Apple macOS vulnerabilities
3,139 known vulnerabilities affecting apple/mac_os_x.
Total CVEs
3,139
CISA KEV
26
actively exploited
Public exploits
279
Exploited in wild
41
Severity breakdown
CRITICAL302HIGH1409MEDIUM1237LOW191
Vulnerabilities
Page 86 of 157
CVE-2012-0658P4MEDIUMCVSS 6.8≤ 10.7.3v10.0+68 more2012-05-11
CVE-2012-0658 [MEDIUM] CWE-119 CVE-2012-0658: Buffer overflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbi
Buffer overflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted audio sample tables in a movie file that is progressively downloaded.
nvd
CVE-2018-4423P4HIGHCVSS 7.8fixed in 10.14.12019-04-03
CVE-2018-4423 [HIGH] CWE-20 CVE-2018-4423: A logic issue was addressed with improved validation. This issue affected versions prior to macOS Mo
A logic issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14.1.
nvd
CVE-2013-1026P4MEDIUMCVSS 6.8≤ 10.8.4v10.8.0+3 more2013-09-16
CVE-2013-1026 [MEDIUM] CWE-119 CVE-2013-1026: Buffer overflow in ImageIO in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitr
Buffer overflow in ImageIO in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.
nvd
CVE-2013-1025P4MEDIUMCVSS 6.8≤ 10.8.4v10.8.0+3 more2013-09-16
CVE-2013-1025 [MEDIUM] CWE-119 CVE-2013-1025: Buffer overflow in CoreGraphics in Apple Mac OS X before 10.8.5 allows remote attackers to execute a
Buffer overflow in CoreGraphics in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JBIG2 data in a PDF document.
nvd
CVE-2010-1836P4MEDIUMCVSS 6.8v10.5.8v10.6.0+4 more2010-11-15
CVE-2010-1836 [MEDIUM] CWE-119 CVE-2010-1836: Stack-based buffer overflow in CoreGraphics in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows
Stack-based buffer overflow in CoreGraphics in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
nvd
CVE-2010-1801P4MEDIUMCVSS 6.8v10.5.8v10.6.42010-08-25
CVE-2010-1801 [MEDIUM] CWE-119 CVE-2010-1801: Heap-based buffer overflow in CoreGraphics in Apple Mac OS X 10.5.8 and 10.6.4 allows remote attacke
Heap-based buffer overflow in CoreGraphics in Apple Mac OS X 10.5.8 and 10.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file.
nvd
CVE-2011-3228P4MEDIUMCVSS 6.8≤ 10.7.1v10.0+66 more2011-10-14
CVE-2011-3228 [MEDIUM] CWE-94 CVE-2011-3228: QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause
QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file.
nvd
CVE-2011-3213P4HIGHCVSS 7.6≤ 10.7.1v10.0+66 more2011-10-14
CVE-2011-3213 [HIGH] CWE-264 CVE-2011-3213: The File Systems component in Apple Mac OS X before 10.7.2 does not properly track the specific X.50
The File Systems component in Apple Mac OS X before 10.7.2 does not properly track the specific X.509 certificate that a user manually accepted for an initial https WebDAV connection, which allows man-in-the-middle attackers to hijack WebDAV communication by presenting an arbitrary certificate for a subsequent connection.
nvd
CVE-2012-0660P4MEDIUMCVSS 6.8≤ 10.7.3v10.0+68 more2012-05-11
CVE-2012-0660 [MEDIUM] CWE-119 CVE-2012-0660: Buffer underflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arb
Buffer underflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG file.
nvd
CVE-2016-4633P4HIGHCVSS 7.8≤ 10.11.52016-07-22
CVE-2016-4633 [HIGH] CWE-264 CVE-2016-4633: Intel Graphics Driver in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a p
Intel Graphics Driver in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
nvd
CVE-2013-1024P4MEDIUMCVSS 6.8≤ 10.8.3v10.7.0+8 more2013-06-05
CVE-2013-1024 [MEDIUM] CWE-20 CVE-2013-1024: CoreMedia Playback in Apple Mac OS X before 10.8.4 does not properly initialize memory during the pr
CoreMedia Playback in Apple Mac OS X before 10.8.4 does not properly initialize memory during the processing of text tracks, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.
nvd
CVE-2011-0224P4MEDIUMCVSS 6.8≤ 10.6.8v10.0+64 more2011-10-14
CVE-2011-0224 [MEDIUM] CWE-94 CVE-2011-0224: CoreMedia in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or caus
CoreMedia in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted QuickTime movie file.
nvd
CVE-2011-3217P4MEDIUMCVSS 6.8≤ 10.6.8v10.0+64 more2011-10-14
CVE-2011-3217 [MEDIUM] CWE-119 CVE-2011-3217: MediaKit in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause
MediaKit in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted disk image.
nvd
CVE-2016-4647P4HIGHCVSS 7.8≤ 10.11.52016-07-22
CVE-2016-4647 [HIGH] CWE-119 CVE-2016-4647: Audio in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of servic
Audio in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted file.
nvd
CVE-2017-2437P4HIGHCVSS 7.8≤ 10.12.32017-04-02
CVE-2017-2437 [HIGH] CWE-119 CVE-2017-2437: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue invol
An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "IOFireWireAVC" component. It allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
nvd
CVE-2013-1032P4MEDIUMCVSS 6.8fixed in 10.8.52013-09-16
CVE-2013-1032 [MEDIUM] CWE-787 CVE-2013-1032: QuickTime in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause
QuickTime in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted idsc atom in a QuickTime movie file.
nvd
CVE-2013-0975P4MEDIUMCVSS 6.8v10.7.0v10.7.1+8 more2013-06-05
CVE-2013-0975 [MEDIUM] CWE-119 CVE-2013-0975: Buffer overflow in QuickDraw Manager in Apple Mac OS X before 10.8.4 allows remote attackers to exec
Buffer overflow in QuickDraw Manager in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.
nvd
CVE-2014-3613P4MEDIUMCVSS 5.0≤ 10.10.42014-11-18
CVE-2014-3613 [MEDIUM] CWE-310 CVE-2014-3613: cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which a
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
nvd
CVE-2013-5170P4MEDIUMCVSS 6.8≤ 10.8.5v10.8.0+5 more2013-10-24
CVE-2013-5170 [MEDIUM] CWE-119 CVE-2013-5170: Buffer underflow in CoreGraphics in Apple Mac OS X before 10.9 allows remote attackers to execute ar
Buffer underflow in CoreGraphics in Apple Mac OS X before 10.9 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
nvd
CVE-2009-2812P4MEDIUMCVSS 6.8v10.5.82009-09-14
CVE-2009-2812 [MEDIUM] CVE-2009-2812: Launch Services in Apple Mac OS X 10.5.8 does not properly recognize an unsafe Uniform Type Identifi
Launch Services in Apple Mac OS X 10.5.8 does not properly recognize an unsafe Uniform Type Identifier (UTI) in an exported document type in a downloaded application, which allows remote attackers to trigger the automatic opening of a file, and execute arbitrary code, via a crafted web site.
nvd