Apple macOS vulnerabilities

CVE-2017-2443 [HIGH] CWE-119 CVE-2017-2443: An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue invol An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

CVE-2010-0520 [MEDIUM] CWE-119 CVE-2010-0520: Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 al Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLC file, related to crafted DELTA_FLI chunks and untrusted length values in a .fli file, which are not properly handled during decompression.

CVE-2019-6205 [HIGH] CWE-787 CVE-2019-6205: A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iO A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious application may cause unexpected changes in memory shared between processes.

CVE-2018-4083 [HIGH] CWE-119 CVE-2018-4083: An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue invol An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "Touch Bar Support" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

CVE-2016-4625 [HIGH] CWE-416 CVE-2016-4625: Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain pr Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors.

CVE-2019-8717 [HIGH] CWE-787 CVE-2019-8717: A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15, tvOS 13. An application may be able to execute arbitrary code with kernel privileges.

CVE-2006-0395 [MEDIUM] CVE-2006-0395: The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types t The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.

CVE-2016-1825 [HIGH] CWE-119 CVE-2016-1825: IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

CVE-2016-1743 [HIGH] CWE-119 CVE-2016-1743: The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1744.

CVE-2016-1846 [HIGH] CWE-119 CVE-2016-1846: The nvCommandQueue::GetHandleIndex method in the NVIDIA Graphics Drivers subsystem in Apple OS X bef The nvCommandQueue::GetHandleIndex method in the NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference and memory corruption) via a crafted app.

CVE-2016-1794 [HIGH] CVE-2016-1794: The AppleGraphicsControlClient::checkArguments method in AppleGraphicsControl in Apple OS X before 1 The AppleGraphicsControlClient::checkArguments method in AppleGraphicsControl in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

CVE-2016-1861 [HIGH] CVE-2016-1861: The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbit The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1846.

CVE-2016-1744 [HIGH] CVE-2016-1744: The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1743.

CVE-2019-8600 [CRITICAL] CWE-89 CVE-2019-8600: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 1 A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution.

CVE-2016-1848 [HIGH] CWE-119 CVE-2016-1848: QuickTime in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a QuickTime in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file.

CVE-2016-1769 [HIGH] CWE-119 CVE-2016-1769: QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop file.

CVE-2016-1821 [HIGH] CVE-2016-1821: IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privilege IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

CVE-2016-1793 [HIGH] CVE-2016-1793: AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

CVE-2015-7068 [HIGH] CWE-476 CVE-2015-7068: IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 all IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.

CVE-2015-6995 [MEDIUM] CWE-119 CVE-2015-6995: The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which al The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.