Mac OS X
by Apple Inc.
CVEs (2,090)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2009-0020 | 0.00 | — | 0.03 | Feb 13, 2009 | Unspecified vulnerability in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted resource fork that triggers memory corruption. | |||
| CVE-2009-0019 | 0.00 | — | 0.02 | Feb 13, 2009 | Remote Apple Events in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) or obtain sensitive information via unspecified vectors that trigger an out-of-bounds memory access. | |||
| CVE-2009-0018 | 0.00 | — | 0.03 | Feb 13, 2009 | The Remote Apple Events server in Apple Mac OS X 10.4.11 and 10.5.6 does not properly initialize a buffer, which allows remote attackers to read portions of memory. | |||
| CVE-2009-0017 | 0.00 | — | 0.00 | Feb 13, 2009 | csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions, which allows local users to execute arbitrary code via unknown vectors that trigger a heap-based buffer overflow. | |||
| CVE-2009-0015 | 0.00 | — | 0.00 | Feb 13, 2009 | Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information (filesystem activities and directory names) via unknown vectors related to "credential management." | |||
| CVE-2009-0014 | 0.00 | — | 0.00 | Feb 13, 2009 | Folder Manager in Apple Mac OS X 10.5.6 uses insecure default permissions when recreating a Downloads folder after it has been deleted, which allows local users to bypass intended access restrictions and read the Downloads folder. | |||
| CVE-2009-0013 | 0.00 | — | 0.00 | Feb 13, 2009 | dscl in DS Tools in Apple Mac OS X 10.4.11 and 10.5.6 requires that passwords must be provided as command line arguments, which allows local users to gain privileges by listing process information. | |||
| CVE-2009-0012 | 0.00 | — | 0.05 | Feb 13, 2009 | Heap-based buffer overflow in CoreText in Apple Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via a crafted Unicode string. | |||
| CVE-2009-0011 | 0.00 | — | 0.00 | Feb 13, 2009 | Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a temporary file. | |||
| CVE-2009-0009 | 0.00 | — | 0.03 | Feb 13, 2009 | Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted movie file that triggers memory corruption. | |||
| CVE-2009-0142 | 0.00 | — | 0.00 | Feb 12, 2009 | Race condition in AFP Server in Apple Mac OS X 10.5.6 allows local users to cause a denial of service (infinite loop) via unspecified vectors related to "file enumeration logic." | |||
| CVE-2008-4237 | 0.00 | — | 0.02 | Dec 17, 2008 | Managed Client in Apple Mac OS X before 10.5.6 sometimes misidentifies a system when installing per-host configuration settings, which allows context-dependent attackers to have an unspecified impact by leveraging unintended settings, as demonstrated by the screen saver lock… | |||
| CVE-2008-4236 | 0.00 | — | 0.02 | Dec 17, 2008 | Apple Type Services (ATS) in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted embedded font in a PDF file. | |||
| CVE-2008-4234 | 0.00 | — | 0.05 | Dec 17, 2008 | Incomplete blacklist vulnerability in the Quarantine feature in CoreTypes in Apple Mac OS X 10.5 before 10.5.6 allows user-assisted remote attackers to execute arbitrary code via an executable file with the content type indicating no application association for the file, which… | |||
| CVE-2008-4224 | 0.00 | — | 0.02 | Dec 17, 2008 | UDF in Apple Mac OS X before 10.5.6 allows user-assisted attackers to cause a denial of service (system crash) via a malformed UDF volume in a crafted ISO file. | |||
| CVE-2008-4223 | 0.00 | — | 0.05 | Dec 17, 2008 | Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors. | |||
| CVE-2008-4222 | 0.00 | — | 0.04 | Dec 17, 2008 | natd in network_cmds in Apple Mac OS X before 10.5.6, when Internet Sharing is enabled, allows remote attackers to cause a denial of service (infinite loop) via a crafted TCP packet. | |||
| CVE-2008-4221 | 0.00 | — | 0.03 | Dec 17, 2008 | The strptime API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a crafted date string, related to improper memory allocation. | |||
| CVE-2008-4220 | 0.00 | — | 0.04 | Dec 17, 2008 | Integer overflow in the inet_net_pton API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. NOTE: this may be related to the WLB-2008080064 advisory… | |||
| CVE-2008-4219 | 0.00 | — | 0.00 | Dec 17, 2008 | The kernel in Apple Mac OS X before 10.5.6 allows local users to cause a denial of service (infinite loop and system halt) by running an application that is dynamically linked to libraries on an NFS server, related to occurrence of an exception in this application. |
- CVE-2009-0020Feb 13, 2009risk 0.00cvss —epss 0.03
Unspecified vulnerability in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted resource fork that triggers memory corruption.
- CVE-2009-0019Feb 13, 2009risk 0.00cvss —epss 0.02
Remote Apple Events in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) or obtain sensitive information via unspecified vectors that trigger an out-of-bounds memory access.
- CVE-2009-0018Feb 13, 2009risk 0.00cvss —epss 0.03
The Remote Apple Events server in Apple Mac OS X 10.4.11 and 10.5.6 does not properly initialize a buffer, which allows remote attackers to read portions of memory.
- CVE-2009-0017Feb 13, 2009risk 0.00cvss —epss 0.00
csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions, which allows local users to execute arbitrary code via unknown vectors that trigger a heap-based buffer overflow.
- CVE-2009-0015Feb 13, 2009risk 0.00cvss —epss 0.00
Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information (filesystem activities and directory names) via unknown vectors related to "credential management."
- CVE-2009-0014Feb 13, 2009risk 0.00cvss —epss 0.00
Folder Manager in Apple Mac OS X 10.5.6 uses insecure default permissions when recreating a Downloads folder after it has been deleted, which allows local users to bypass intended access restrictions and read the Downloads folder.
- CVE-2009-0013Feb 13, 2009risk 0.00cvss —epss 0.00
dscl in DS Tools in Apple Mac OS X 10.4.11 and 10.5.6 requires that passwords must be provided as command line arguments, which allows local users to gain privileges by listing process information.
- CVE-2009-0012Feb 13, 2009risk 0.00cvss —epss 0.05
Heap-based buffer overflow in CoreText in Apple Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via a crafted Unicode string.
- CVE-2009-0011Feb 13, 2009risk 0.00cvss —epss 0.00
Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a temporary file.
- CVE-2009-0009Feb 13, 2009risk 0.00cvss —epss 0.03
Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted movie file that triggers memory corruption.
- CVE-2009-0142Feb 12, 2009risk 0.00cvss —epss 0.00
Race condition in AFP Server in Apple Mac OS X 10.5.6 allows local users to cause a denial of service (infinite loop) via unspecified vectors related to "file enumeration logic."
- CVE-2008-4237Dec 17, 2008risk 0.00cvss —epss 0.02
Managed Client in Apple Mac OS X before 10.5.6 sometimes misidentifies a system when installing per-host configuration settings, which allows context-dependent attackers to have an unspecified impact by leveraging unintended settings, as demonstrated by the screen saver lock…
- CVE-2008-4236Dec 17, 2008risk 0.00cvss —epss 0.02
Apple Type Services (ATS) in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted embedded font in a PDF file.
- CVE-2008-4234Dec 17, 2008risk 0.00cvss —epss 0.05
Incomplete blacklist vulnerability in the Quarantine feature in CoreTypes in Apple Mac OS X 10.5 before 10.5.6 allows user-assisted remote attackers to execute arbitrary code via an executable file with the content type indicating no application association for the file, which…
- CVE-2008-4224Dec 17, 2008risk 0.00cvss —epss 0.02
UDF in Apple Mac OS X before 10.5.6 allows user-assisted attackers to cause a denial of service (system crash) via a malformed UDF volume in a crafted ISO file.
- CVE-2008-4223Dec 17, 2008risk 0.00cvss —epss 0.05
Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors.
- CVE-2008-4222Dec 17, 2008risk 0.00cvss —epss 0.04
natd in network_cmds in Apple Mac OS X before 10.5.6, when Internet Sharing is enabled, allows remote attackers to cause a denial of service (infinite loop) via a crafted TCP packet.
- CVE-2008-4221Dec 17, 2008risk 0.00cvss —epss 0.03
The strptime API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a crafted date string, related to improper memory allocation.
- CVE-2008-4220Dec 17, 2008risk 0.00cvss —epss 0.04
Integer overflow in the inet_net_pton API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. NOTE: this may be related to the WLB-2008080064 advisory…
- CVE-2008-4219Dec 17, 2008risk 0.00cvss —epss 0.00
The kernel in Apple Mac OS X before 10.5.6 allows local users to cause a denial of service (infinite loop and system halt) by running an application that is dynamically linked to libraries on an NFS server, related to occurrence of an exception in this application.
Page 83 of 105