Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · December 2004 — Apple Security Advisories
19 advisories 19 CVEs

Apple-vendor CVEs for 2004-12. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2004-2687

XcodeWeaponized exploitHIGH2004-12-31

distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.

CVEs:CVE-2004-2687

Affected products

ProductStatusVendorPackageEcosystem
xcode affected apple — —
Upstream advisory

CVE-2004-1307

OtherEPSS <= 49%CRITICAL2004-12-21

Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be all...

CVEs:CVE-2004-1307

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2004-1086

macOSEPSS <= 49%CRITICAL2004-12-02

Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file.

CVEs:CVE-2004-1086

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

CVE-2004-1314

SafariEPSS <= 49%HIGH2004-12-22

Safari 1.x allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "windo...

CVEs:CVE-2004-1314

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2004-1122

SafariEPSS <= 49%HIGH2004-12-10

Safari 1.x to 1.2.4, and possibly other versions, allows inactive windows to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows, aka the "Dialog Box Spoofing Vulnerability," a different vulne...

CVEs:CVE-2004-1122

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2004-2154

OtherEPSS <= 49%CRITICAL2004-12-31

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive.

CVEs:CVE-2004-2154

Affected products

ProductStatusVendorPackageEcosystem
cups affected apple — —
Upstream advisory

CVE-2004-0429

macOSEPSS <= 49%HIGH2004-12-31

Unknown vulnerability related to "the handling of large requests" in RAdmin for Apple Mac OS X 10.3.3 and Mac OS X 10.2.8 may allow attackers to have unknown impact via unknown attack vectors.

CVEs:CVE-2004-0429

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2004-1083

macOSEPSS <= 49%HIGH2004-12-03

Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ...

CVEs:CVE-2004-1083

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

CVE-2004-1832

macOSEPSS <= 49%CRITICAL2004-12-31

Buffer overflow in the GUI admin service in Mac OS X Server 10.3 allows remote attackers to cause a denial of service (crash and restart) via a large amount of data to TCP port 660.

CVEs:CVE-2004-1832

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x_server affected apple — —
Upstream advisory

CVE-2004-0090

macOSEPSS <= 49%HIGH2004-12-31

Unknown vulnerability in Windows File Sharing for Mac OS X 10.1.5 through 10.3.2 does not "shutdown properly," which has unknown impact and attack vectors.

CVEs:CVE-2004-0090

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2004-1088

macOSEPSS <= 49%HIGH2004-12-02

Postfix server for Apple Mac OS X 10.3.6, when using CRAM-MD5, allows remote attackers to send mail without authentication by replaying authentication information.

CVEs:CVE-2004-1088

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

CVE-2004-1199

macOSEPSS <= 49%HIGH2004-12-15

Safari 1.2.4 on Mac OS X 10.3.6 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.

CVEs:CVE-2004-1199

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2004-1084

macOSEPSS <= 49%CRITICAL2004-12-02

Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+, which bypass Apache file handles.

CVEs:CVE-2004-1084

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

CVE-2004-1123

OtherEPSS <= 49%HIGH2004-12-05

Darwin Streaming Server 5.0.1, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) via a DESCRIBE request with a location that contains a null byte.

CVEs:CVE-2004-1123

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

CVE-2004-0824

macOSEPSS <= 49%LOW2004-12-31

PPPDialer for Mac OS X 10.2.8 through 10.3.5 allows local users to overwrite system files via a symlink attack on PPPDialer log files.

CVEs:CVE-2004-0824

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2004-1087

macOSEPSS <= 49%LOW2004-12-02

Terminal for Apple Mac OS X 10.3.6 may indicate that "Secure Keyboard Entry" is enabled even when it is not, which could result in a false sense of security for the user.

CVEs:CVE-2004-1087

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

CVE-2004-1089

macOSEPSS <= 49%MEDIUM2004-12-02

Unknown vulnerability in Apple Mac OS X 10.3.6 server, when using Kerberos authentication and Cyrus IMAP allows local users to access mailboxes of other users.

CVEs:CVE-2004-1089

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

CVE-2004-1081

macOSEPSS <= 49%LOW2004-12-02

The Application Framework (AppKit) for Apple Mac OS X 10.2.8 and 10.3.6 does not properly restrict access to a secure text input field, which allows local users to read keyboard input from other applications within the same window session.

CVEs:CVE-2004-1081

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

CVE-2004-1085

OtherEPSS <= 49%HIGH2004-12-02

Human Interface Toolbox (HIToolBox) for Apple Mac 0S X 10.3.6 allows local users to exit applications via the force-quit key combination, even when the system is running in kiosk mode.

CVEs:CVE-2004-1085

Affected products

ProductStatusVendorPackageEcosystem
darwin_streaming_server affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
quicktime_streaming_server affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console