VYPR
← Apple Inc.

Vendor CVEs

Apple Inc.

All CVEs

9,002 total · sorted by risk
  • CVE-2010-1176Mar 29, 2010
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.09

    Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to an array of long strings, an array of IMG elements with crafted strings in their SRC attributes, a…

  • CVE-2010-1029Mar 19, 2010
    Google
    Chrome
    risk 0.04cvss —epss 0.10

    Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service (application crash) or possibly…

  • CVE-2010-0049Mar 15, 2010
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.11

    Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via HTML elements with right-to-left (RTL) text directionality.

  • CVE-2010-0314Jan 14, 2010
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.07

    Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value.

  • CVE-2009-4186Dec 3, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.07

    Stack consumption vulnerability in Apple Safari 4.0.3 on Windows allows remote attackers to cause a denial of service (application crash) via a long URI value (aka url) in the Cascading Style Sheets (CSS) background property.

  • CVE-2009-4017Nov 24, 2009
    PHP
    PHP
    risk 0.04cvss —epss 0.12

    PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to…

  • CVE-2009-2817Sep 24, 2009
    Apple Inc.
    iTunes
    risk 0.04cvss —epss 0.09

    Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .pls file.

  • CVE-2009-3272Sep 21, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.06

    Stack consumption vulnerability in WebKit.dll in WebKit in Apple Safari 3.2.3, and possibly other versions before 4.1.2, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls eval on a long string composed of A/ sequences.

  • CVE-2009-2195Aug 12, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.13

    Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted floating-point numbers.

  • CVE-2009-2419Jul 9, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.09

    Use-after-free vulnerability in the servePendingRequests function in WebCore in WebKit in Apple Safari 4.0 and 4.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted HTML document that references a…

  • CVE-2009-0961Jun 19, 2009
    Apple Inc.
    Iphone OS
    risk 0.04cvss —epss 0.06

    The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog when another alert appears, which might allow remote attackers to force the iPhone to place a call without user approval by causing an…

  • CVE-2009-1684Jun 10, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via an event handler that triggers script execution in the…

  • CVE-2009-0955Jun 2, 2009
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.10

    Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted image description atoms in an Apple video file, related to a "sign extension issue."

  • CVE-2009-1236Apr 2, 2009
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.08

    Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites a certain ifPort…

  • CVE-2009-0744Feb 27, 2009
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.07

    Apple Safari 4 Beta build 528.16 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a feeds: URI beginning with a (1) % (percent), (2) { (open curly bracket), (3) } (close curly bracket), (4) ^ (caret), (5) ` (backquote), or…

  • CVE-2008-5406Dec 10, 2008
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.10

    Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a MOV file with "long arguments," related to an "off by one overflow."

  • CVE-2008-4116Sep 18, 2008
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.12

    Buffer overflow in Apple QuickTime 7.5.5 and iTunes 8.0 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a long type attribute in a quicktime tag (1) on a web page or embedded in a (2) .mp4 or (3) .mov file, possibly…

  • CVE-2008-3950Sep 16, 2008
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.07

    Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service (browser crash) via a JavaScript alert call with an…

  • CVE-2008-2326Sep 11, 2008
    Apple Inc.
    Bonjour
    risk 0.04cvss —epss 0.07

    mDNSResponder in the Bonjour Namespace Provider in Apple Bonjour for Windows before 1.0.5 allows attackers to cause a denial of service (NULL pointer dereference and application crash) by resolving a crafted .local domain name that contains a long label.

  • CVE-2008-2321Aug 4, 2008
    Apple Inc.
    Coregraphics
    risk 0.04cvss —epss 0.12

    Unspecified vulnerability in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unknown vectors involving "processing of arguments."

  • CVE-2008-2303Jul 14, 2008
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.13

    Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript array indices that trigger an out-of-bounds access, a…

  • CVE-2008-1035Jun 3, 2008
    Apple Inc.
    Ical
    risk 0.04cvss —epss 0.10

    Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to trigger memory corruption or possibly execute arbitrary code via an "ATTACH;VALUE=URI:S=osumi" line in a .ics file, which triggers a "resource…

  • CVE-2008-2006May 22, 2008
    Apple Inc.
    Ical
    risk 0.04cvss —epss 0.10

    Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a .ics file containing (1) a large 16-bit integer on a TRIGGER…

  • CVE-2008-0778Feb 14, 2008
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.09

    Multiple stack-based buffer overflows in an ActiveX control in QTPlugin.ocx for Apple QuickTime 7.4.1 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the (1) SetBgColor, (2) SetHREF, (3)…

  • CVE-2008-0729Feb 12, 2008
    Apple Inc.
    MobileSafari
    risk 0.04cvss —epss 0.08

    Mobile Safari on Apple iPhone 1.1.2 and 1.1.3 allows remote attackers to cause a denial of service (memory exhaustion and device crash) via certain JavaScript code that constructs a long string and an array containing long string elements, possibly a related issue to…

  • CVE-2008-0234Jan 11, 2008
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.12

    Buffer overflow in Apple Quicktime Player 7.3.1.70 and other versions before 7.4.1, when RTSP tunneling is enabled, allows remote attackers to execute arbitrary code via a long Reason-Phrase response to an rtsp:// request, as demonstrated using a 404 error message.

  • CVE-2007-6276Dec 7, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.09

    The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a denial of service (divide-by-zero error and daemon crash) via a crafted load balancing packet to UDP port 4112.

  • CVE-2007-4676Nov 7, 2007
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.47

    Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing (1) Poly type (0x0070 through 0x0074) and (2) PackBitsRgn field (0x0099) opcodes in a PICT image.

  • CVE-2007-4677Nov 7, 2007
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.47

    Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid color table size when parsing the color table atom (CTAB) in a movie file, related to the CTAB RGB values.

  • CVE-2007-2394Jul 15, 2007
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.12

    Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file, related to improper calculations for memory allocation.

  • CVE-2007-2401Jun 25, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.07

    CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the…

  • CVE-2007-1071Feb 22, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.18

    Integer overflow in the gifGetBandProc function in ImageIO in Apple Mac OS X 10.4.8 allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image that triggers the overflow during decompression. NOTE: this…

  • CVE-2007-0646Feb 1, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.10

    Format string vulnerability in iMovie HD 6.0.3, and Safari in Apple Mac OS X 10.4 through 10.4.10, allows remote user-assisted attackers to cause a denial of service (crash) via format string specifiers in a filename, which is not properly handled when calling the…

  • CVE-2007-0614Jan 31, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.09

    The Bonjour functionality in mDNSResponder, iChat 3.1.6, and InstantMessage framework 428 in Apple Mac OS X 10.4.8 allows remote attackers to cause a denial of service (persistent application crash) via a crafted phsh hash attribute in a TXT key.

  • CVE-2007-0613Jan 31, 2007
    Apple Inc.
    Ichat
    risk 0.04cvss —epss 0.07

    The Bonjour functionality in mDNSResponder, iChat 3.1.6, and InstantMessage framework 428 in Apple Mac OS X 10.4.8 does not check for duplicate entries when adding newly discovered available contacts, which allows remote attackers to cause a denial of service (disrupted…

  • CVE-2007-0465Jan 31, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.18

    Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a (1) PKG, (2) DISTZ, or (3) MPKG package filename.

  • CVE-2007-0464Jan 30, 2007
    Cfnetwork
    Cfnetwork
    risk 0.04cvss —epss 0.15

    The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application crash) via a crafted HTTP 301 response, which results in a NULL pointer dereference.

  • CVE-2007-0463Jan 29, 2007
    Apple Inc.
    SoftwareUpdate
    risk 0.04cvss —epss 0.18

    Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in (1) SWUTMP or (2) SUCATALOG filenames, or using the (3)…

  • CVE-2007-0462Jan 26, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.07

    The _GetSrcBits32ARGB function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT image with a…

  • CVE-2007-0355Jan 19, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.07

    Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allows local users, and possibly remote attackers, to gain privileges and possibly execute arbitrary code via a registration request with an invalid attr-list…

  • CVE-2007-0197Jan 11, 2007
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.08

    Finder 10.4.6 on Apple Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long volume name in a DMG disk image, which results in memory corruption.

  • CVE-2007-0051Jan 4, 2007
    Apple Inc.
    Iphoto
    risk 0.04cvss —epss 0.09

    Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.

  • CVE-2006-5710Nov 4, 2006
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.19

    The Airport driver for certain Orinoco based Airport cards in Darwin kernel 8.8.0 in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via an 802.11 probe response frame without any valid information element (IE) fields after…

  • CVE-2006-4965Sep 25, 2006
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.13

    Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter that identifies resources outside of the original…

  • CVE-2006-4384Sep 12, 2006
    Apple Inc.
    Quicktime
    risk 0.04cvss —epss 0.16

    Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via the COLOR_64 chunk in a FLIC (FLC) movie.

  • CVE-2006-3372Jul 6, 2006
    Apple Inc.
    Safari
    risk 0.04cvss —epss 0.09

    Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call with zero arguments, which triggers a null dereference.

  • CVE-2006-1470Jun 27, 2006
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.08

    OpenLDAP in Apple Mac OS X 10.4 up to 10.4.6 allows remote attackers to cause a denial of service (crash) via an invalid LDAP request that triggers an assert error.

  • CVE-2006-2277May 10, 2006
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.07

    Multiple Apple Mac OS X 10.4 applications might allow context-dependent attackers to cause a denial of service (application crash) via a crafted OpenEXR (.exr) image file, which triggers the crash when opening a folder using Finder, displaying the image in Safari, or using…

  • CVE-2006-1985Apr 21, 2006
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.14

    Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attackers to execute arbitrary code via a crafted archive (such as ZIP) that contains long path names, which triggers an error in the BOMStackPop…

  • CVE-2006-0396Mar 14, 2006
    Apple Inc.
    Mac OS X
    risk 0.04cvss —epss 0.11

    Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5, when patched with Security Update 2006-001, allows remote attackers to execute arbitrary code via a long Real Name value in an e-mail attachment sent in AppleDouble format, which triggers the overflow when the user…

Page 114 of 181