Advisories
OtherPoC exploitCRITICAL2009-08-11
Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute t...
CVEs:CVE-2009-2416
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
OtherPoC exploitMEDIUM2009-08-21
neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via ...
CVEs:CVE-2009-2474
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
SafariEPSS <= 49%HIGH2009-08-12
Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted floating-point numbers.
CVEs:CVE-2009-2195
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| safari |
affected |
apple |
— |
— |
macOSEPSS <= 49%HIGH2009-08-06
Buffer overflow in the kernel in Apple Mac OS X 10.5 before 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a crafted AppleTalk response packet.
CVEs:CVE-2009-2193
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
iOSEPSS <= 49%HIGH2009-08-03
Unspecified vulnerability in the CoreTelephony component in Apple iPhone OS before 3.0.1 allows remote attackers to execute arbitrary code, obtain GPS coordinates, or enable the microphone via an SMS message that triggers memory corruption, as demonstr...
CVEs:CVE-2009-2204
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
macOSEPSS <= 49%HIGH2009-08-06
Heap-based buffer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image containing an embedded ColorSync profile.
CVEs:CVE-2009-1726
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
macOSEPSS <= 49%HIGH2009-08-06
Buffer overflow in ImageIO in Apple Mac OS X 10.5 before 10.5.8, and Safari before 4.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with crafted EXIF metadata.
CVEs:CVE-2009-2188
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
macOSEPSS <= 49%CRITICAL2009-08-06
Stack-based buffer overflow in Image RAW in Apple Mac OS X 10.5 before 10.5.8, and 10.4 before Digital Camera RAW Compatibility Update 2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted...
CVEs:CVE-2009-1728
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
SafariEPSS <= 49%MEDIUM2009-08-12
Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors.
CVEs:CVE-2009-2196
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
macOSEPSS <= 49%HIGH2009-08-06
launchd in Apple Mac OS X 10.5 before 10.5.8 allows remote attackers to cause a denial of service (individual service outage) by making many connections to an inetd-based launchd service.
CVEs:CVE-2009-2190
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
macOSEPSS <= 49%CRITICAL2009-08-06
Format string vulnerability in Login Window in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in an application name.
CVEs:CVE-2009-2191
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
macOSEPSS <= 49%CRITICAL2009-08-06
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X 10.5 before 10.5.8 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the l...
CVEs:CVE-2009-1727
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
iOSEPSS <= 49%MEDIUM2009-08-12
Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing...
CVEs:CVE-2009-2199
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
macOSEPSS <= 49%HIGH2009-08-06
MobileMe in Apple Mac OS X 10.5 before 10.5.8 does not properly delete credentials upon signout from the preference pane, which makes it easier for attackers to hijack a MobileMe session via unspecified vectors, related to a "logic issue."
CVEs:CVE-2009-2192
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
SafariEPSS <= 49%HIGH2009-08-12
WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HT...
CVEs:CVE-2009-2200
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| safari |
affected |
apple |
— |
— |
SafariEPSS <= 49%MEDIUM2009-08-04
Apple GarageBand before 5.1 reconfigures Safari to accept all cookies regardless of domain name, which makes it easier for remote web servers to track users.
CVEs:CVE-2009-2198
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| garageband |
affected |
apple |
— |
— |
macOSEPSS <= 49%MEDIUM2009-08-06
CFNetwork in Apple Mac OS X 10.5 before 10.5.8 places an incorrect URL in a certificate warning in certain 302 redirection scenarios, which makes it easier for remote attackers to trick a user into visiting an arbitrary https web site by leveraging an ...
CVEs:CVE-2009-1723
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
SafariEPSS <= 49%CRITICAL2009-08-31
Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains ...
CVEs:CVE-2009-3016
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| safari |
affected |
apple |
— |
— |
macOSEPSS <= 49%MEDIUM2009-08-06
Apple Mac OS X 10.5 before 10.5.8 does not properly share file descriptors over local sockets, which allows local users to cause a denial of service (system crash) by placing file descriptors in messages sent to a socket that has no receiver, related t...
CVEs:CVE-2009-2194
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
macOSEPSS <= 49%HIGH2009-08-06
The screen saver in Dock in Apple Mac OS X 10.5 before 10.5.8 does not prevent four-finger Multi-Touch gestures, which allows physically proximate attackers to bypass locking and "manage applications or use Expose" via unspecified vectors.
CVEs:CVE-2009-0151
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
| mac_os_x_server |
affected |
apple |
— |
— |
