CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple : Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1401 CVE-2008-3626 119 DoS Exec Code Overflow Mem. Corr. 2008-09-11 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample_size_table in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file.
1402 CVE-2008-3613 399 DoS 2008-09-16 2017-08-08
6.1
None Local Network Low Not required None None Complete
Finder in Apple Mac OS X 10.5.2 through 10.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving a search for a remote disk on the local network.
1403 CVE-2008-3611 287 Bypass 2008-09-16 2017-08-08
6.3
None Local Medium Not required None Complete Complete
Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new password on the same login screen.
1404 CVE-2008-3170 264 2008-07-14 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746, CVE-2004-0866, and CVE-2004-0867.
1405 CVE-2008-2310 134 DoS Exec Code 2008-07-01 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.
1406 CVE-2008-2309 264 Exec Code 2008-07-01 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.4 allows user-assisted remote attackers to execute arbitrary code via a (1) .xht or (2) .xhtm file, which does not trigger a "potentially unsafe" warning message in (a) the Download Validation feature in Mac OS X 10.4 or (b) the Quarantine feature in Mac OS X 10.5.
1407 CVE-2008-2304 119 DoS Exec Code Overflow 2008-07-14 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow in Apple Core Image Fun House 2.0 and earlier in CoreImage Examples in Xcode tools before 3.1 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a .funhouse file with a string XML element that contains many characters.
1408 CVE-2008-1739 399 DoS Exec Code Mem. Corr. 2008-09-03 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
Apple QuickTime before 7.4.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted ftyp atoms in a movie file, which triggers memory corruption.
1409 CVE-2008-1585 20 2008-06-10 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file: URLs.
1410 CVE-2008-1584 119 DoS Exec Code Overflow 2008-06-10 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in Indeo.qtx in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted Indeo video codec content in a movie file.
1411 CVE-2008-1583 119 DoS Exec Code Overflow 2008-06-10 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PICT image, a different vulnerability than CVE-2008-1581.
1412 CVE-2008-1582 399 DoS Exec Code Mem. Corr. 2008-06-10 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Unspecified vulnerability in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AAC-encoded file that triggers memory corruption.
1413 CVE-2008-1576 399 DoS Exec Code +Info 2008-06-02 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Mail in Apple Mac OS X before 10.5, when an IPv6 SMTP server is used, does not properly initialize memory, which might allow remote attackers to execute arbitrary code or cause a denial of service (application crash), or obtain sensitive information (memory contents) in opportunistic circumstances, by sending an e-mail message.
1414 CVE-2008-1374 190 Exec Code Overflow 2008-04-04 2020-12-23
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in pdftops filter in CUPS in Red Hat Enterprise Linux 3 and 4, when running on 64-bit platforms, allows remote attackers to execute arbitrary code via a crafted PDF file. NOTE: this issue is due to an incomplete fix for CVE-2004-0888.
1415 CVE-2008-1032 Exec Code 2008-06-02 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via an (1) Automator, (2) Help, (3) Safari, or (4) Terminal content type for a downloadable object, which does not trigger a "potentially unsafe" warning message in (a) the Download Validation feature in Mac OS X 10.4 or (b) the Quarantine feature in Mac OS X 10.5.
1416 CVE-2008-1023 119 Exec Code Overflow 2008-04-04 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in Clip opcode parsing in Apple QuickTime before 7.4.5 on Windows allows remote attackers to execute arbitrary code via a crafted PICT image file.
1417 CVE-2008-1022 119 Exec Code Overflow 2008-04-04 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in Apple QuickTime before 7.4.5 allows remote attackers to execute arbitrary code via a crafted VR movie with an obji atom of zero size.
1418 CVE-2008-1021 119 Exec Code Overflow 2008-04-04 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in Animation codec content handling in Apple QuickTime before 7.4.5 on Windows allows remote attackers to execute arbitrary code via a crafted movie with run length encoding.
1419 CVE-2008-1020 119 Exec Code Overflow 2008-04-04 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in quickTime.qts in Apple QuickTime before 7.4.5 on Windows allows remote attackers to execute arbitrary code via a crafted PICT image file with Kodak encoding, related to error checking and error messages.
1420 CVE-2008-1019 119 Exec Code Overflow 2008-04-04 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in quickTime.qts in Apple QuickTime before 7.4.5 allows remote attackers to execute arbitrary code via a crafted PICT image file, related to an improperly terminated memory copy loop.
1421 CVE-2008-1018 119 Exec Code Overflow 2008-04-04 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in Apple QuickTime before 7.4.5 allows remote attackers to execute arbitrary code via an MP4A movie with a malformed Channel Compositor (aka chan) atom.
1422 CVE-2008-1017 119 Exec Code Overflow 2008-04-04 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in clipping region (aka crgn) atom handling in quicktime.qts in Apple QuickTime before 7.4.5 allows remote attackers to execute arbitrary code via a crafted movie.
1423 CVE-2008-1016 94 Exec Code Mem. Corr. 2008-04-04 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Apple QuickTime before 7.4.5 does not properly handle movie media tracks, which allows remote attackers to execute arbitrary code via a crafted movie that triggers memory corruption.
1424 CVE-2008-1015 119 Exec Code Overflow 2008-04-04 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow in the data reference atom handling in Apple QuickTime before 7.4.5 allows remote attackers to execute arbitrary code via a crafted movie.
1425 CVE-2008-1013 Exec Code 2008-04-04 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Apple QuickTime before 7.4.5 enables deserialization of QTJava objects by untrusted Java applets, which allows remote attackers to execute arbitrary code via a crafted applet.
1426 CVE-2008-1010 119 Exec Code Overflow 2008-03-19 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow in WebKit, as used in Apple Safari before 3.1, allows remote attackers to execute arbitrary code via crafted regular expressions in JavaScript.
1427 CVE-2008-0998 264 Exec Code Bypass 2008-03-18 2017-08-08
6.9
None Local Medium Not required Complete Complete Complete
Unspecified vulnerability in NetCfgTool in the System Configuration component in Apple Mac OS X 10.4.11 and 10.5.2 allows local users to bypass authorization and execute arbitrary code via crafted distributed objects.
1428 CVE-2008-0997 119 DoS Exec Code Overflow 2008-03-18 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows user-assisted remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted PostScript Printer Description (PPD) file that is not properly handled when querying a network printer.
1429 CVE-2008-0989 134 Exec Code 2008-03-18 2017-08-08
6.9
None Local Medium Not required Complete Complete Complete
Format string vulnerability in mDNSResponderHelper in Apple Mac OS X 10.5.2 allows local users to execute arbitrary code via format string specifiers in the local hostname.
1430 CVE-2008-0894 DoS 2008-02-21 2018-10-15
6.8
None Remote Medium Not required Partial Partial Partial
Apple Safari might allow remote attackers to obtain potentially sensitive memory contents or cause a denial of service (crash) via a crafted (1) bitmap (BMP) or (2) GIF file, a related issue to CVE-2008-0420.
1431 CVE-2008-0060 94 2008-03-18 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Help Viewer in Apple Mac OS X 10.4.11 and 10.5.2 allows remote attackers to execute arbitrary Applescript via a help:topic_list URL that injects HTML or JavaScript into a topic list page, as demonstrated using a help:runscript link.
1432 CVE-2008-0057 189 Exec Code Overflow 2008-03-18 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Multiple integer overflows in a "legacy serialization format" parser in AppKit in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via a crafted serialized property list.
1433 CVE-2008-0056 119 Exec Code Overflow 2008-03-18 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in Foundation in Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a "long pathname with an unexpected structure" that triggers the overflow in NSFileManager.
1434 CVE-2008-0054 20 Exec Code 2008-03-18 2017-08-08
6.4
None Remote Low Not required None Partial Partial
Foundation in Apple Mac OS X 10.4.11 might allow context-dependent attackers to execute arbitrary code via a malformed selector name to the NSSelectorFromString API, which causes an "unexpected selector" to be used.
1435 CVE-2008-0052 200 +Info 2008-03-18 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
CoreServices in Apple Mac OS X 10.4.11 treats .ief as a safe file type, which allows remote attackers to force Safari users into opening an .ief file in AppleWorks, even when the "Open 'Safe' files" preference is set.
1436 CVE-2008-0051 189 Exec Code Overflow 2008-03-18 2017-08-08
6.9
None Local Medium Not required Complete Complete Complete
Integer overflow in CoreFoundation in Apple Mac OS X 10.4.11 might allow local users to execute arbitrary code via crafted time zone data.
1437 CVE-2008-0048 119 Exec Code Overflow 2008-03-18 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via the a long file name to the NSDocument API.
1438 CVE-2008-0042 94 Exec Code 2008-02-12 2011-03-08
6.8
None Remote Medium Not required Partial Partial Partial
Argument injection vulnerability in Terminal.app in Terminal in Apple Mac OS X 10.4.11 and 10.5 through 10.5.1 allows remote attackers to execute arbitrary code via unspecified URL schemes.
1439 CVE-2008-0036 119 Exec Code Overflow 2008-01-16 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow in Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, which triggers the overflow during decoding.
1440 CVE-2007-5861 399 DoS Exec Code Mem. Corr. 2007-12-19 2017-07-29
6.8
None Remote Medium Not required Partial Partial Partial
Unspecified vulnerability in Spotlight in Apple Mac OS X 10.4.11 allows user-assisted attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted .XLS file that triggers memory corruption in the Microsoft Office Spotlight Importer.
1441 CVE-2007-5857 264 +Info 2007-12-19 2017-07-29
6.4
None Remote Low Not required Partial Partial None
Quick Look in Apple Mac OS X 10.5.1 does not prevent a movie from accessing URLs when the movie file is previewed or if an icon is created, which might allow remote attackers to obtain sensitive information via HREFTrack.
1442 CVE-2007-5855 287 2007-12-19 2017-07-29
6.4
None Remote Low Not required Partial Partial None
Mail in Apple Mac OS X 10.4.11 and 10.5.1, when an SMTP account has been set up using Account Assistant, can use plaintext authentication even when MD5 Challenge-Response authentication is available, which makes it easier for remote attackers to sniff account activity.
1443 CVE-2007-5847 362 +Info 2007-12-19 2017-07-29
6.6
None Local Low Not required Complete Complete None
Race condition in the CFURLWriteDataAndPropertiesToResource API in Core Foundation in Apple Mac OS X 10.4.11 creates files with insecure permissions, which might allow local users to obtain sensitive information.
1444 CVE-2007-4706 119 Exec Code Overflow 2007-12-15 2017-07-29
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in Apple QuickTime before 7.3.1 allows remote attackers to execute arbitrary code via a crafted QTL file.
1445 CVE-2007-4697 DoS Exec Code Mem. Corr. 2007-11-15 2017-07-29
6.8
None Remote Medium Not required Partial Partial Partial
Unspecified vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via unknown vectors related to browser history, which triggers memory corruption.
1446 CVE-2007-4684 119 Exec Code Overflow 2007-11-15 2018-10-15
6.9
None Local Medium Not required Complete Complete Complete
Integer overflow in the kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a large num_sels argument to the i386_set_ldt system call.
1447 CVE-2007-4682 119 DoS Exec Code Overflow 2007-11-15 2017-07-29
6.8
None Remote Medium Not required Partial Partial Partial
CoreText in Apple Mac OS X 10.4 through 10.4.10 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted text content that triggers an access of an uninitialized object pointer.
1448 CVE-2007-4681 119 DoS Exec Code Overflow 2007-11-15 2017-07-29
6.9
None Local Medium Not required Complete Complete Complete
Buffer overflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted directory hierarchy.
1449 CVE-2007-4680 287 2007-11-15 2017-07-29
6.8
None Remote Medium Not required Partial Partial Partial
CFNetwork in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 does not properly validate certificates, which allows remote attackers to spoof trusted SSL certificates via a man-in-the-middle attack.
1450 CVE-2007-4674 189 Exec Code Overflow 2007-11-27 2018-10-15
6.8
None Remote Medium Not required Partial Partial Partial
An "integer arithmetic" error in Apple QuickTime 7.2 allows remote attackers to execute arbitrary code via a crafted movie file containing a movie atom with a large size value, which triggers a stack-based buffer overflow.
Total number of vulnerabilities : 1465   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 (This Page)30
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.