Apple Mac Os X vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Apple Mac Os X: 57 record(s), with affected versions and fixes.cpe:2.3:o:apple:mac_os_x
CVE-2020-36221
High · 7.5
CWE-191 Jan 26, 2021
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the...
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).
CVE-2020-8286
High · 7.5
CWE-295 Dec 14, 2020
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to...
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVE-2020-8285
High · 7.5
CWE-674 Dec 14, 2020
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack...
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8284
Low · 3.7
CWE-200 Dec 14, 2020
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting...
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
CVE-2020-27932
High · 7.8
KEV High · 55 CWE-843 Dec 8, 2020
Apple Multiple Products Type Confusion Vulnerability
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to execute arbitrary code with kernel privileges.
CVE-2020-27930
High · 7.8
KEV High · 62 Public exploit CWE-787 Dec 8, 2020
Apple Multiple Products Memory Corruption Vulnerability
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. Processing a maliciously crafted font may lead to arbitrary code execution.
CVE-2020-9934
Medium · 5.5
KEV High · 57 Public exploit Oct 16, 2020
Apple iOS, iPadOS, and macOS Input Validation Vulnerability
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
CVE-2020-9859
High · 7.8
KEV High · 50 CWE-415 Jun 5, 2020
Apple Multiple Products Code Execution Vulnerability
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.
CVE-2020-12243
High · 7.5
CWE-674 Apr 28, 2020
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean...
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
CVE-2020-3837
High · 7.8
KEV High · 64 Public exploit CWE-787 Feb 27, 2020
Apple Multiple Products Memory Corruption Vulnerability
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
CVE-2019-19906
High · 7.5
CWE-193 Dec 19, 2019
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote...
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
CVE-2019-8605
High · 7.8
KEV Urgent · 70 Public exploit CWE-416 Dec 18, 2019
Apple Multiple Products Use-After-Free Vulnerability
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
CVE-2019-8526
High · 7.8
KEV High · 49 CWE-416 Dec 18, 2019
Apple macOS Use-After-Free Vulnerability
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.
CVE-2019-7286
High · 7.8
KEV High · 64 Public exploit CWE-787 Dec 18, 2019
Apple Multiple Products Memory Corruption Vulnerability
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
CVE-2019-13565
High · 7.5
Jul 26, 2019
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session...
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
CVE-2019-13057
Medium · 4.9
Jul 26, 2019
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator...
An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
CVE-2018-4344
High · 7.8
KEV High · 54 CWE-119 Apr 3, 2019
Apple Multiple Products Memory Corruption Vulnerability
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.
CVE-2019-6223
High · 7.5
KEV High · 54 Mar 5, 2019
Apple iOS and macOS Group Facetime Vulnerability
A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.
CVE-2019-8906
Medium · 4.4
CWE-125 Feb 18, 2019
Out-of-bounds Read in File Project File
do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.
CVE-2016-9841
Critical · 9.8
May 23, 2017
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified…
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVE-2016-9840
High · 8.8
May 23, 2017
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified…
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVE-2016-4658
Critical · 9.8
CWE-119 Sep 25, 2016
Nokogiri does not forbid namespace nodes in XPointer ranges
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
CVE-2016-5131
High · 8.8
CWE-416 Jul 23, 2016
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743...
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
CVE-2016-0718
Critical · 9.8
CWE-119 May 26, 2016
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Mozilla Firefox
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
CVE-2016-1839
Medium · 5.5
Public exploit CWE-125 May 20, 2016
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X...
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.