Mac OS X
by Apple Inc.
CVEs (3,257)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2007-5860 | 0.00 | — | 0.00 | Dec 19, 2007 | Unspecified vulnerability in Spin Tracer in Apple Mac OS X 10.5.1 allows local users to execute arbitrary code via unspecified output files, involving an "insecure file operation." | |||
| CVE-2007-5854 | 0.00 | — | 0.01 | Dec 19, 2007 | Launch Services in Apple Mac OS X 10.4.11 and 10.5.1 does not treat HTML files as unsafe content, which allows attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via a crafted HTML file. | |||
| CVE-2007-5861 | 0.00 | — | 0.02 | Dec 19, 2007 | Unspecified vulnerability in Spotlight in Apple Mac OS X 10.4.11 allows user-assisted attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted .XLS file that triggers memory corruption in the Microsoft Office Spotlight Importer. | |||
| CVE-2007-5859 | 0.00 | — | 0.06 | Dec 19, 2007 | Unspecified vulnerability in Safari RSS in Apple Mac OS X 10.4.11 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted feed: URL that triggers memory corruption. | |||
| CVE-2007-4710 | 0.00 | — | 0.04 | Dec 19, 2007 | Unspecified vulnerability in ColorSync in Apple Mac OS X 10.4.11 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via an image with a crafted ColorSync profile, which triggers memory corruption. | |||
| CVE-2007-5857 | 0.00 | — | 0.03 | Dec 19, 2007 | Quick Look in Apple Mac OS X 10.5.1 does not prevent a movie from accessing URLs when the movie file is previewed or if an icon is created, which might allow remote attackers to obtain sensitive information via HREFTrack. | |||
| CVE-2007-5853 | 0.00 | — | 0.03 | Dec 19, 2007 | Unspecified vulnerability in IO Storage Family in Apple Mac OS X 10.4.11 allows user-assisted attackers to cause a denial of service (system shutdown) or execute arbitrary code via a disk image with crafted GUID partition maps, which triggers memory corruption. | |||
| CVE-2007-5856 | 0.00 | — | 0.02 | Dec 19, 2007 | Quick Look Apple Mac OS X 10.5.1, when previewing an HTML file, does not prevent plug-ins from making network requests, which might allow remote attackers to obtain sensitive information. | |||
| CVE-2007-4709 | 0.00 | — | 0.03 | Dec 19, 2007 | Directory traversal vulnerability in CFNetwork in Apple Mac OS X 10.5.1 allows remote attackers to overwrite arbitrary files via a crafted HTTP response. | |||
| CVE-2007-5848 | 0.00 | — | 0.01 | Dec 19, 2007 | Buffer overflow in CUPS in Apple Mac OS X 10.4.11 allows local admin users to execute arbitrary code via a crafted URI to the CUPS service. | |||
| CVE-2007-5855 | 0.00 | — | 0.02 | Dec 19, 2007 | Mail in Apple Mac OS X 10.4.11 and 10.5.1, when an SMTP account has been set up using Account Assistant, can use plaintext authentication even when MD5 Challenge-Response authentication is available, which makes it easier for remote attackers to sniff account activity. | |||
| CVE-2007-5862 | 0.00 | — | 0.03 | Dec 18, 2007 | Java in Mac OS X 10.4 through 10.4.11 allows remote attackers to bypass Keychain access controls and add or delete arbitrary Keychain items via a crafted Java applet. | |||
| CVE-2007-4703 | 0.00 | — | 0.03 | Nov 15, 2007 | The Application Firewall in Apple Mac OS X 10.5 does not prevent a root process from accepting incoming connections, even when "Block incoming connections" has been set for its associated executable, which might allow remote attackers or local root processes to bypass intended… | |||
| CVE-2007-4702 | 0.00 | — | 0.02 | Nov 15, 2007 | The Application Firewall in Apple Mac OS X 10.5, when "Block all incoming connections" is enabled, does not prevent root processes or mDNSResponder from accepting connections, which might allow remote attackers or local root processes to bypass intended access restrictions. | |||
| CVE-2007-4704 | 0.00 | — | 0.02 | Nov 15, 2007 | The Application Firewall in Apple Mac OS X 10.5 does not apply changed settings to processes that are started by launchd until the processes are restarted, which might allow attackers to bypass intended access restrictions. | |||
| CVE-2007-4699 | 0.00 | — | 0.02 | Nov 15, 2007 | The default configuration of Safari in Apple Mac OS X 10.4 through 10.4.10 adds a private key to the keychain with permissions that allow other applications to access the key without warning the user, which might allow other applications to bypass intended access restrictions. | |||
| CVE-2007-4700 | 0.00 | — | 0.02 | Nov 15, 2007 | Unspecified vulnerability in WebKit on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to use Safari as an indirect proxy and send attacker-controlled data to arbitrary TCP ports via unknown vectors. | |||
| CVE-2007-4701 | 0.00 | — | 0.00 | Nov 15, 2007 | WebKit on Apple Mac OS X 10.4 through 10.4.10 does not create temporary files securely when Safari is previewing a PDF file, which allows local users to read the contents of that file. | |||
| CVE-2007-4691 | 0.00 | — | 0.02 | Nov 15, 2007 | The NSURL component in Apple Mac OS X 10.4 through 10.4.10 performs case-sensitive comparisons that allow attackers to bypass intended restrictions for local file system URLs. | |||
| CVE-2007-4679 | 0.00 | — | 0.02 | Nov 15, 2007 | CFFTP in CFNetwork for Apple Mac OS X 10.4 through 10.4.10 allows remote FTP servers to force clients to connect to other hosts via crafted responses to FTP PASV commands. |
- CVE-2007-5860Dec 19, 2007risk 0.00cvss —epss 0.00
Unspecified vulnerability in Spin Tracer in Apple Mac OS X 10.5.1 allows local users to execute arbitrary code via unspecified output files, involving an "insecure file operation."
- CVE-2007-5854Dec 19, 2007risk 0.00cvss —epss 0.01
Launch Services in Apple Mac OS X 10.4.11 and 10.5.1 does not treat HTML files as unsafe content, which allows attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via a crafted HTML file.
- CVE-2007-5861Dec 19, 2007risk 0.00cvss —epss 0.02
Unspecified vulnerability in Spotlight in Apple Mac OS X 10.4.11 allows user-assisted attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted .XLS file that triggers memory corruption in the Microsoft Office Spotlight Importer.
- CVE-2007-5859Dec 19, 2007risk 0.00cvss —epss 0.06
Unspecified vulnerability in Safari RSS in Apple Mac OS X 10.4.11 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted feed: URL that triggers memory corruption.
- CVE-2007-4710Dec 19, 2007risk 0.00cvss —epss 0.04
Unspecified vulnerability in ColorSync in Apple Mac OS X 10.4.11 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via an image with a crafted ColorSync profile, which triggers memory corruption.
- CVE-2007-5857Dec 19, 2007risk 0.00cvss —epss 0.03
Quick Look in Apple Mac OS X 10.5.1 does not prevent a movie from accessing URLs when the movie file is previewed or if an icon is created, which might allow remote attackers to obtain sensitive information via HREFTrack.
- CVE-2007-5853Dec 19, 2007risk 0.00cvss —epss 0.03
Unspecified vulnerability in IO Storage Family in Apple Mac OS X 10.4.11 allows user-assisted attackers to cause a denial of service (system shutdown) or execute arbitrary code via a disk image with crafted GUID partition maps, which triggers memory corruption.
- CVE-2007-5856Dec 19, 2007risk 0.00cvss —epss 0.02
Quick Look Apple Mac OS X 10.5.1, when previewing an HTML file, does not prevent plug-ins from making network requests, which might allow remote attackers to obtain sensitive information.
- CVE-2007-4709Dec 19, 2007risk 0.00cvss —epss 0.03
Directory traversal vulnerability in CFNetwork in Apple Mac OS X 10.5.1 allows remote attackers to overwrite arbitrary files via a crafted HTTP response.
- CVE-2007-5848Dec 19, 2007risk 0.00cvss —epss 0.01
Buffer overflow in CUPS in Apple Mac OS X 10.4.11 allows local admin users to execute arbitrary code via a crafted URI to the CUPS service.
- CVE-2007-5855Dec 19, 2007risk 0.00cvss —epss 0.02
Mail in Apple Mac OS X 10.4.11 and 10.5.1, when an SMTP account has been set up using Account Assistant, can use plaintext authentication even when MD5 Challenge-Response authentication is available, which makes it easier for remote attackers to sniff account activity.
- CVE-2007-5862Dec 18, 2007risk 0.00cvss —epss 0.03
Java in Mac OS X 10.4 through 10.4.11 allows remote attackers to bypass Keychain access controls and add or delete arbitrary Keychain items via a crafted Java applet.
- CVE-2007-4703Nov 15, 2007risk 0.00cvss —epss 0.03
The Application Firewall in Apple Mac OS X 10.5 does not prevent a root process from accepting incoming connections, even when "Block incoming connections" has been set for its associated executable, which might allow remote attackers or local root processes to bypass intended…
- CVE-2007-4702Nov 15, 2007risk 0.00cvss —epss 0.02
The Application Firewall in Apple Mac OS X 10.5, when "Block all incoming connections" is enabled, does not prevent root processes or mDNSResponder from accepting connections, which might allow remote attackers or local root processes to bypass intended access restrictions.
- CVE-2007-4704Nov 15, 2007risk 0.00cvss —epss 0.02
The Application Firewall in Apple Mac OS X 10.5 does not apply changed settings to processes that are started by launchd until the processes are restarted, which might allow attackers to bypass intended access restrictions.
- CVE-2007-4699Nov 15, 2007risk 0.00cvss —epss 0.02
The default configuration of Safari in Apple Mac OS X 10.4 through 10.4.10 adds a private key to the keychain with permissions that allow other applications to access the key without warning the user, which might allow other applications to bypass intended access restrictions.
- CVE-2007-4700Nov 15, 2007risk 0.00cvss —epss 0.02
Unspecified vulnerability in WebKit on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to use Safari as an indirect proxy and send attacker-controlled data to arbitrary TCP ports via unknown vectors.
- CVE-2007-4701Nov 15, 2007risk 0.00cvss —epss 0.00
WebKit on Apple Mac OS X 10.4 through 10.4.10 does not create temporary files securely when Safari is previewing a PDF file, which allows local users to read the contents of that file.
- CVE-2007-4691Nov 15, 2007risk 0.00cvss —epss 0.02
The NSURL component in Apple Mac OS X 10.4 through 10.4.10 performs case-sensitive comparisons that allow attackers to bypass intended restrictions for local file system URLs.
- CVE-2007-4679Nov 15, 2007risk 0.00cvss —epss 0.02
CFFTP in CFNetwork for Apple Mac OS X 10.4 through 10.4.10 allows remote FTP servers to force clients to connect to other hosts via crafted responses to FTP PASV commands.
Page 147 of 163