Apple macOS vulnerabilities

CVE-2014-1252 [HIGH] CWE-415 CVE-2014-1252: Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers t Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.

CVE-2018-14468 [HIGH] CWE-125 CVE-2018-14468: The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print(). The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().

CVE-2019-6230 [HIGH] CWE-665 CVE-2019-6230: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iO A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3,macOS Mojave 10.14.3,tvOS 12.1.2,watchOS 5.1.3. A malicious application may be able to break out of its sandbox.

CVE-2008-4220 [CRITICAL] CWE-189 CVE-2008-4220: Integer overflow in the inet_net_pton API in Libsystem in Apple Mac OS X before 10.5.6 allows contex Integer overflow in the inet_net_pton API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. NOTE: this may be related to the WLB-2008080064 advisory published by SecurityReason on 20080822; however, as of 20081216, there

CVE-2008-3616 [CRITICAL] CWE-189 CVE-2008-3616: Multiple integer overflows in the SearchKit API in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 al Multiple integer overflows in the SearchKit API in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via vectors associated with "passing untrusted input" to unspecified API functions.

CVE-2015-5776 [HIGH] CWE-119 CVE-2015-5776: Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitra Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.

CVE-2016-4617 [HIGH] CWE-264 CVE-2016-4617: An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involve An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves a sandbox escape related to launchctl process spawning in the "libxpc" component.

CVE-2020-9847 [HIGH] CWE-125 CVE-2020-9847: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Cata An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to break out of its sandbox.

CVE-2011-3457 [HIGH] CWE-119 CVE-2011-3457: The OpenGL implementation in Apple Mac OS X before 10.7.3 does not properly perform OpenGL Shading L The OpenGL implementation in Apple Mac OS X before 10.7.3 does not properly perform OpenGL Shading Language (aka GLSL) compilation, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted program.

CVE-2002-1383 [CRITICAL] CVE-2002-1383: Multiple integer overflows in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allow remote Multiple integer overflows in Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allow remote attackers to execute arbitrary code via (1) the CUPSd HTTP interface, as demonstrated by vanilla-coke, and (2) the image handling code in CUPS filters, as demonstrated by mksun.

CVE-2012-0662 [HIGH] CWE-189 CVE-2012-0662: Integer overflow in the Security Framework in Apple Mac OS X before 10.7.4 allows remote attackers t Integer overflow in the Security Framework in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted input.

CVE-2020-8037 [HIGH] CWE-770 CVE-2020-8037: The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.

CVE-2016-1820 [HIGH] CWE-119 CVE-2016-1820: Buffer overflow in IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary Buffer overflow in IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.

CVE-2016-1826 [HIGH] CVE-2016-1826: Integer overflow in the dtrace implementation in the kernel in Apple OS X before 10.11.5 allows atta Integer overflow in the dtrace implementation in the kernel in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.

CVE-2014-4459 [MEDIUM] CVE-2014-4459: Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attacker Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attackers to execute arbitrary code via crafted page objects in an HTML document.

CVE-2020-9991 [HIGH] CVE-2020-9991: This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.0.1, watchOS This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iCloud for Windows 7.21, tvOS 14.0. A remote attacker may be able to cause a denial of service.

CVE-2016-4599 [HIGH] CWE-119 CVE-2016-4599: QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop document.

CVE-2016-4779 [HIGH] CWE-119 CVE-2016-4779: Apple Type Services (ATS) in Apple OS X before 10.12 allows remote attackers to execute arbitrary co Apple Type Services (ATS) in Apple OS X before 10.12 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.

CVE-2022-0261 [HIGH] CWE-122 CVE-2022-0261: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

CVE-2016-1746 [HIGH] CWE-20 CVE-2016-1746: IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged c IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1747.