CVEs

31,810 total · page 589 of 637

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2016-1463	Cisco Systems, Inc. Firesight System Software	Hig	0.49	7.5	0.02	Jul 28, 2016	Cisco FireSIGHT System Software 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet, aka Bug ID CSCuz20737.
CVE-2016-1374	BMC Software Performance Manager	Hig	0.57	8.8	0.03	Jul 28, 2016	The web framework in Cisco Unified Computing System (UCS) Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request, aka Bug ID CSCuy07827.
CVE-2015-5738	Marvell Software Development Kit	Hig	0.49	7.5	0.02	Jul 26, 2016	The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel…
CVE-2016-6152	Ca Ehealth	Hig	0.57	8.8	0.03	Jul 26, 2016	CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
CVE-2016-6151	Ca Ehealth	Hig	0.57	8.8	0.03	Jul 26, 2016	CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
CVE-2016-6297	PHP PHP	Hig	0.58	8.8	0.05	Jul 25, 2016	Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a…
CVE-2016-6289	PHP PHP	Hig	0.51	7.8	0.04	Jul 25, 2016	Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted…
CVE-2016-5136	Google Chrome	Hig	0.57	8.8	0.01	Jul 23, 2016	Use-after-free vulnerability in extensions/renderer/user_script_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.
CVE-2016-5134	Google Chrome	Hig	0.57	8.8	0.01	Jul 23, 2016	net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a…
CVE-2016-5132	Google Chrome	Hig	0.57	8.8	0.01	Jul 23, 2016	The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element…
CVE-2016-5131	Google Chrome	Hig	0.57	8.8	0.02	Jul 23, 2016	Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
CVE-2016-5129	Google Chrome	Hig	0.57	8.8	0.02	Jul 23, 2016	Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.
CVE-2016-5128	Google Chrome	Hig	0.57	8.8	0.01	Jul 23, 2016	objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-5127	Google Chrome	Hig	0.49	7.5	0.01	Jul 23, 2016	Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import…
CVE-2016-1711	Google Chrome	Hig	0.57	8.8	0.01	Jul 23, 2016	WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation on a DocumentLoader object, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-1710	Google Chrome	Hig	0.57	8.8	0.01	Jul 23, 2016	The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-1709	Google Chrome	Hig	0.50	8.8	0.01	Jul 23, 2016	Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.
CVE-2016-1708	Google Chrome	Hig	0.57	8.8	0.01	Jul 23, 2016	The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows remote attackers to cause a denial of service (use-after-free) or…
CVE-2016-1705	Google Chrome	Hig	0.57	8.8	0.01	Jul 23, 2016	Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2016-5874	Siemens Foundation Simatic Net Pc Software	Hig	0.49	7.5	0.04	Jul 22, 2016	Siemens SIMATIC NET PC-Software before 13 SP2 allows remote attackers to cause a denial of service (OPC UA service outage) via crafted TCP packets.
CVE-2016-5744	Siemens Foundation Wincc	Hig	0.49	7.5	0.04	Jul 22, 2016	Siemens SIMATIC WinCC 7.0 through SP3 and 7.2 allows remote attackers to read arbitrary WinCC station files via crafted packets.
CVE-2016-4653	Apple Inc. tvOS	Hig	0.51	7.8	0.00	Jul 22, 2016	The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1863 and CVE-2016-4582.
CVE-2016-4647	Apple Inc. OS X	Hig	0.51	7.8	0.00	Jul 22, 2016	Audio in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted file.
CVE-2016-4641	Apple Inc. OS X	Hig	0.47	7.3	0.01	Jul 22, 2016	Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a "type confusion."
CVE-2016-4640	Apple Inc. Mac OS X	Hig	0.51	7.8	0.01	Jul 22, 2016	Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context, obtain sensitive user information, or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4639	Apple Inc. OS X	Hig	0.46	7.0	0.00	Jul 22, 2016	Login Window in Apple OS X before 10.11.6 does not properly initialize memory, which allows local users to cause a denial of service via unspecified vectors.
CVE-2016-4638	Apple Inc. OS X	Hig	0.51	7.8	0.01	Jul 22, 2016	Login Window in Apple OS X before 10.11.6 allows attackers to gain privileges via a crafted app that leverages a "type confusion."
CVE-2016-4637	Apple Inc. Coregraphics	Hig	0.57	8.8	0.04	Jul 22, 2016	CoreGraphics in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted BMP image.
CVE-2016-4634	Apple Inc. OS X	Hig	0.51	7.8	0.00	Jul 22, 2016	The Graphics Drivers subsystem in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-4633	Apple Inc. OS X	Hig	0.51	7.8	0.00	Jul 22, 2016	Intel Graphics Driver in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4632	Apple Inc. tvOS	Hig	0.49	7.5	0.03	Jul 22, 2016	ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVE-2016-4631	Apple Inc. tvOS	Hig	0.57	8.8	0.05	Jul 22, 2016	ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF file.
CVE-2016-4630	Apple Inc. OS X	Hig	0.57	8.8	0.04	Jul 22, 2016	ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted EXR image with B44 compression.
CVE-2016-4627	Apple Inc. tvOS	Hig	0.51	7.8	0.00	Jul 22, 2016	IOAcceleratorFamily in Apple iOS before 9.3.3, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2016-4626	Apple Inc. tvOS	Hig	0.51	7.8	0.00	Jul 22, 2016	IOHIDFamily in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2016-4625	Apple Inc. OS X	Hig	0.54	7.8	0.02	Jul 22, 2016	Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors.
CVE-2016-4624	Apple Inc. Webkit	Hig	0.57	8.8	0.03	Jul 22, 2016	WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4623.
CVE-2016-4623	Apple Inc. Safari	Hig	0.57	8.8	0.03	Jul 22, 2016	WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4624.
CVE-2016-4622	Apple Inc. Safari	Hig	0.63	8.8	0.19	Jul 22, 2016	WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624.
CVE-2016-4621	Apple Inc. OS X	Hig	0.51	7.8	0.01	Jul 22, 2016	libc++abi in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4602	Apple Inc. Quicktime	Hig	0.57	8.8	0.02	Jul 22, 2016	QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4597, and CVE-2016-4600.
CVE-2016-4601	Apple Inc. Quicktime	Hig	0.57	8.8	0.02	Jul 22, 2016	QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted SGI image.
CVE-2016-4600	Apple Inc. Quicktime	Hig	0.57	8.8	0.02	Jul 22, 2016	QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4597, and CVE-2016-4602.
CVE-2016-4599	Apple Inc. Quicktime	Hig	0.51	7.8	0.02	Jul 22, 2016	QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop document.
CVE-2016-4597	Apple Inc. Quicktime	Hig	0.57	8.8	0.02	Jul 22, 2016	QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4600, and CVE-2016-4602.
CVE-2016-4596	Apple Inc. Quicktime	Hig	0.57	8.8	0.02	Jul 22, 2016	QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4597, CVE-2016-4600, and CVE-2016-4602.
CVE-2016-4594	Apple Inc. tvOS	Hig	0.51	7.8	0.01	Jul 22, 2016	The Sandbox Profiles component in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows attackers to access the process list via a crafted app that makes an API call.
CVE-2016-4591	Apple Inc. Safari	Hig	0.49	7.5	0.04	Jul 22, 2016	WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
CVE-2016-4589	Apple Inc. Safari	Hig	0.57	8.8	0.03	Jul 22, 2016	WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4622, CVE-2016-4623, and CVE-2016-4624.
CVE-2016-4588	Apple Inc. tvOS	Hig	0.57	8.8	0.02	Jul 22, 2016	WebKit in Apple tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

CVE-2016-1463HigJul 28, 2016
Cisco Systems, Inc.
Firesight System Software
risk 0.49cvss 7.5epss 0.02
Cisco FireSIGHT System Software 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet, aka Bug ID CSCuz20737.
CVE-2016-1374HigJul 28, 2016
BMC Software
Performance Manager
risk 0.57cvss 8.8epss 0.03
The web framework in Cisco Unified Computing System (UCS) Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request, aka Bug ID CSCuy07827.
CVE-2015-5738HigJul 26, 2016
Marvell
Software Development Kit
risk 0.49cvss 7.5epss 0.02
The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel…
CVE-2016-6152HigJul 26, 2016
Ca
Ehealth
risk 0.57cvss 8.8epss 0.03
CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
CVE-2016-6151HigJul 26, 2016
Ca
Ehealth
risk 0.57cvss 8.8epss 0.03
CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
CVE-2016-6297HigJul 25, 2016
PHP
PHP
risk 0.58cvss 8.8epss 0.05
Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a…
CVE-2016-6289HigJul 25, 2016
PHP
PHP
risk 0.51cvss 7.8epss 0.04
Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted…
CVE-2016-5136HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.01
Use-after-free vulnerability in extensions/renderer/user_script_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.
CVE-2016-5134HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.01
net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a…
CVE-2016-5132HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.01
The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element…
CVE-2016-5131HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.02
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
CVE-2016-5129HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.02
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.
CVE-2016-5128HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.01
objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-5127HigJul 23, 2016
Google
Chrome
risk 0.49cvss 7.5epss 0.01
Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import…
CVE-2016-1711HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.01
WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation on a DocumentLoader object, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-1710HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.01
The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-1709HigJul 23, 2016
Google
Chrome
risk 0.50cvss 8.8epss 0.01
Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.
CVE-2016-1708HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.01
The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows remote attackers to cause a denial of service (use-after-free) or…
CVE-2016-1705HigJul 23, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.01
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2016-5874HigJul 22, 2016
Siemens Foundation
Simatic Net Pc Software
risk 0.49cvss 7.5epss 0.04
Siemens SIMATIC NET PC-Software before 13 SP2 allows remote attackers to cause a denial of service (OPC UA service outage) via crafted TCP packets.
CVE-2016-5744HigJul 22, 2016
Siemens Foundation
Wincc
risk 0.49cvss 7.5epss 0.04
Siemens SIMATIC WinCC 7.0 through SP3 and 7.2 allows remote attackers to read arbitrary WinCC station files via crafted packets.
CVE-2016-4653HigJul 22, 2016
Apple Inc.
tvOS
risk 0.51cvss 7.8epss 0.00
The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1863 and CVE-2016-4582.
CVE-2016-4647HigJul 22, 2016
Apple Inc.
OS X
risk 0.51cvss 7.8epss 0.00
Audio in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted file.
CVE-2016-4641HigJul 22, 2016
Apple Inc.
OS X
risk 0.47cvss 7.3epss 0.01
Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a "type confusion."
CVE-2016-4640HigJul 22, 2016
Apple Inc.
Mac OS X
risk 0.51cvss 7.8epss 0.01
Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context, obtain sensitive user information, or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4639HigJul 22, 2016
Apple Inc.
OS X
risk 0.46cvss 7.0epss 0.00
Login Window in Apple OS X before 10.11.6 does not properly initialize memory, which allows local users to cause a denial of service via unspecified vectors.
CVE-2016-4638HigJul 22, 2016
Apple Inc.
OS X
risk 0.51cvss 7.8epss 0.01
Login Window in Apple OS X before 10.11.6 allows attackers to gain privileges via a crafted app that leverages a "type confusion."
CVE-2016-4637HigJul 22, 2016
Apple Inc.
Coregraphics
risk 0.57cvss 8.8epss 0.04
CoreGraphics in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted BMP image.
CVE-2016-4634HigJul 22, 2016
Apple Inc.
OS X
risk 0.51cvss 7.8epss 0.00
The Graphics Drivers subsystem in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-4633HigJul 22, 2016
Apple Inc.
OS X
risk 0.51cvss 7.8epss 0.00
Intel Graphics Driver in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4632HigJul 22, 2016
Apple Inc.
tvOS
risk 0.49cvss 7.5epss 0.03
ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVE-2016-4631HigJul 22, 2016
Apple Inc.
tvOS
risk 0.57cvss 8.8epss 0.05
ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF file.
CVE-2016-4630HigJul 22, 2016
Apple Inc.
OS X
risk 0.57cvss 8.8epss 0.04
ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted EXR image with B44 compression.
CVE-2016-4627HigJul 22, 2016
Apple Inc.
tvOS
risk 0.51cvss 7.8epss 0.00
IOAcceleratorFamily in Apple iOS before 9.3.3, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2016-4626HigJul 22, 2016
Apple Inc.
tvOS
risk 0.51cvss 7.8epss 0.00
IOHIDFamily in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2016-4625HigJul 22, 2016
Apple Inc.
OS X
risk 0.54cvss 7.8epss 0.02
Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors.
CVE-2016-4624HigJul 22, 2016
Apple Inc.
Webkit
risk 0.57cvss 8.8epss 0.03
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4623.
CVE-2016-4623HigJul 22, 2016
Apple Inc.
Safari
risk 0.57cvss 8.8epss 0.03
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4624.
CVE-2016-4622HigJul 22, 2016
Apple Inc.
Safari
risk 0.63cvss 8.8epss 0.19
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624.
CVE-2016-4621HigJul 22, 2016
Apple Inc.
OS X
risk 0.51cvss 7.8epss 0.01
libc++abi in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4602HigJul 22, 2016
Apple Inc.
Quicktime
risk 0.57cvss 8.8epss 0.02
QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4597, and CVE-2016-4600.
CVE-2016-4601HigJul 22, 2016
Apple Inc.
Quicktime
risk 0.57cvss 8.8epss 0.02
QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted SGI image.
CVE-2016-4600HigJul 22, 2016
Apple Inc.
Quicktime
risk 0.57cvss 8.8epss 0.02
QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4597, and CVE-2016-4602.
CVE-2016-4599HigJul 22, 2016
Apple Inc.
Quicktime
risk 0.51cvss 7.8epss 0.02
QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop document.
CVE-2016-4597HigJul 22, 2016
Apple Inc.
Quicktime
risk 0.57cvss 8.8epss 0.02
QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4600, and CVE-2016-4602.
CVE-2016-4596HigJul 22, 2016
Apple Inc.
Quicktime
risk 0.57cvss 8.8epss 0.02
QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4597, CVE-2016-4600, and CVE-2016-4602.
CVE-2016-4594HigJul 22, 2016
Apple Inc.
tvOS
risk 0.51cvss 7.8epss 0.01
The Sandbox Profiles component in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows attackers to access the process list via a crafted app that makes an API call.
CVE-2016-4591HigJul 22, 2016
Apple Inc.
Safari
risk 0.49cvss 7.5epss 0.04
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
CVE-2016-4589HigJul 22, 2016
Apple Inc.
Safari
risk 0.57cvss 8.8epss 0.03
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4622, CVE-2016-4623, and CVE-2016-4624.
CVE-2016-4588HigJul 22, 2016
Apple Inc.
tvOS
risk 0.57cvss 8.8epss 0.02
WebKit in Apple tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.