Apple Mac Os X Server vulnerabilities

CVE-2008-0997 [MEDIUM] CWE-119 CVE-2008-0997: Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows user-assisted remote attacker Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows user-assisted remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted PostScript Printer Description (PPD) file that is not properly handled when querying a network printer.

CVE-2009-2809 [MEDIUM] CWE-94 CVE-2009-2809: ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or ca ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PixarFilm encoded TIFF image, related to "multiple memory corruption issues."

CVE-2009-1727 [MEDIUM] CVE-2009-1727: Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X 10.5 before 10.5.8 makes it easier Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X 10.5 before 10.5.8 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari.

CVE-2009-2800 [MEDIUM] CWE-119 CVE-2009-2800: Buffer overflow in Alias Manager in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute ar Buffer overflow in Alias Manager in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted alias file.

CVE-2011-3449 [MEDIUM] CWE-399 CVE-2011-3449: Use-after-free vulnerability in CoreText in Apple Mac OS X before 10.7.3 allows remote attackers to Use-after-free vulnerability in CoreText in Apple Mac OS X before 10.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded font in a document.

CVE-2009-2205 [MEDIUM] CWE-119 CVE-2009-2205: Stack-based buffer overflow in the Java Web Start command launcher in Java for Mac OS X 10.5 before Stack-based buffer overflow in the Java Web Start command launcher in Java for Mac OS X 10.5 before Update 5 allows attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

CVE-2010-4013 [MEDIUM] CWE-134 CVE-2010-4013: Format string vulnerability in PackageKit in Apple Mac OS X 10.6.x before 10.6.6 allows man-in-the-m Format string vulnerability in PackageKit in Apple Mac OS X 10.6.x before 10.6.6 allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to interaction between Software Update and distribution scripts.

CVE-2013-0971 [MEDIUM] CWE-399 CVE-2013-0971: Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to ex Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted ink annotations in a PDF document.

CVE-2012-0654 [MEDIUM] CWE-119 CVE-2012-0654: libsecurity in Apple Mac OS X before 10.7.4 accesses uninitialized memory locations during the proce libsecurity in Apple Mac OS X before 10.7.4 accesses uninitialized memory locations during the processing of X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted certificate.

CVE-2011-0173 [MEDIUM] CWE-134 CVE-2011-0173: Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context- Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) display dialog or (2) display alert command in a dialog in an AppleScript Studio application.

CVE-2009-0017 [HIGH] CWE-119 CVE-2009-0017: csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions, which allows local users to execute arbitrary code via unknown vectors that trigger a heap-based buffer overflow.

CVE-2008-3645 [HIGH] CWE-119 CVE-2008-3645: Heap-based buffer overflow in the local IPC component in the EAPOLController plugin for configd (Net Heap-based buffer overflow in the local IPC component in the EAPOLController plugin for configd (Networking component) in Mac OS X 10.4.11 and 10.5.5 allows local users to execute arbitrary code via unknown vectors.

CVE-2011-3463 [HIGH] CWE-287 CVE-2011-3463: WebDAV Sharing in Apple Mac OS X 10.7.x before 10.7.3 does not properly perform authentication, whic WebDAV Sharing in Apple Mac OS X 10.7.x before 10.7.3 does not properly perform authentication, which allows local users to gain privileges by leveraging access to (1) the server or (2) a bound directory.

CVE-2010-0058 [MEDIUM] CWE-16 CVE-2010-0058: freshclam in ClamAV in Apple Mac OS X 10.5.8 with Security Update 2009-005 has an incorrect launchd. freshclam in ClamAV in Apple Mac OS X 10.5.8 with Security Update 2009-005 has an incorrect launchd.plist ProgramArguments key and consequently does not run, which might allow remote attackers to introduce viruses into the system.

CVE-2006-1455 [HIGH] CVE-2006-1455: QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to cause a de QuickTime Streaming Server in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to cause a denial of service (crash and connection interruption) via a QuickTime movie with a missing track, which triggers a null dereference.

CVE-2012-0655 [MEDIUM] CWE-310 CVE-2012-0655: libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within X.509 certificates, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by conducting a spoofing or network-sniffing attack during communication with a site that uses a short key.

CVE-2009-2836 [MEDIUM] CWE-362 CVE-2009-2836: Race condition in Login Window in Apple Mac OS X 10.6.x before 10.6.2, when at least one account has Race condition in Login Window in Apple Mac OS X 10.6.x before 10.6.2, when at least one account has a blank password, allows attackers to bypass password authentication and obtain login access to an arbitrary account via unspecified vectors.

CVE-2009-2831 [MEDIUM] CVE-2009-2831: Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any conte Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any contents, and thereby execute arbitrary code, via crafted JavaScript, related to a "design issue."

CVE-2016-1776 [MEDIUM] CWE-284 CVE-2016-1776: Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DS_Store and .htacc Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DS_Store and .htaccess files, which allows remote attackers to obtain sensitive configuration information via an HTTP request.

CVE-2016-1774 [MEDIUM] CWE-284 CVE-2016-1774: The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about ignored permissions during a backup, which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading backup data that lacks intended restrictions.