local users to cause a denial of service (memory exhaustion) via crafted arguments.