Apple Xcode vulnerabilities

CVE-2014-8108 [MEDIUM] CVE-2014-8108: The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.

CVE-2014-6394 [HIGH] CWE-22 CVE-2014-6394: visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a director visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

CVE-2014-3522 [MEDIUM] CWE-297 CVE-2014-3522: The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 doe The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

CVE-2014-3528 [MEDIUM] CWE-255 CVE-2014-3528: Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

CVE-2012-3698 [MEDIUM] CWE-264 CVE-2012-3698: Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of pro Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2) command-line tool.

CVE-2008-2318 [MEDIUM] CWE-200 CVE-2008-2318: The WOHyperlink implementation in WebObjects in Apple Xcode tools before 3.1 appends local session I The WOHyperlink implementation in WebObjects in Apple Xcode tools before 3.1 appends local session IDs to generated non-local URLs, which allows remote attackers to obtain potentially sensitive information by reading the requests for these URLs.

CVE-2006-5327 [HIGH] CVE-2006-5327: Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, which is executed by gnutar with certain TAR_OPTIONS environment variable settings, when gnutar is invoked by Open

CVE-2006-5328 [HIGH] CVE-2006-5328: OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other product OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to create arbitrary files via a symlink attack on the simulation.sql file.

CVE-2006-1466 [MEDIUM] CVE-2006-1466: Xcode Tools before 2.3 for Mac OS X 10.4, when running the WebObjects plugin, allows remote attacker Xcode Tools before 2.3 for Mac OS X 10.4, when running the WebObjects plugin, allows remote attackers to access or modify WebObjects projects through a network service.

CVE-2004-2687 [CRITICAL] CWE-16 CVE-2004-2687: distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server po distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.

CVE-2015-7082 [CRITICAL] CVE-2015-7082: Xcode 7.2 Apple Security Update: About the security content of Xcode 7.2 Product: Xcode Version: 7.2 CVE: CVE-2015-7082 Component: CVE-2015-7082

CVE-2014-3567 [HIGH] CVE-2014-3567: Xcode 7.0 Apple Security Update: About the security content of Xcode 7.0 Product: Xcode Version: 7.0 CVE: CVE-2014-3567 Component: CVE-2014-3567

CVE-2014-3513 [HIGH] CVE-2014-3513: Xcode 7.0 Apple Security Update: About the security content of Xcode 7.0 Product: Xcode Version: 7.0 CVE: CVE-2014-3513 Component: CVE-2014-3513

CVE-2014-3568 [MEDIUM] CVE-2014-3568: Xcode 7.0 Apple Security Update: About the security content of Xcode 7.0 Product: Xcode Version: 7.0 CVE: CVE-2014-3568 Component: CVE-2014-3568

CVE-2014-3566 [LOW] CVE-2014-3566: Xcode 7.0 Apple Security Update: About the security content of Xcode 7.0 Product: Xcode Version: 7.0 CVE: CVE-2014-3566 Component: CVE-2014-3566