Apple Xcode vulnerabilities

CVE-2021-21300 [HIGH] CWE-59 CVE-2021-21300: Git is an open-source distributed revision control system. In affected versions of Git a specially c Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default f

CVE-2019-8840 [HIGH] CWE-125 CVE-2019-8840: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3 An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3. Compiling with untrusted sources may lead to arbitrary code execution with user privileges.

CVE-2020-9992 [HIGH] CVE-2020-9992: This issue was addressed by encrypting communications over the network to devices running iOS 14, iP This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network.

CVE-2014-9390 [CRITICAL] CWE-20 CVE-2014-9390: Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allo

CVE-2019-20372 [MEDIUM] CWE-444 CVE-2019-20372: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demon NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

CVE-2019-8739 [HIGH] CWE-787 CVE-2019-8739: A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.

CVE-2019-8723 [HIGH] CWE-20 CVE-2019-8723: Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. Th Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

CVE-2019-8722 [HIGH] CWE-20 CVE-2019-8722: Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. Th Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

CVE-2019-8738 [HIGH] CWE-787 CVE-2019-8738: A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.

CVE-2019-8800 [HIGH] CWE-787 CVE-2019-8800: A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.

CVE-2019-8721 [HIGH] CWE-20 CVE-2019-8721: Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. Th Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

CVE-2019-8724 [HIGH] CWE-20 CVE-2019-8724: Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. Th Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

CVE-2019-8806 [HIGH] CWE-787 CVE-2019-8806: A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.

CVE-2019-1348 [LOW] CVE-2019-1348: Xcode 11.2 Apple Security Update: About the security content of Xcode 11.2 Product: Xcode Version: 11.2 CVE: CVE-2019-1348 Component: Git Impact: Git could allow a remote malicious user to bypass security restrictions, caused by a flaw in the --export-marks option of git fast-import Description: An input validation issue was addressed.

CVE-2019-14379 [CRITICAL] CWE-1321 CVE-2019-14379: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when eh SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVE-2018-4357 [HIGH] CWE-119 CVE-2018-4357: A memory corruption issue was addressed with improved input validation. This issue affected versions A memory corruption issue was addressed with improved input validation. This issue affected versions prior to Xcode 10.

CVE-2018-4461 [HIGH] CVE-2018-4461: Xcode 10.2 Apple Security Update: About the security content of Xcode 10.2 Product: Xcode Version: 10.2 CVE: CVE-2018-4461 Component: Kernel Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation.

CVE-2019-3855 [HIGH] CWE-190 CVE-2019-3855: An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVE-2018-16844 [HIGH] CWE-400 CVE-2018-16844: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

CVE-2018-16843 [HIGH] CWE-400 CVE-2018-16843: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.